http-proxy denial of service vulnerability

[fozzleberry]

bumped http-proxy to >=1.18.1 to fix Denial of Service vulenrability from NPM Audit

fixes #1764

REQUIRES DROPPING NODE V6

[mattshirlaw-finocomp]

@fozzleberry in the comments to the linked issue @denisbrodbeck mentioned that http-proxy 1.18.1 drops support for node 6. Since browser-sync still supports node 6 is this PR going to break anything?

[fozzleberry]

@mattshirlaw-finocomp I assumed it wouldn't have with it only being a minor semver bump. But yes, it will. They bumped the node "engines" to >= 8.0.0

I'm guessing they support the last 3 LTS versions of node only

https://github.com/http-party/node-http-proxy/pull/1397/files

[mattshirlaw-finocomp]

Ugh 😢 does anyone know what needs to change in browser-sync to drop support for node 6 and make a minor or major version bump for those of us who don't care about node 6

[fozzleberry]

if you need a quick (and dirty) fix you can clone my fork.

Its up to the maintainers how they progress with node 6 support

[XhmikosR]

@shakyShane that's why dependencies shouldn't be locked :/

I know the downsides, but the approach with locking deps requires someone to be able to act fast, which doesn't seem to be the case for this project.

[jeffschwartz]

Can we get a status update on this? Is this project dead?

[shakyShane]

browser-sync@2.26.9 :)