Severe security vulnerabilities from #70 Pull Request #72 didn't fix

Andy-set-studio / hylia

Hylia is a lightweight Eleventy starter kit to help you to create your own blog or personal website.

https://hylia.website

MIT License

905 stars 230 forks source link

Severe security vulnerabilities from #70 Pull Request #72 didn't fix #73

Closed MikaCaldera closed 5 years ago

MikaCaldera commented 5 years ago

https://www.npmjs.com/package/rollup-plugin-node-builtins Is the real issue. It's not been updated since 2017.

It's actually mentioned in the repo. The issue got closed when I fixed all the other vulnerabilities but it's still an issue. https://github.com/andybelldesign/hylia/issues/70

Is there another package that can be used to replace the outdated one?

Andy-set-studio commented 5 years ago

Hmm I'm not sure on this stuff, as it relates to the admin improvements with live previews. I’ll loop @erquhart in as he’s someone who actually knows what he’s doing!

erquhart commented 5 years ago

Hmm I know that lib is necessary for template parsing to work - maybe there's a workaround I'm not aware of. To see what I mean, try removing this plugin from rollup.config.js.

We could also fork it, update deps, and publish that for our purposes here, as long as it's published and controlled by a trusted party.

Andy-set-studio commented 5 years ago

I’m pretty low on experience with these situations. What do you think will be the best thing to do out of those, Shawn?

Thank you for taking a look at this 🙂