Update localtunnel to fix axios vulnerability (CVE-2021-3749)

[raniesantos]

Issue details

axios has fixed this vulnerability.

localtunnel which depends on axios has also updated the version it uses.

browser-sync still depends on a vulnerable version of localtunnel and needs to be updated.

browser-sync/packages/browser-sync/package-lock.json

Line 1506 in a7c14c8

"version": "2.0.1",

Steps to reproduce/test case

N/A

Please specify which version of Browsersync, node and npm you're running

• Browsersync: 2.27.7
• Node: 12.16.1
• Npm: 6.13.4

Affected platforms

all of them

Browsersync use-case

N/A

If CLI, please paste the entire command below

N/A

for all other use-cases, (gulp, grunt etc), please show us exactly how you're using Browsersync

N/A

[raniesantos]

Related localtunnel/localtunnel#431

Waiting for localtunnel maintainer to publish the fix that was merged

[raniesantos]

localtunnel 2.0.2 has been published by its maintainer.

[Levdbas]

Hi @shakyShane, doyou have time to take care of the following vulnerability?

[sjaks]

This issue is still relevant since the required axios version is still outdated.

[raniesantos]

@sjaks then go bother the maintainer yourself, I'm sick of waiting.

[Levdbas]

Well, at least keep the issue open for us then and remove yourself from the notifications.

[antongolub]

Technically there's nothing to fix here. browser-sync depends on localtunnel@^2.0.1. v2.0.2 (which already has the axios fix) matches to semver range^2.0.1. So the only thing that is needed is just to update the lockfile in your local project.