Merge pull request #7 from launchdarkly/at/sync-package-json

Use version 3.3.4 of event-stream
launchdarkly · Nov 27, 2018 · 6b787b3 · 6b787b3
2 parents 2a3bacd + 65ced35
commit 6b787b3
Show file tree

Hide file tree

Showing 4 changed files with 426 additions and 29 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,8 +2,16 @@
 
 All notable changes to the "launchdarkly" extension will be documented in this file.
 
+## [2.0.3] - 2018-11-26
+
+### Fixed
+
+- The previous version of ld-vscode had shipped with a potentially vulnerable version of `event-stream`, a dependency used by the vscode api. This version downgrades `event-stream` to a previous version that did not contain this vulnerability. More information on this vulnerability can be found here: https://github.com/dominictarr/event-stream/issues/116.
+
 ## [2.0.2] - 2018-10-04
 
+### ⚠ PSA: Version 2.0.2 contains a dependency vulnerability in `event-stream` and should not be used.
+
 ### Fixed
 
 - Fixed a bug causing hovers on non-flag string literals to indefinitely display loading text

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -2,7 +2,7 @@
 	"name": "launchdarkly",
 	"displayName": "LaunchDarkly",
 	"description": "View LaunchDarkly feature flags in your editor.",
-	"version": "2.0.2",
+	"version": "2.0.3",
 	"publisher": "launchdarkly",
 	"engines": {
 		"vscode": "^1.18.0"