search

patrickxchong / eleventy-plugin-svg-sprite

A high performance Eleventy universal plugin that compiles a directory of SVG files into a single SVG Sprite and adds shortcodes to embed SVG Sprite and SVG content in Eleventy templates.
MIT License
39 stars 6 forks source link

Update the svg-sprite dependency in package.json #19

Open wesley-dean-flexion opened 2 months ago

wesley-dean-flexion commented 2 months ago

svg-sprite 2.0.0 has a dependency on lodash.trim 4.5.1 which is subject to a ReDoS vulnerability:

https://github.com/advisories/GHSA-29mw-wpgm-hmr9

svg-sprite 2.0.3 removes this dependency:

https://github.com/svg-sprite/svg-sprite/releases/tag/v2.0.3

The current v2.0.x release is 2.0.4 which also includes several fixes:

https://github.com/svg-sprite/svg-sprite/releases/tag/v2.0.4