Open FabioDiCeglie opened 3 months ago
It's such a shame to have this error for dead code. I had to spend time going back and analyzing the issue to understand.
Removing the dependency as soon as possible would save human time.
@1000-x-t30 you gonna release this?
@FabioDiCeglie sorry. Released today!
Description: The
stringify
package in our repository is outdated, not utilized, and poses a potential security risk due to an identified vulnerability. Specifically, the package is no longer in use and contains a known vulnerability, the "kangax html-minifier REDoS vulnerability". This vulnerability, discovered inkangax html-minifier 4.0.0
, exposes our system to Regular Expression Denial of Service (ReDoS) attacks via thecandidate
variable inhtmlminifier.js
.Considering that the package serves no active purpose in our codebase and presents a security concern, it's imperative to remove it from the repository to mitigate any potential risks.
Action Plan:
stringify
Package:stringify
package from this repository entirely.