Closed jeremad closed 2 years ago
There was an attempt to fix it (PR #106), but got declined by the package maintainer. Looks like there's no recent update though.
Hi!
As explained in the title, remote-content 2.0.0
imports "superagent-proxy": "^2.1.0"
, which has a high vulnerability.
inline-css 2.0.0 > extract-css 2.0.0 > href-content 2.0.0 > remote-content 2.0.0> superagent-proxy 2.1.0 [fixed in ] > proxy-agent [HIGH VULN.] > pac-proxy-agent [HIGH VULN.] > pac-resolver [HIGH VULN.]
=> remote-content
can be fixed by upgrading superagent-proxy
to 3.0.0, then href-content
, extract-css
and finally inline-css
:small_airplane:
Fixed 36e3c0d
Thank you very much :bow:
A dependency of
superagent-proxy
(pac-resolver
) has a known vulnerability. It was fixed in version 5.0.0, updating to version 3.0.0 ofsuperagent-proxy
should fix the issue.Thank you very much