Security update needed

[erip2]

A security update is needed for "vue-template-compiler" package.

I have gotten this error:

vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS) #54

A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.

[harmyderoman]

Thanks for highlighting the problem

[groenroos]

Running into this issue as well! Is there anything preventing an upgrade to vue-template-compiler@3?

[harmyderoman]

@groenroos 2.7.16 is latest

[groenroos]

Ah, right you are - the format of the Dependabot security alert misled me to believe that a fixed version exists:

Since Vue 2 is EOL, is there an opportunity to drop this dependency? Or perhaps replace it with something else?

[harmyderoman]

@groenroos I'll check if I can can drop it

[kubica]

Same issue here :/ Is there already an update on this?

[harmyderoman]

@kubica An update is on the way

[harmyderoman]

Fixed #36