search

jonkemp / inline-css

Inline css into an html file.
MIT License
429 stars 85 forks source link

Update superagent-proxy #108

Closed jeremad closed 2 years ago

jeremad commented 2 years ago

A dependency of superagent-proxy (pac-resolver) has a known vulnerability. It was fixed in version 5.0.0, updating to version 3.0.0 of superagent-proxy should fix the issue.

Thank you very much

alumni commented 2 years ago

There was an attempt to fix it (PR #106), but got declined by the package maintainer. Looks like there's no recent update though.

pleymor commented 2 years ago

Hi!

As explained in the title, remote-content 2.0.0 imports "superagent-proxy": "^2.1.0", which has a high vulnerability.

inline-css 2.0.0 > extract-css 2.0.0 > href-content 2.0.0 > remote-content 2.0.0> superagent-proxy 2.1.0 [fixed in ] > proxy-agent [HIGH VULN.] > pac-proxy-agent [HIGH VULN.] > pac-resolver [HIGH VULN.]

=> remote-content can be fixed by upgrading superagent-proxy to 3.0.0, then href-content, extract-css and finally inline-css :small_airplane:

jonkemp commented 2 years ago

Fixed 36e3c0d

jeremad commented 2 years ago

Thank you very much :bow: