Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace metaparser library #31

Open
marcovtwout opened this issue Jun 21, 2021 · 0 comments
Open

Replace metaparser library #31

marcovtwout opened this issue Jun 21, 2021 · 0 comments

Comments

@marcovtwout
Copy link

npm audit reports a vulnerability in a dependency of the metaparser library:

  High            Denial of Service
  Package         css-what
  Patched in      >=5.0.1
  Dependency of   cli-real-favicon [dev]
  Path            cli-real-favicon > rfg-api > metaparser > cheerio >
                  css-select > css-what
  More info       https://npmjs.com/advisories/1754

The latest release of metaparser uses the latest release of cheerio (v0.22), which uses an outdated version of css-select, which uses the vulnerable version of css-what. I don't think this issue has much impact, but it would be good to fix it nonetheless.

The metaparser package has its latest release 6 years ago and unfortunately the link to source returns a 404:

Perhaps the best course of action is to find an alternative for metaparser and replace it?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant