Chris Barrick

Thanks for the contribution! I'm excited to see real users out there. IIUC this patch is using the naive algorithm for computing variance. The original algorithm used here is [Welford's...

Also, the contributors file is unnecessary. Git tracks that metadata automatically.

By changing the method signatures from `Stats` to `*Stats`, you are changing the semantics. The original version does not modify the stats object. It may be worth it to change,...

Currently the stderr of the process is not exposed, but that could easily be changed. Do you have any suggestions for an interface? Perhaps there could be an option called...

Unfortunately, I don't have a Windows machine to work on this. Does this happen with the `usePowerShell` option?

On Unix, `sh -c COMMAND` expects all of the command to be a single argument to `sh` (i.e. enclosed in quotes when typing into a terminal), but on Windows it...

According to that same site,`powershell -Command COMMAND` expects the command as a single argument, so you may be able to setup powershell as a workaround until this gets fixed.

I pushed an untested fix as c5ad8a0. When I test it, and if it works, I'll push it to npm.

That use case is definitely important to this project. Actually, that's why I chose to run commands through a subshell rather than executing them directly. All higher-level shell features are...

It is difficult to fix a security issue from a transitive dependency. The best solution may be to submit a patch to gulp-util and convince them to do a release....