Included version of ws (transitive dependency) has a high severity security issue about lightstep-tracer-javascript

[austinlparker]

Thanks for opening this issue - we are aware of the ws vulnerability and plan to update thrift in order to resolve it. As you noticed, there are incompatibilities with older node.js versions and thrift 0.11. We're working internally to ensure we can deprecate these versions in a new release, but let me see if I can get the ball rolling in the hopes of getting a release out sooner rather than later.

In the mean time, we analyzed the reported ws vulnerabilities and believe them to be low impact. If you require a write-up, please email me at [email protected] and I can share it with you.

[austinlparker]

Just a quick update - after some internal discussion, we're going to go-ahead with dropping support for older node versions. I should be able to get to it early next week as I'm returning from Kubecon today. Thanks for your patience!

[esarafianou]

Thanks for the followup @austinlparker, I really appreciate it.