Publish new version

[skoestler]

There was recently a security fix in a downstream dependency (unshiftio/querystringify#19) and it looks like the dependencies of this module have been updated accordingly but a new version has not yet been published.

I apologize if I am missing something here, but are you planning on publishing a new version of this library with the updated dependencies?

[lpinca]

AFAIK there is actually no harm also with the current version of querystringify. Properties inherited by Object.prototype can be safely overridden and setting __proto__ to a string has no effect. The only problem is if the user expects the inherited properties to not be overridden which doesn't make sense in this lib.

That said a new release doesn't hurt.

cc: @3rd-Eden

[jdx]

👍 this shows up in snyk as a high severity vulnerability so it would be nice to have this bumped rather than ignore the vuln in snyk

[3rd-Eden]

I'm the author of the fix, as well as the reporter to snyk, this module is not affected by it. Generation of an origin string does not require access to querystring params if any shape or form. The only way this module would have been vulnerable is when:

https://github.com/unshiftio/original/blob/master/index.js#L13

sets the second argument to true to enable querystring parsing.

[3rd-Eden]

1.0.1 is out