Security vulnerability GHSA-6fc8-4gx4-v693 affecting "ws" package (nested dependency) about grunt-contrib-connect

[pedrosanta]

Upon closer inspection, I've noticed that Node.js http2 module only became stable from v10.10.0 onwards.

And since grunt-contrib-connect supports Node.js versions 10 or greater ("engines": { "node": ">=10" }) it supports all versions of 10.x release, including earlier ones where the http2 module was still experimental API.

So, from my POV, unless the supported node versions were updated (and thus triggering a major version bump on grunt-contrib-connect to 4.0.0) we should not move/upgrade to Node.js http2 module.

Which is kinda unfortunate because:

• node-http2 repository (which was itself a fork of https://github.com/molnarg/node-http2 / http2 npm package, which since went seemingly unpublished too) was deleted/is nowhere to be found (see here: https://www.npmjs.com/package/node-http2) so one can't submit Issues or PRs to fix the security vulnerability that the latest node-http2 release/version (4.0.1) has.
• node-http2 4.0.1 depends on "websocket-stream": "^5.0.1" which depends (even on latest version/release 5.4.0) on "ws": "^3.2.0", which has a security vulnerability: GHSA-6fc8-4gx4-v693 (I've created the max-mapper/websocket-stream#162 issue to track this).
• Lastly, I already had the update to http2 module ready to go at https://github.com/pedrosanta/grunt-contrib-connect/tree/http2-update.

But again, from my POV:

• Either the Node.js supported versions are updated (new major version), or
• The next best chance to fix the vulnerability is to have websocket-stream upgrade their ws dependency.

PS: Meanwhile I'll update this issue to reference/track the security vulnerability in the first place, moreso than moving to http2 module, etc.

[pedrosanta]

Closing in favor of #270.