fix: update svgo to non-vulnerable version#21
Conversation
|
I'd be grateful for an ETA if possible. This is a vulnerability fix, so would hope it could be given some priority. Thanks! |
…ad `css-select` -> `css-what`) The vulnerability is described at https://snyk.io/vuln/SNYK-JS-CSSWHAT-1298035 Also: 1. updates devDeps. 2. fixes problem with numeric entities for `<` and `&` not being permissible when they should be (needed to keep a test passing as well as being a proper fix)
|
@tkyi : Could you merge this please? It's been a vulnerability for 6 months, and not much involved to the update. |
|
Do you want to archive the project if not maintaining it? |
|
Hey @brettz9, We're part of a startup called Seal Security that mitigates software vulnerabilities in older open source versions by backporting/creating standalone security patches - enabling more straightforward remediation in cases like this. We created an If relevant, check out our GitHub repo if you wish to learn more, or start using our app. Please feel free to reach us at info@seal.security if you have any requests/questions. |
2 participants
css-select->css-what)The vulnerability is described at https://snyk.io/vuln/SNYK-JS-CSSWHAT-1298035
Also:
<and¬ being permissible when they should be (needed to keep a test passing as well as being a proper fix for svgo #1498)Note that svgo changed their API from asynchronous to synchronous (see https://github.com/svg/svgo/releases/tag/v2.0.0 ). The reason I changed our functions to
async(the syntax is ok because ourenginesrange of Node 10+ as they were available since Node 8) was to ensure they would continue returning a Promise, thus avoiding changing our own API. I think perhaps it is fine to continue having an async API since this is the kind of thing that could become async again, but it's not technically needed anymore.I confirm that this contribution is made under the terms of the license found in the root directory of this repository's source tree and that I have the authority necessary to make this contribution on behalf of its copyright owner.