Question: Possibility to back-port jsprim update to version 1.2.X

[felix-hcl]

As stated in #123 there was a security vulnerability down the dependency tree.

Unfortunately the well known but already deprecated library [email protected] depends on "http-signature": "~1.2.0".
As you might be aware, there are still many (open source) packages out there which have not replaced request with a more up2date http client.

I am aware that this is not a long-term solution/fix but I kindly ask if there is any possibility to back-port the jsprim update from #123 / #125 to a version 1.2.1?

[felix-hcl]

Closing this issue. Jsprim backported the fix to version 1.4.2 which resolves this issue since it is in the correct semver version range for [email protected]
https://github.com/joyent/node-jsprim/releases/tag/v1.4.2