Skip to content

Maybe Replace html-minifier with htmlnano or html-minifier-terser due to security vulnerabilities #148

@RoversX

Description

@RoversX

Check List

  • I have already read README.
  • I have already searched existing issues.
  • I have already searched existing pull requrests.

Feature Request

I noticed that the hexo-html-minifier project currently depends on html-minifier (version ^4.0.0), which has a high-severity security vulnerability (REDoS). Unfortunately, html-minifier is no longer actively maintained, and there is no fix available for this issue.

npm audit
# npm audit report

html-minifier  *
Severity: high
kangax html-minifier REDoS vulnerability - https://github.com/advisories/GHSA-pfq8-rq6v-vf5m
No fix available
node_modules/html-minifier
  hexo-html-minifier  *
  Depends on vulnerable versions of html-minifier
  node_modules/hexo-html-minifier

2 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

So maybe we should replace html-minifier with html-minifier-terser or htmlnano ? Thank you!

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions