search

andymantell / node-wpautop

A Node.js port of Wordpress' wpautop() function
GNU General Public License v2.0
16 stars 7 forks source link

Remove phpjs or upgrade #4

Closed abstractvector closed 6 years ago

abstractvector commented 6 years ago

The version of phpjs you are using relies on a library send which has two known vulnerabilities:

Given you've now removed phpjs dependency from the main library, could you please either:

I'm happy to make the necessary changes and submit a PR if you let me know which of the above you'd prefer.

andymantell commented 6 years ago

Thanks for alerting me to this Matt. I reckon removing the dependency is probably the best bet. If you're willing to do the work that would be greatly appreciated. I am happy to do it, but it won't be till the weekend so if you'd like it done sooner feel free to pitch in!

Or for expediency, upgrading phpjs and moving to Dev deps is fine too...

abstractvector commented 6 years ago

Thanks for the quick reply @andymantell. I've submitted a pull request for the changes - I did make a few other changes whilst I was there and documented them in the PR. Please let me know if you're happy with those.

andymantell commented 6 years ago

Fixed in https://github.com/andymantell/node-wpautop/pull/5 and released as https://github.com/andymantell/node-wpautop/releases/tag/v1.0.0

andymantell commented 6 years ago

Thanks @abstractvector!