vite-plugin-svg-sprite icon indicating copy to clipboard operation
vite-plugin-svg-sprite copied to clipboard

Published 20 hours ago • verified publisher icon meowtec

Dependent packages include CVE

Open alexharpin opened this issue 5 months ago • 0 comments

There's currently a security vulnerability flagged by yarn audit, which is triggered by the postcss requirement of one of your direct dependencies, svg-baker. It doesn't look like that package has had any activity in a while, and there's an open issue against it since September 23, so it doesn't look there's going to be an update any time soon. Is there any chance the svg-baker depedency can be replaced by something that doesn't pull the affected postcss version?

postcss <7.0.36 Severity: moderate Regular Expression Denial of Service in postcss - https://github.com/advisories/GHSA-566m-qj78-rww5

alexharpin avatar Jan 16 '24 15:01 alexharpin