Open apennell opened 3 years ago
Hello. Is there a plan to upgrade the dependency within the image-webpack-loader
?
The issue mentioned above https://github.com/imagemin/imagemin-svgo/issues/45 has been closed.
imagemin-svgo
was updated to version 9.0.0
in Release 8.0.0 (as visible in the CHANGELOG.md), so I think this issue can be closed.
There's a reported ReDoS vulnerability with
is-svg
v4.2.1:is-svg
is a dependency ofimagemin-svgo
, which is a dependency ofimage-webpack-loader
. Current latest release ofimagemin-svgo
9.0.0
("imagemin-svgo": "^8.0.0"
used here) is still usingis-svgo 4.2.1
, but there's an open issue and pr in that repo to bump the dependency up, so ideallyimage-webpack-loader
would upgradeimagemin-svgo
once that fix is in.