16:27 <kentonv> ugh this again... unmaintained project we depend on depends on a specific version of some other module which depends on a specific old version of underscore.js which has a reported security vulnerability, but the vulnerability is in a function that the dependent doesn't use, but `npm` is going to keep telling me we have a high-severity vulnerability until I do something about it, sigh

16:35 <ocdtrekkie> Absolutely lovely.

17:00 <kentonv> so we use a library called nodemailer to send email. It would appear that nodemailer hasn't been updated in 4 years.

17:01 <isd> Isn't that the same library that caused the comma separator vulnerability?

17:01 <kentonv> what's that?

17:03 <isd> Yep, it was: https://sandstorm.io/news/2017-03-02-security-review

17:17 <kentonv> heh... at least nodemailer was still maintained at that time

17:17 <kentonv> we should probably update to a fresher library

17:25 <isd> Hm, looks like it was updated less than a month ago: https://github.com/nodemailer/nodemailer ?

17:26 <isd> How did you come to the conclusion that it was unmaintained?