Reported vulnerability in dependency randomatic (< 3.0.0)

[soundasleep]

NVD has issued https://nvd.nist.gov/vuln/detail/CVE-2017-16028 which captures one of browser-syncs' sub-dependencies: randomatic (1.1.7).

$ npm ls randomatic
my-package@0.1.0 /Users/jevon/workspace/my-package
└─┬ browser-sync@2.26.0
  └─┬ micromatch@2.3.11
    └─┬ braces@1.8.5
      └─┬ expand-range@1.8.2
        └─┬ fill-range@2.2.3
          └── randomatic@1.1.7

I'm not sure if you need to update your dependencies, or if the CVE itself needs to be fixed, but as it stands I think any project using browser-sync will fail npm audit.

See also: jonschlinkert/randomatic#15

[shakyShane]

@soundasleep hopefully 2.26.2 solves this (although I couldn't actually get npm audit to fail for me)