Ping @TheBoroer

Would you be able to look into this any time soon?

@strangelookingnerd oh man I hope @TheBoroer will merge this. Nobody wants any issues with localtunnel.

@TheBoroer please merge this!

Since he's not responding, I'm just going to throw this out there: If you're worried about the security in your app and you're using localtunnel, you can upgrade it manually. Just run:

npm install axios --save

And you should be good to go.

I gave up waiting so I forked, patched, and published my own version to npm (https://www.npmjs.com/package/@security-patched/localtunnel)

browser-sync have also just recently dropped localtunnel as a dependency because of this issue.

+1
It would be nice to have this PR approved. Currently, Angular 17 ("@angular-devkit/build-angular": "^17.0.10") has a dependency on this library which in turn has a dependency on Axios. The npm audit reports a moderate severity vulnerability. Actual risk seems low since it's within the devDependencies; however, the error messages trigger security audits at large companies.
: (

The reason this sadly isn't being merged is because @TheBoroer doesn't have edit perms on this repo, neither to npm

Still waiting for the PR to be approved so we can migrate to Angular 17..