hexo-html-minifier
hexo-html-minifier copied to clipboard
Maybe Replace `html-minifier` with `htmlnano` or `html-minifier-terser` due to security vulnerabilities
Check List
- [X] I have already read README.
- [X] I have already searched existing issues.
- [X] I have already searched existing pull requrests.
Feature Request
I noticed that the hexo-html-minifier
project currently depends on html-minifier
(version ^4.0.0), which has a high-severity security vulnerability (REDoS). Unfortunately, html-minifier
is no longer actively maintained, and there is no fix available for this issue.
npm audit
# npm audit report
html-minifier *
Severity: high
kangax html-minifier REDoS vulnerability - https://github.com/advisories/GHSA-pfq8-rq6v-vf5m
No fix available
node_modules/html-minifier
hexo-html-minifier *
Depends on vulnerable versions of html-minifier
node_modules/hexo-html-minifier
2 high severity vulnerabilities
Some issues need review, and may require choosing
a different dependency.
So maybe we should replace html-minifier
with html-minifier-terser
or htmlnano
? Thank you!
Additional context
No response