Open LanceStasinski opened 1 year ago
+1 This bug has high severity, would be good to resolve!
this vulnerability seems completely irrelevant here since svgo in this context is not used on arbitrary user data. it is only used on the SVG files that you add to your project, and most likely you won't try to DoS yourself... 😅
🐞 Bug Report
Describe the bug
nth-check@1.0.2
, a transient dependency ofsvgo@2.1.0
, has an Inefficient Regular Expression Complexity vulnerability.svgo@2.1.0
is a dependency ofbroccoli-svg-optimizer@2.1.0
.Expected behavior
There should not be security vulnerability.
Possible Solution
Update
svgo
to v3.0.2 which usesnth-check@2.0.1
as a transient dependency.