-
-
Notifications
You must be signed in to change notification settings - Fork 134
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
html-minifier high security vulnerability #397
Comments
Hi, |
How would you go about swapping these if using NPM, since it's a dependency for a dependency? |
Exactly! Thank you as I was swinging by here to bring over this comment link: kangax/html-minifier#1135 (comment) I think this might have to be solved by switching the deps in this project. I'm not sure how to do that yet though, as antfu uses/used a different environment that I don't work with much as an old schooler... so I never really got over the initial learning curve to even try and help out with this project constructively. :( If any one can send me a tut link for this flavor of a local development stack used here in vite-ssg, i can try to carve out an afternoon to finally wrap my head around it and then take a stab at swapping out the vulnerable dep for the html-minifier-terser one that's being maintained more. Otherwise, cheers and happy hacking, everyone! |
The first thing to try in a downstream repo dependent on this repo, would probably be this approach: https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides Note, have not tried that yet though. But this would be the path of least resistance, theoretically. cheers! |
I have also the problem. Do you know if it's planned to resolve this problem in vite-ssg module ? |
The text was updated successfully, but these errors were encountered: