From bb2e20ef61f1357a92258ca32349e67dce3dc0a9 Mon Sep 17 00:00:00 2001 From: Ahmed Yasin Koculu Date: Thu, 8 Oct 2026 01:13:02 +0200 Subject: [PATCH] Remove vulnerable transitive dependencies braces and sprintf-js. --- packages/ts-ssg/package.json | 4 +- packages/ts-ssg/src/build/io.ts | 28 +- .../ts-ssg/src/frontmatter/frontmatter.ts | 2 +- yarn.lock | 266 ++---------------- 4 files changed, 42 insertions(+), 258 deletions(-) diff --git a/packages/ts-ssg/package.json b/packages/ts-ssg/package.json index a006595c..f35a5669 100644 --- a/packages/ts-ssg/package.json +++ b/packages/ts-ssg/package.json @@ -41,7 +41,7 @@ "test": "vitest" }, "dependencies": { - "@node-minify/html-minifier": "^11.0.0", + "@11ty/gray-matter": "^3.0.0", "@purestack/ts-common": "workspace:^", "@purestack/ts-components": "workspace:^", "@purestack/ts-html": "workspace:^", @@ -53,10 +53,10 @@ "@purestack/ts-util": "workspace:^", "@purestack/ts-util-node": "workspace:^", "esbuild": "^0.28.0", - "gray-matter": "^4.0.3", "hast-util-from-html": "^2.0.3", "hast-util-to-html": "^9.0.5", "highlight.js": "^11.11.1", + "html-minifier-next": "^4.19.1", "logpot": "^1.0.7", "mdast-util-to-hast": "^13.2.1", "pagefind": "^1.4.0", diff --git a/packages/ts-ssg/src/build/io.ts b/packages/ts-ssg/src/build/io.ts index d6269fb5..b1b119b2 100644 --- a/packages/ts-ssg/src/build/io.ts +++ b/packages/ts-ssg/src/build/io.ts @@ -1,6 +1,6 @@ import fs from 'node:fs/promises' -import { htmlMinifier } from '@node-minify/html-minifier' import { ensureDir } from '@purestack/ts-util-node' +import { minify } from 'html-minifier-next' export async function readSource(absPath: string) { return fs.readFile(absPath, 'utf-8') @@ -30,16 +30,20 @@ export async function prepareOutDir( } async function minifyHtml(input: string): Promise { - const result = await htmlMinifier({ - content: input, - settings: { - compressor: async () => ({ code: '' }), - options: { - collapseInlineTagWhitespace: false, - removeOptionalTags: false, - conservativeCollapse: true, - }, - }, + return minify(input, { + collapseBooleanAttributes: true, + collapseInlineTagWhitespace: false, + collapseWhitespace: true, + conservativeCollapse: true, + minifyCSS: true, + minifyJS: true, + removeAttributeQuotes: true, + removeComments: true, + removeEmptyAttributes: true, + removeOptionalTags: false, + removeRedundantAttributes: true, + removeScriptTypeAttributes: true, + removeStyleLinkTypeAttributes: true, + useShortDoctype: true, }) - return result.code } diff --git a/packages/ts-ssg/src/frontmatter/frontmatter.ts b/packages/ts-ssg/src/frontmatter/frontmatter.ts index 89824910..3950949f 100644 --- a/packages/ts-ssg/src/frontmatter/frontmatter.ts +++ b/packages/ts-ssg/src/frontmatter/frontmatter.ts @@ -1,3 +1,4 @@ +import matter from '@11ty/gray-matter' import type { FrontmatterEmbedOptions, FrontmatterLayoutOptions, @@ -6,7 +7,6 @@ import type { PreviewConfig, } from '@purestack/ts-common' import { pickSemanticTone } from '@purestack/ts-style' -import matter from 'gray-matter' export function parseFrontmatterSource( source: string, diff --git a/yarn.lock b/yarn.lock index 615c0346..6effe4cb 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5,6 +5,16 @@ __metadata: version: 10 cacheKey: 10c0 +"@11ty/gray-matter@npm:^3.0.0": + version: 3.0.0 + resolution: "@11ty/gray-matter@npm:3.0.0" + dependencies: + js-yaml: "npm:^5.2.2" + section-matter: "npm:^1.0.0" + checksum: 10c0/f9f03dd1e17450cea2dd6331be0eae13e897ea1c9b5fd7b3bc802aafaf861f76c8f526d394242bb3a35a3184396e2793475ebd0557e4b6bcc16d54c327c27235 + languageName: node + linkType: hard + "@azure/abort-controller@npm:^2.0.0, @azure/abort-controller@npm:^2.1.2": version: 2.1.2 resolution: "@azure/abort-controller@npm:2.1.2" @@ -647,53 +657,6 @@ __metadata: languageName: node linkType: hard -"@node-minify/html-minifier@npm:^11.0.0": - version: 11.0.0 - resolution: "@node-minify/html-minifier@npm:11.0.0" - dependencies: - "@node-minify/utils": "npm:11.0.0" - html-minifier-next: "npm:^4.19.1" - checksum: 10c0/04f74a9b1b00312625fa4babd2ae0920fb2f7d85c8dada6988e4679b4a91bd61957e66f993d297b12612779de55ca6322b1495ebbe78885174e6d63b6f9c4137 - languageName: node - linkType: hard - -"@node-minify/utils@npm:11.0.0": - version: 11.0.0 - resolution: "@node-minify/utils@npm:11.0.0" - dependencies: - fast-glob: "npm:^3.3.3" - gzip-size: "npm:7.0.0" - checksum: 10c0/965eeeec9cb9fae77bf1bcab54ee6cb366ef3b750d6fe02d6041e73b037bf4a92513eedea365f3c9a6f35f046c4435f9d90b207e3d6256586e87b02cfbe53a00 - languageName: node - linkType: hard - -"@nodelib/fs.scandir@npm:2.1.5": - version: 2.1.5 - resolution: "@nodelib/fs.scandir@npm:2.1.5" - dependencies: - "@nodelib/fs.stat": "npm:2.0.5" - run-parallel: "npm:^1.1.9" - checksum: 10c0/732c3b6d1b1e967440e65f284bd06e5821fedf10a1bea9ed2bb75956ea1f30e08c44d3def9d6a230666574edbaf136f8cfd319c14fd1f87c66e6a44449afb2eb - languageName: node - linkType: hard - -"@nodelib/fs.stat@npm:2.0.5, @nodelib/fs.stat@npm:^2.0.2": - version: 2.0.5 - resolution: "@nodelib/fs.stat@npm:2.0.5" - checksum: 10c0/88dafe5e3e29a388b07264680dc996c17f4bda48d163a9d4f5c1112979f0ce8ec72aa7116122c350b4e7976bc5566dc3ddb579be1ceaacc727872eb4ed93926d - languageName: node - linkType: hard - -"@nodelib/fs.walk@npm:^1.2.3": - version: 1.2.8 - resolution: "@nodelib/fs.walk@npm:1.2.8" - dependencies: - "@nodelib/fs.scandir": "npm:2.1.5" - fastq: "npm:^1.6.0" - checksum: 10c0/db9de047c3bb9b51f9335a7bb46f4fcfb6829fb628318c12115fbaf7d369bfce71c15b103d1fc3b464812d936220ee9bc1c8f762d032c9f6be9acc99249095b1 - languageName: node - linkType: hard - "@npmcli/agent@npm:^3.0.0": version: 3.0.0 resolution: "@npmcli/agent@npm:3.0.0" @@ -852,7 +815,7 @@ __metadata: version: 0.0.0-use.local resolution: "@purestack/ts-ssg@workspace:packages/ts-ssg" dependencies: - "@node-minify/html-minifier": "npm:^11.0.0" + "@11ty/gray-matter": "npm:^3.0.0" "@purestack/ts-common": "workspace:^" "@purestack/ts-components": "workspace:^" "@purestack/ts-html": "workspace:^" @@ -864,10 +827,10 @@ __metadata: "@purestack/ts-util": "workspace:^" "@purestack/ts-util-node": "workspace:^" esbuild: "npm:^0.28.0" - gray-matter: "npm:^4.0.3" hast-util-from-html: "npm:^2.0.3" hast-util-to-html: "npm:^9.0.5" highlight.js: "npm:^11.11.1" + html-minifier-next: "npm:^4.19.1" logpot: "npm:^1.0.7" mdast-util-to-hast: "npm:^13.2.1" pagefind: "npm:^1.4.0" @@ -1799,12 +1762,10 @@ __metadata: languageName: node