Wrong security information

[maxrimue]

My module depends on express, which is currently in version 4.12.4.
On the dependency site of my repo, it says that there are "security vulnerabilities in dependencies", and it tells me that there's a problem with express, and also shows me a link to the Node Security Project for further information. However, on that site, it says the security problem has been patched with version 4.5, and since I declared in my package.json the version "4.x.x" of express, it should be all fine. Any clue?

[alanshaw]

You need to change your version range to not include the vulnerable version - ^4.5 should probably work

[maxrimue]

Thanks!