Repository navigation
Security vulnerability via transitive dependency on serialize-javascript via rollup-plugin-terser #1100
Description
Activity
Your link 404's, but like most "vulnerabilities" in build tooling, it's likely they're completely non-applicable for users. They tend to only be relevant if you're running untrusted user data through it on (say) a web server.
That being said, Microbundle is no longer maintained so it's unlikely those audit warnings will go away.
Oops, sorry, didn't realize that link was protected. But thanks for the info about
microbundlebeing unmaintained. We'll look for an alternative.@rschristian Would be great to have a short notice on the repo saying microbundle is unmaintained.
Reacted by Jeremy GreenUnfortunately I don't have maintainer rights here and wrangling the couple people that do is pretty tricky these days; it's unlikely that anything, even a ReadMe change, will get merged in.
Also, not my repo & Preact itself still uses it, so slapping a "Unmaintained" label isn't really my call :/
Reacted by Philipp Daun
I've started to see vulnerability reports on a number of projects that all look like this: https://github.com/bullet-train-co/bullet_train-core/security/dependabot/557
The issue arises because
microbundledepends on the deprecatedrollup-plugin-terserpackage which has its dependency onserialize-javascriptdeclared with^4.0.0.Updating
microbundleto@rollup/plugin-tersershould fix the dependency chain, but I don't know if it would introduce other issues.