hexojs / hexojs/hexo-html-minifier
Maybe Replace `html-minifier` with `htmlnano` or `html-minifier-terser` due to security vulnerabilities
- Dominant language
- JavaScript
- Stars
- 27
- Forks
- 10
- Avg merge
- 8h 43m
- Merged PRs (30d)
- 1
Description
### Check List
- [X] I have already read README.
- [X] I have already searched existing issues.
- [X] I have already searched existing pull requrests.
### Feature Request
I noticed that the `hexo-html-minifier` project currently depends on `html-minifier` (version ^4.0.0), which has a high-severity security vulnerability (REDoS). Unfortunately, `html-minifier` is no longer actively maintained, and there is no fix available for this issue.
```bash
npm audit
# npm audit report
html-minifier *
Severity: high
kangax html-minifier REDoS vulnerability - https://github.com/advisories/GHSA-pfq8-rq6v-vf5m
No fix available
node_modules/html-minifier
hexo-html-minifier *
Depends on vulnerable versions of html-minifier
node_modules/hexo-html-minifier
2 high severity vulnerabilities
Some issues need review, and may require choosing
a different dependency.
```
So maybe we should replace ``html-minifier`` with ``html-minifier-terser`` or ``htmlnano`` ? Thank you!
### Additional context
- https://github.com/hexojs/hexo-html-minifier/issues/84
- https://github.com/hexojs/hexo-html-minifier/issues/148
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.