hexojs / hexojs/hexo-html-minifier

Maybe Replace `html-minifier` with `htmlnano` or `html-minifier-terser` due to security vulnerabilities

Open
#148 4 comments 1 reaction 0 assignees Claimed by @stevenjoezhang View on GitHub
Dominant language
JavaScript
Stars
27
Forks
10
Avg merge
8h 43m
Merged PRs (30d)
1

Description

### Check List

- [X] I have already read README.
- [X] I have already searched existing issues.
- [X] I have already searched existing pull requrests.

### Feature Request

I noticed that the `hexo-html-minifier` project currently depends on `html-minifier` (version ^4.0.0), which has a high-severity security vulnerability (REDoS). Unfortunately, `html-minifier` is no longer actively maintained, and there is no fix available for this issue.

```bash
npm audit
# npm audit report

html-minifier *
Severity: high
kangax html-minifier REDoS vulnerability - https://github.com/advisories/GHSA-pfq8-rq6v-vf5m
No fix available
node_modules/html-minifier
hexo-html-minifier *
Depends on vulnerable versions of html-minifier
node_modules/hexo-html-minifier

2 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.
```

So maybe we should replace ``html-minifier`` with ``html-minifier-terser`` or ``htmlnano`` ? Thank you!

### Additional context

- https://github.com/hexojs/hexo-html-minifier/issues/84
- https://github.com/hexojs/hexo-html-minifier/issues/148

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.