developit / developit/microbundle
Security vulnerability via transitive dependency on `serialize-javascript` via `rollup-plugin-terser`
Aperta
- Lingua principale
- JavaScript
- Stelle
- 8.1k
- Fork
- 358
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
I've started to see vulnerability reports on a number of projects that all look like this: https://github.com/bullet-train-co/bullet_train-core/security/dependabot/557
The issue arises because `microbundle` depends on the deprecated `rollup-plugin-terser` package which has its dependency on `serialize-javascript` declared with `^4.0.0`.
Updating `microbundle` to `@rollup/plugin-terser` should fix the dependency chain, but I don't know if it would introduce other issues.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Valutazione
Questa issue non è ancora stata valutata.