finalhandler vulnerability about connect

[dougwilson]

Please see the conversation here: pillarjs/finalhandler#26 (comment)

There is no fix, npm has blacklisted the module and no response so far from npm, so we're waiting to hear back on what to do.

[XhmikosR]

Thanks for the reply.

Still I think you should use the semver operators so that such issues can be fixed more easily.

[dougwilson]

We don't need to agree on this. I planned to published a new connect as soon as there is a finalhandler version to change, so there is no issue here and it would have changed anything in this situation, either.

[XhmikosR]

I understand your point of view, but issues like this one wouldn't require anyone to have to push a new release just for a dep patch version.

[dougwilson]

I maintain both, and am happy to do just that. This conversation is off topic from the original issue.

[dougwilson]

This no longer shows up in npm audit.