search

hexojs / hexo-html-minifier

Minify HTML files with HTMLMinifier.
MIT License
27 stars 12 forks source link

found 3 vulnerabilities (2 low, 1 high) #14

Closed PrabhanshuAttri closed 5 years ago

PrabhanshuAttri commented 5 years ago

npm audit shows found 3 vulnerabilities (2 low, 1 high)

screenshot 2019-01-24 at 4 14 24 pm

Created an issue in html-minifier

tomap commented 5 years ago

Those bugs are already fixed, we just need to publish a new version You can check with by setting the version in you package.json to "hexojs/hexo-html-minifier" See https://docs.npmjs.com/files/package.json#github-urls

ILAsoft commented 5 years ago

To further explain the last comment - until an official release is made and issue is properly resolved, you can still use the latest (fixed) code to bypass this issue - simply change package.json from the current

"hexo-html-minifier": "0.0.2",

to

"hexo-html-minifier": "hexojs/hexo-html-minifier"

And run the usual "npm upgrade"

tomap commented 5 years ago

However, an official release would be nice @hexojs/core ?

floydpink commented 5 years ago

+1 for publishing a release

tomap commented 5 years ago

@YoshinoriN could you publish a v1? (maybe after droping support for node 6 https://github.com/hexojs/hexo/issues/3508 )

yoshinorin commented 5 years ago

@tomap I totally agree with drop Node.js v6 & publish this plugin v1. But, I haven't permission to publish npm...

PS. I wrote hexo-renderer-marked releases & its release news. But, npm publisher is @JLHwung

tomap commented 5 years ago

in the meantime, you can replace 

    "hexo-html-minifier": "0.0.2",

with

"hexo-html-minifier": "hexojs/hexo-html-minifier",

in your package.json

curbengh commented 5 years ago

https://github.com/hexojs/hexo-html-minifier/pull/33