I received a Dependabot security alert for a repo that's using browser-sync 3.0.4 concerning Immutable being vulnerable to Immutable.js List 32-bit trie overflow:
Dependabot cannot update immutable to a non-vulnerable version
The latest possible version that can be installed is 3.8.3 because of the following conflicting dependencies:
browser-sync@3.0.4 requires immutable@^3
browser-sync@3.0.4 requires immutable@^3 via browser-sync-ui@3.0.4
A patched version exists for immutable, but the available update path still resolves it to 3.8.3
The earliest fixed version is 4.3.9.
Similar to issue #2111
Is there a plan for a browser-sync update to handle this?
I received a Dependabot security alert for a repo that's using browser-sync 3.0.4 concerning Immutable being vulnerable to Immutable.js
List32-bit trie overflow:Similar to issue #2111
Is there a plan for a browser-sync update to handle this?