Morgan is using Debug 2.6.9 dependency which has a known vulnerability

[silverthornekevin]

Debug dependency needs to be upgraded to 4.3.5 to remove the vulnerability that exists within it.

Discussion about the vulnerability takes place here: debug-js/debug#737

[dpopp07]

This is related to the discussion here.

Notably, a comment on that issue points out:

[email protected]+ requires node >= 6.

Since morgan supports Node 0.8.0 and above, resolving this would require a new major.

The aforementioned issue ended up getting closed - @wesleytodd should this one be closed as well?

[bjohansebas]

We are not affected by this issue, and we also cannot upgrade to that version due to the support for older Node.js