fix CVE-2021-23368,CVE-2021-23382, CVE-2021-33502 #11398
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bump ansi-html to ^0.0.8 fix CVE-2021-23424
|
这些都是本地构建过程用的工具，不会带到产物代码里，本地默认都是开发者安全的，除非本地已经被入侵不安全了，修复价值不大。 比如 vscode 在你添加代码文件目录的时候还会警告你是否信任，不安全的提示，价值不大。 一般在 postinstall 恶意执行脚本，或者特别严重的 webpack 任意代码执行漏洞才会修复。 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
bump normalize-url to 4.5.1
bump postcss to 7.0.39