developit / developit/microbundle
Security vulnerability via transitive dependency on `serialize-javascript` via `rollup-plugin-terser`
Ouverte
- Langage dominant
- JavaScript
- Étoiles
- 8.1k
- Forks
- 358
- Métriques de merge des PR
- Aucune PR mergée en 30 j
Description
I've started to see vulnerability reports on a number of projects that all look like this: https://github.com/bullet-train-co/bullet_train-core/security/dependabot/557
The issue arises because `microbundle` depends on the deprecated `rollup-plugin-terser` package which has its dependency on `serialize-javascript` declared with `^4.0.0`.
Updating `microbundle` to `@rollup/plugin-terser` should fix the dependency chain, but I don't know if it would introduce other issues.
Guide de contribution
Aucun guide de contribution indexé pour ce dépôt
Évaluation
Cette issue n'a pas encore été évaluée.