Closed ir-fuel closed 6 months ago
It's even worse it seems. I deleted package-lock.json
, node_modules
and I force cleaned the npm cache, and I still get the above dependency tree imported in the project
Thanks. I am aware. This is a monorepo so it's more complicated and I'm looking into converting it to use Turborepo. I just haven't gotten to it yet. Sorry for the delay.
Hi @jonkemp, I really look forward to a new version of inline-css
and remote-content
without vm2
. :wink:
I guess just having a remote-content@3.0.2
would be enough.
Updates to href-content and remote-content are available on npm.
@jonkemp Thank you so much :pray:
You have updated the code so
remote-content
no longer uses thesuperagent
dependency which pulled in a vulnerablevm2
dependency.However you did not update any version numbers, not on
inline-css
and not onremote-content
, so people who don't wipenode-modules
before runningnpm install
will not get updated versions for this.this is what
npm ls contextify vm2
shows right now on my computer: