critical vulnerability

[takezaki]

npm audit shows critical vulnerability of gulp-webserver.
Is there plan to fix it?

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical      │ Command Injection                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ open                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gulp-webserver [dev]                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp-webserver > open                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/663                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

[ranbuch]

@schickling can you please share whether you have plans to fix this issue or not?

[manzanit0]

I think at this point, it makes sense to use https://github.com/avevlad/gulp-connect. It doesn't have any vulnerabilities and works just the same. It took me ~3 minutes to swap libraries.