High severity vulnerability (axios)

Adding browser-sync as a dependency results in npm audit warning:

found 1 high severity vulnerability

Further details:

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Server-Side Request Forgery                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ axios                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.21.1                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ browser-sync [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ browser-sync > localtunnel > axios                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1594                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 high severity vulnerability in 212 scanned packages
  1 vulnerability requires manual review. See the full report for details.

Steps to reproduce:

1. mkdir test && cd test
2. npm init
3. npm install -D browser-sync
4. npm audit

It looks like localtunnel already has a GH issue on this: https://github.com/localtunnel/localtunnel/issues/377

So I guess we need to wait for localtunnel to fix the issue and then bump dependency here?

Ps. in the past a similar issue has happened (https://github.com/BrowserSync/browser-sync/issues/1695)

[mattwelke]

@thomas-gordon That worked for me. GitHub’s automated security updates couldn’t figure out how to make a PR for me since browser-sync’s version didn’t need to be updated. Uninstalling and re-installing browser-sync updated the localtunnel transitive dependency to 2.0.1 which updated the axios transitive dependency to 0.21.0, resolving the security issue.

Because there’s no need to do anything to browser-sync to resolve this now, this issue should be closed.

[waldyrious]

To expand on @mattwelke’s comment, the localtunnel dependency was upgraded from 1.9.2 to ^2.0.0 back in July; so as soon as 2.0.1 (which matches the ^2.0.0 version spec) on localtunnel was released with the fix, any new installations of browser-sync will now automatically pick that up. Yay for caret version ranges!