Any plan bump debug package to 3.1.0 for CVE-2017-20165?

[zhhsun]

CVE-2017-20165: https://nvd.nist.gov/vuln/detail/CVE-2017-20165

[dougwilson]

Hello, and thank you for your report. I took a look at that report, and it looks like this module is already using the patched version, 2.9.6. Take a look at https://nvd.nist.gov/vuln/detail/CVE-2017-20165 which shows it is in reference to the fix listed at debug-js/debug#504 . That fix was backported to 2.x as well as 3.x and released as 2.6.9: debug-js/debug#504 (comment) . I hope that helps!

Edit: your first link to GHSA-9vvw-cc9w-f27h also shows 2.6.9 is a fixed version:

[zhhsun]

Thanks for quick response. @dougwilson