-
-
Notifications
You must be signed in to change notification settings - Fork 11
Open
Description
Check List
- I have already read README.
- I have already searched existing issues.
- I have already searched existing pull requrests.
Feature Request
I noticed that the hexo-html-minifier project currently depends on html-minifier (version ^4.0.0), which has a high-severity security vulnerability (REDoS). Unfortunately, html-minifier is no longer actively maintained, and there is no fix available for this issue.
npm audit
# npm audit report
html-minifier *
Severity: high
kangax html-minifier REDoS vulnerability - https://github.com/advisories/GHSA-pfq8-rq6v-vf5m
No fix available
node_modules/html-minifier
hexo-html-minifier *
Depends on vulnerable versions of html-minifier
node_modules/hexo-html-minifier
2 high severity vulnerabilities
Some issues need review, and may require choosing
a different dependency.So maybe we should replace html-minifier with html-minifier-terser or htmlnano ? Thank you!
Additional context
stevenjoezhang
Metadata
Metadata
Assignees
Labels
No labels