We use an older verion of dojo in our product and our upgrade to newer version needs lot of overhauling of the product code - which is not possible at this wee hour. But we need to get rid of this reported vulnerability - CVE-2018-15494. I found that the fix is there in the dojo's two files - https://github.com/dojo/dojox/pull/283
I wanted to know if I can make the changes in my application directly? Are there any license issues?