Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update clean-css dependency in pug-filters #2988

Closed
callmeaponte opened this issue Mar 19, 2018 · 2 comments · Fixed by #2989, atherdon/fullcalendar-node2#50, atherdon/groceristar#11 or Yproximite/better-vue-input-tag#43 · May be fixed by lajoskvcs/fusebox-vue-371-error#3
Closed

Update clean-css dependency in pug-filters #2988

callmeaponte opened this issue Mar 19, 2018 · 2 comments · Fixed by #2989, atherdon/fullcalendar-node2#50, atherdon/groceristar#11 or Yproximite/better-vue-input-tag#43 · May be fixed by lajoskvcs/fusebox-vue-371-error#3

Comments

@callmeaponte
Copy link
Contributor

I'm running a snyk test on my app, and noticed the following vulnerability:

? Low severity vuln found in clean-css@3.4.28, introduced via email-templates@3.5.0
- desc: Regular Expression Denial of Service (ReDoS)
- info: https://snyk.io/vuln/npm:clean-css:20180306
- from: email-templates@3.5.0 > preview-email@0.0.7 > pug@2.0.0 > pug-filters@3.0.0 > clean-css@3.4.28

Per the snyk page for this issue, clean-css has released a patch to fix this vulnerability in its latest release.
@ForbesLindesay
Copy link
Member

ForbesLindesay commented Mar 19, 2018 •
edited

A pull request to update it would be great.

@callmeaponte callmeaponte mentioned this issue Mar 20, 2018
Merged
@callmeaponte
Copy link
Contributor Author

Sure np, I've submitted a PR: #2989.

ForbesLindesay pushed a commit that referenced this issue Mar 21, 2018
@callmeaponte @ForbesLindesay
fixes #2988 "Update clean-css dependency in pug-filters" (#2989)
81df277
This was referenced Mar 21, 2018
Closed
Closed
Closed
Merged
Merged
Merged
Closed
shawnmclean pushed a commit to auth0/webtask-tools that referenced this issue Aug 20, 2019
@davetapley @shawnmclean
Bump pug (#34)
e79adb1 
* Update to pug 2.0.3

https://npmjs.com/advisories/785 
pugjs/pug#2988

* 3.4.1
This was referenced Mar 12, 2021
Open
Closed
Closed
Open
Open
Open
Open
Open
Closed
Open
Open
Open
Open
Open
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@ForbesLindesay @callmeaponte