boopathi/react-svg-loader

js-yaml throwing security errors

RobPethick opened this issue · 2 comments

RobPethick commented

When running npm audit I get the following results

Moderate Denial of Service
Package js-yaml
Patched in >=3.13.0
Dependency of react-svg-loader [dev]
Path react-svg-loader > react-svg-core > svgo > js-yaml
More info https://nodesecurity.io/advisories/788

High Code Injection
Package js-yaml
Patched in >=3.13.1
Dependency of react-svg-loader [dev]
Path react-svg-loader > react-svg-core > svgo > js-yaml
More info https://nodesecurity.io/advisories/813****

Looks like svgo have updated their version of js-yaml to fix this, we just need to update the version of svgo to get that change

RobPethick commented

Looks like this might have been done in commit 27bce4a
But this doesn't look like it has been released as a new version of react-svg-loader with the new reference to react-svg-core