Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade svgo #79

Closed
wants to merge 1 commit into from
Closed

Upgrade svgo #79

wants to merge 1 commit into from

Conversation

tomphilbin
Copy link

The js-yaml package which is a dependency of svgo has a high-severity Code Injection vulnerability documented here: https://www.npmjs.com/advisories/813

ljharb
ljharb requested changes Apr 27, 2020
View reviewed changes
Copy link
Collaborator

@ljharb ljharb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Duplicate of #66.

@ljharb
Copy link
Collaborator

ljharb commented Apr 27, 2020

This is a duplicate of #66; see also #35 and #34; svgo v1+ doesn't offer a synchronous mechanism, so we can't use it.

Additionally, every security issue you're referencing is a false positive that does not apply to this repo.

@ljharb ljharb closed this Apr 27, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ljharb ljharb ljharb requested changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@tomphilbin @ljharb