6 files changed, 41 insertions, 12 deletions
diff --git a/node_modules/vinyl/README.md b/node_modules/vinyl/README.md
index a36777fb6..3861c4636 100644
--- a/node_modules/vinyl/README.md
+++ b/node_modules/vinyl/README.md
@@ -87,9 +87,9 @@ Default: `undefined`
 
 ##### `options.contents`
 
-The contents of the file.  If `options.contents` is a [`Stream`][stream], it is wrapped in a [`cloneable-readable`][cloneable-readable] stream.
+The contents of the file.  If `options.contents` is a [`ReadableStream`][readable-stream], it is wrapped in a [`cloneable-readable`][cloneable-readable] stream.
 
-Type: [`Stream`][stream], [`Buffer`][buffer], or `null`
+Type: [`ReadableStream`][readable-stream], [`Buffer`][buffer], or `null`
 
 Default: `null`
 
@@ -164,11 +164,11 @@ Each Vinyl object will have instance properties. Some may be unavailable based o
 
 #### `file.contents`
 
-Gets and sets the contents of the file. If set to a [`Stream`][stream], it is wrapped in a [`cloneable-readable`][cloneable-readable] stream.
+Gets and sets the contents of the file. If set to a [`ReadableStream`][readable-stream], it is wrapped in a [`cloneable-readable`][cloneable-readable] stream.
 
-Throws when set to any value other than a [`Stream`][stream], a [`Buffer`][buffer] or `null`.
+Throws when set to any value other than a [`ReadableStream`][readable-stream], a [`Buffer`][buffer] or `null`.
 
-Type: [`Stream`][stream], [`Buffer`][buffer] or `null`
+Type: [`ReadableStream`][readable-stream], [`Buffer`][buffer], or `null`
 
 #### `file.cwd`
 
@@ -355,7 +355,7 @@ Static method used by Vinyl when setting values inside the constructor or when c
 
 Takes a string `property` and returns `true` if the property is not used internally, otherwise returns `false`.
 
-This method is usefuly for inheritting from the Vinyl constructor. Read more in [Extending Vinyl][extending-vinyl].
+This method is useful for inheritting from the Vinyl constructor. Read more in [Extending Vinyl][extending-vinyl].
 
 Example:
 
@@ -423,6 +423,7 @@ MIT
 [normalization]: #normalization-and-concatenation
 [extending-vinyl]: #extending-vinyl
 [stream]: https://nodejs.org/api/stream.html#stream_stream
+[readable-stream]: https://nodejs.org/api/stream.html#stream_readable_streams
 [buffer]: https://nodejs.org/api/buffer.html#buffer_class_buffer
 [fs-stats]: http://nodejs.org/api/fs.html#fs_class_fs_stats
 [vinyl-fs]: https://github.com/gulpjs/vinyl-fs
diff --git a/node_modules/vinyl/index.js b/node_modules/vinyl/index.js
index beaba3b32..d99094e21 100644
--- a/node_modules/vinyl/index.js
+++ b/node_modules/vinyl/index.js
@@ -1,6 +1,7 @@
 'use strict';
 
 var path = require('path');
+var util = require('util');
 var isBuffer = require('buffer').Buffer.isBuffer;
 
 var clone = require('clone');
@@ -157,6 +158,11 @@ File.prototype.inspect = function() {
   return '<File ' + inspect.join(' ') + '>';
 };
 
+// Newer Node.js versions use this symbol for custom inspection.
+if (util.inspect.custom) {
+  File.prototype[util.inspect.custom] = File.prototype.inspect;
+}
+
 File.isCustomProp = function(key) {
   return builtInFields.indexOf(key) === -1;
 };
diff --git a/node_modules/vinyl/node_modules/clone/README.md b/node_modules/vinyl/node_modules/clone/README.md
index c21ba167d..207e60a24 100644
--- a/node_modules/vinyl/node_modules/clone/README.md
+++ b/node_modules/vinyl/node_modules/clone/README.md
@@ -5,6 +5,8 @@
 offers foolproof _deep cloning_ of objects, arrays, numbers, strings, maps,
 sets, promises, etc. in JavaScript.
 
+**XSS vulnerability detected**
+
 
 ## Installation
 
@@ -98,6 +100,12 @@ So, `b.myself` points to `b`, not `a`. Neat!
 
 ## Changelog
 
+### v2.1.2
+
+#### 2018-03-21
+
+  - Use `Buffer.allocUnsafe()` on Node >= 4.5.0 (contributed by @ChALkeR)
+
 ### v2.1.1
 
 #### 2017-03-09
@@ -119,7 +127,15 @@ So, `b.myself` points to `b`, not `a`. Neat!
 
   - Add support for cloning ES6 Maps, Sets, Promises, and Symbols
 
-### v1.0.2
+### v1.0.3
+
+#### 2017-11-08
+
+  - Close XSS vulnerability in the NPM package, which included the file
+    `test-apart-ctx.html`. This vulnerability was disclosed by Juho Nurminen of
+    2NS - Second Nature Security.
+
+### v1.0.2 (deprecated)
 
 #### 2015-03-25
 
@@ -127,14 +143,14 @@ So, `b.myself` points to `b`, not `a`. Neat!
   - Refactor utilities
   - Refactor test suite
 
-### v1.0.1
+### v1.0.1 (deprecated)
 
 #### 2015-03-04
 
   - Fix nodeunit version
   - Directly call getRegExpFlags
 
-### v1.0.0
+### v1.0.0 (deprecated)
 
 #### 2015-02-10
 
diff --git a/node_modules/vinyl/node_modules/clone/clone.js b/node_modules/vinyl/node_modules/clone/clone.js
index 80d0c765f..3fa5fad6f 100644
--- a/node_modules/vinyl/node_modules/clone/clone.js
+++ b/node_modules/vinyl/node_modules/clone/clone.js
@@ -104,7 +104,13 @@ function clone(parent, circular, depth, prototype, includeNonEnumerable) {
     } else if (clone.__isDate(parent)) {
       child = new Date(parent.getTime());
     } else if (useBuffer && Buffer.isBuffer(parent)) {
-      child = new Buffer(parent.length);
+      if (Buffer.allocUnsafe) {
+        // Node.js >= 4.5.0
+        child = Buffer.allocUnsafe(parent.length);
+      } else {
+        // Older Node.js versions
+        child = new Buffer(parent.length);
+      }
       parent.copy(child);
       return child;
     } else if (_instanceof(parent, Error)) {
diff --git a/node_modules/vinyl/node_modules/clone/package.json b/node_modules/vinyl/node_modules/clone/package.json
index ce8d7e384..39a53e3ff 100644
--- a/node_modules/vinyl/node_modules/clone/package.json
+++ b/node_modules/vinyl/node_modules/clone/package.json
@@ -8,7 +8,7 @@
     "function",
     "date"
   ],
-  "version": "2.1.1",
+  "version": "2.1.2",
   "repository": {
     "type": "git",
     "url": "git://github.com/pvorb/node-clone.git"
diff --git a/node_modules/vinyl/package.json b/node_modules/vinyl/package.json
index cd6f72e40..fded1c900 100644
--- a/node_modules/vinyl/package.json
+++ b/node_modules/vinyl/package.json
@@ -1,6 +1,6 @@
 {
   "name": "vinyl",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Virtual file format.",
   "author": "Gulp Team <team@gulpjs.com> (http://gulpjs.com/)",
   "contributors": [