Dependency on sshpk@1.13.1 which contains security vulnerability

[lastrader]

https://nodesecurity.io/advisories/606
Can you update to use sshpk >=1.14.1?

[knoxcard]

I submitted a PR here, but we need a maintainer to merge...#68

Where have all maintainers gone?
Long time passing...
When will they ever learn?

[dpxxdp]

Hi- can the maintainer please merge this?

[ar000n]

@arekinath can you merge this pull request? It's a serious vulnerability

[sc0ttkclark]

cc: @trentm @jclulow who both seem to be part of Joyent still

[jiacfan]

@trentm @jclulow Would there be a recent release mitigate this security vulnerable? The PR is merged for days, and a new release is wished.

Thanks,
Jiachen

[wfortin]

https://app.snyk.io/vuln/npm:sshpk:20180409 snyk is also complaining about this vulnerability, any way to update sshpk?
I've explicitly set the version of sshpk to circumvent this, but I would be great to have official support for this fix.

[jlamillan]

This looks resolved: https://github.com/joyent/node-http-signature/blob/master/package.json#L35