Backport #149 to v3.9.x and/or v3.10.x

[stephanebisson]

Would it be possible to backport #149 to v3.9.x and/or v3.10.x and release a new package to npmjs?

This is quite an important fix as it addresses a security vulnerability. Migrating to v4.0.0 is a bigger effort that we cannot really do in the short-term.

Thanks

[pnorman]

Just a ping on this - are there any resources that would help do this, or could someone from WMF get access? We're stuck using a fork right now, kartotherian@457c46c