browserify-middleware icon indicating copy to clipboard operation
browserify-middleware copied to clipboard

please update watchify to fix CVE-2020-28469

Open sseide opened this issue 4 years ago • 0 comments

browserify-middleware requires older 3.x version of watchify that depends on old chokidar releases fetching an insecure version of glob-parent without any change to update to the fixed glob-parent release. This dependency problem is resolved with updating watchify to current version.

Updating watchify to current 4.0 release requires at least NodeJS 8.x - but 8.x is End-Of-Life by now without any fixes whatsoever, there should not be any problem.

Thanks

sseide avatar Mar 24 '21 08:03 sseide