vulnerability in node dependency

[etsauer]

@rdebeasi the suggested resolution below is quite a bit newer than what we have in our package.json. can we upgrade?

[rdebeasi]

Looks like this is a problem with node-sass v4, which is a dependency of the gulp-sass package that we're using. The problem has been fixed in v5.

We'll probably need to wait for the node-sass folks to either release v5 or backport the fix to v4. The good news is that this dependency is used only when building the theme, so the impact of the vulnerability is most likely limited.

[stale]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.