Depends on handlebars v4.0.1 which has a severe security vulnerability

Question

Depends on handlebars v4.0.1 which has a severe security vulnerability

IanKemp opened this issue 5 years ago · comments

Ian Kemp commented 5 years ago

Please see https://www.npmjs.com/advisories/1164

MANOJ G commented 5 years ago

+1

Ano Shukla · Answer 1 · Thu Oct 10 2019 15:17:39 GMT+0800 (China Standard Time)

Also see: https://app.snyk.io/vuln/npm:istanbul

@gotwarlost , any ETA on this?

Ian Kemp · Answer 2 · Thu Oct 10 2019 15:55:30 GMT+0800 (China Standard Time)

BTW, I'm fully aware that this package is deprecated, but a lot of projects still depend on it, hence why I think a release just to update the dependencies would be justified.