browser-sync dependency vulnerability (localtunnel -> axios)

[april]

Issue details

browser-sync depends upon localtunnel 1.9.1, which depends upon axios 0.17.1, which has an outstanding security vulnerability. This causes warnings across every GitHub repo that is using browser-sync.

Steps to reproduce/test case

Have localtunnel 1.9.1 in your package-lock.json.

Please specify which version of Browsersync, node and npm you're running

• Browsersync [ 1.9.1 ]
• Node [ ]
• Npm [ ]

Affected platforms

• [x] linux
• [x] windows
• [x] OS X
• [x] freebsd
• [x] solaris
• [x] other _(please specify which)_

Browsersync use-case

• [ ] API
• [ ] Gulp
• [x] Grunt
• [ ] CLI

If CLI, please paste the entire command below

N/A

for all other use-cases, (gulp, grunt etc), please show us exactly how you're using

The vulnerability warning can be seen here:
https://github.com/mozilla/ssl-config-generator/network/alert/package-lock.json/axios/open

This issue is dependent upon the following issue:
https://github.com/localtunnel/localtunnel/issues/302

[gverni]

The localtunnel issue is now fixed in version 1.9.2.

[snuggs]

@gverni GREAT!

@april waiting on @gaards to merge.

@shakyShane any chance of expediting the merge of this vulnerability fix?
I know you took care of the last few.

[dippas]

This is happening again , localtunnel has axios v0.19.0, and it is fixed in v0.21.1

[morozgrafix]

localtunnel issue that tracks ☝️ https://github.com/localtunnel/localtunnel/issues/377

[snuggs]

....and here we are again. At least i'm not the only one that this issue popped up on. Was having DeJa Vú thinking this was fixed already.

/ping @gaards @shakyShane 🙏🏽

[alexkuc]

@snuggs made a new issue to keep track of it (#1831)

[dippas]

localtunell just release v2.0.1, please update