linkType: hard -"argparse@npm:^1.0.7": - version: 1.0.10 - resolution: "argparse@npm:1.0.10" - dependencies: - sprintf-js: "npm:~1.0.2" - checksum: 10c0/b2972c5c23c63df66bca144dbc65d180efa74f25f8fd9b7d9a0a6c88ae839db32df3d54770dcb6460cf840d232b60695d1a6b1053f599d84e73f7437087712de +"argparse@npm:^2.0.1": + version: 2.0.1 + resolution: "argparse@npm:2.0.1" + checksum: 10c0/c5640c2d89045371c7cedd6a70212a04e360fd34d6edeae32f6952c63949e3525ea77dbec0289d8213a99bbaeab5abfa860b5c12cf88a2e6cf8106e90dd27a7e languageName: node linkType: hard @@ -1887,15 +1848,6 @@ __metadata: languageName: node linkType: hard -"braces@npm:^3.0.3": - version: 3.0.3 - resolution: "braces@npm:3.0.3" - dependencies: - fill-range: "npm:^7.1.1" - checksum: 10c0/7c6dfd30c338d2997ba77500539227b9d1f85e388a5f43220865201e407e076783d0881f2d297b9f80951b4c957fcf0b51c1d2d24227631643c3f7c284b0aa04 - languageName: node - linkType: hard - "buffer-crc32@npm:~0.2.3": version: 0.2.13 resolution: "buffer-crc32@npm:0.2.13" @@ -2249,13 +2201,6 @@ __metadata: languageName: node linkType: hard -"duplexer@npm:^0.1.2": - version: 0.1.2 - resolution: "duplexer@npm:0.1.2" - checksum: 10c0/c57bcd4bdf7e623abab2df43a7b5b23d18152154529d166c1e0da6bee341d84c432d157d7e97b32fecb1bf3a8b8857dd85ed81a915789f550637ed25b8e64fc2 - languageName: node - linkType: hard - "eastasianwidth@npm:^0.2.0": version: 0.2.0 resolution: "eastasianwidth@npm:0.2.0" @@ -2472,16 +2417,6 @@ __metadata: languageName: node linkType: hard -"esprima@npm:^4.0.0": - version: 4.0.1 - resolution: "esprima@npm:4.0.1" - bin: - esparse: ./bin/esparse.js - esvalidate: ./bin/esvalidate.js - checksum: 10c0/ad4bab9ead0808cf56501750fd9d3fb276f6b105f987707d059005d57e182d18a7c9ec7f3a01794ebddcca676773e42ca48a32d67a250c9d35e009ca613caba3 - languageName: node - linkType: hard - "estree-walker@npm:^3.0.3": version: 3.0.3 resolution: "estree-walker@npm:3.0.3" @@ -2521,28 +2456,6 @@ __metadata: languageName: node linkType: hard -"fast-glob@npm:^3.3.3": - version: 3.3.3 - resolution: "fast-glob@npm:3.3.3" - dependencies: - "@nodelib/fs.stat": "npm:^2.0.2" - "@nodelib/fs.walk": "npm:^1.2.3" - glob-parent: "npm:^5.1.2" - merge2: "npm:^1.3.0" - micromatch: "npm:^4.0.8" - checksum: 10c0/f6aaa141d0d3384cf73cbcdfc52f475ed293f6d5b65bfc5def368b09163a9f7e5ec2b3014d80f733c405f58e470ee0cc451c2937685045cddcdeaa24199c43fe - languageName: node - linkType: hard - -"fastq@npm:^1.6.0": - version: 1.20.1 - resolution: "fastq@npm:1.20.1" - dependencies: - reusify: "npm:^1.0.4" - checksum: 10c0/e5dd725884decb1f11e5c822221d76136f239d0236f176fab80b7b8f9e7619ae57e6b4e5b73defc21e6b9ef99437ee7b545cff8e6c2c337819633712fa9d352e - languageName: node - linkType: hard - "fdir@npm:^6.4.4": version: 6.4.6 resolution: "fdir@npm:6.4.6" @@ -2567,15 +2480,6 @@ __metadata: languageName: node linkType: hard -"fill-range@npm:^7.1.1": - version: 7.1.1 - resolution: "fill-range@npm:7.1.1" - dependencies: - to-regex-range: "npm:^5.0.1" - checksum: 10c0/b75b691bbe065472f38824f694c2f7449d7f5004aa950426a2c28f0306c60db9b880c0b0e4ed819997ffb882d1da02cfcfc819bddc94d71627f5269682edf018 - languageName: node - linkType: hard - "foreground-child@npm:^3.1.0": version: 3.3.1 resolution: "foreground-child@npm:3.3.1" @@ -2668,15 +2572,6 @@ __metadata: languageName: node linkType: hard -"glob-parent@npm:^5.1.2": - version: 5.1.2 - resolution: "glob-parent@npm:5.1.2" - dependencies: - is-glob: "npm:^4.0.1" - checksum: 10c0/cab87638e2112bee3f839ef5f6e0765057163d39c66be8ec1602f3823da4692297ad4e972de876ea17c44d652978638d2fd583c6713d0eb6591706825020c9ee - languageName: node - linkType: hard - "glob@npm:^10.2.2": version: 10.5.0 resolution: "glob@npm:10.5.0" @@ -2707,27 +2602,6 @@ __metadata: languageName: node linkType: hard -"gray-matter@npm:^4.0.3": - version: 4.0.3 - resolution: "gray-matter@npm:4.0.3" - dependencies: - js-yaml: "npm:^3.13.1" - kind-of: "npm:^6.0.2" - section-matter: "npm:^1.0.0" - strip-bom-string: "npm:^1.0.0" - checksum: 10c0/e38489906dad4f162ca01e0dcbdbed96d1a53740cef446b9bf76d80bec66fa799af07776a18077aee642346c5e1365ed95e4c91854a12bf40ba0d4fb43a625a6 - languageName: node - linkType: hard - -"gzip-size@npm:7.0.0": - version: 7.0.0 - resolution: "gzip-size@npm:7.0.0" - dependencies: - duplexer: "npm:^0.1.2" - checksum: 10c0/0bf63084d5fea0880f3607ecd361d4663aab26b9cb0d3e97ba77373a0246c8f8de57d8613ac4e57e1e6c28522dcee6f8682aae55c275b9262b66d2ffd698f72b - languageName: node - linkType: hard - "has-symbols@npm:^1.1.0": version: 1.1.0 resolution: "has-symbols@npm:1.1.0" @@ -3002,13 +2876,6 @@ __metadata: languageName: node linkType: hard -"is-extglob@npm:^2.1.1": - version: 2.1.1 - resolution: "is-extglob@npm:2.1.1" - checksum: 10c0/5487da35691fbc339700bbb2730430b07777a3c21b9ebaecb3072512dfd7b4ba78ac2381a87e8d78d20ea08affb3f1971b4af629173a6bf435ff8a4c47747912 - languageName: node - linkType: hard - "is-fullwidth-code-point@npm:^3.0.0": version: 3.0.0 resolution: "is-fullwidth-code-point@npm:3.0.0" @@ -3016,15 +2883,6 @@ __metadata: languageName: node linkType: hard -"is-glob@npm:^4.0.1": - version: 4.0.3 - resolution: "is-glob@npm:4.0.3" - dependencies: - is-extglob: "npm:^2.1.1" - checksum: 10c0/17fb4014e22be3bbecea9b2e3a76e9e34ff645466be702f1693e8f1ee1adac84710d0be0bd9f967d6354036fd51ab7c2741d954d6e91dae6bb69714de92c197a - languageName: node - linkType: hard - "is-inside-container@npm:^1.0.0": version: 1.0.0 resolution: "is-inside-container@npm:1.0.0" @@ -3036,13 +2894,6 @@ __metadata: languageName: node linkType: hard -"is-number@npm:^7.0.0": - version: 7.0.0 - resolution: "is-number@npm:7.0.0" - checksum: 10c0/b4686d0d3053146095ccd45346461bc8e53b80aeb7671cc52a4de02dbbf7dc0d1d2a986e2fe4ae206984b4d34ef37e8b795ebc4f4295c978373e6575e295d811 - languageName: node - linkType: hard - "is-plain-obj@npm:^4.0.0": version: 4.1.0 resolution: "is-plain-obj@npm:4.1.0" @@ -3097,15 +2948,14 @@ __metadata: languageName: node linkType: hard -"js-yaml@npm:^3.13.1": - version: 3.15.2 - resolution: "js-yaml@npm:3.15.2" +"js-yaml@npm:^5.2.2": + version: 5.4.3 + resolution: "js-yaml@npm:5.4.3" dependencies: - argparse: "npm:^1.0.7" - esprima: "npm:^4.0.0" + argparse: "npm:^2.0.1" bin: - js-yaml: bin/js-yaml.js - checksum: 10c0/e341df211dece9d4b784849647ad7568b5b6a58a9ee58ead750482316d83276387343649fe4b71522705dc6c76acf97718588f23dc19443833ef3e75033af967 + js-yaml: bin/js-yaml.mjs + checksum: 10c0/7180bf35feef9815a06cb2f8845c1196f1e4264430a04623884d87c3d21475de7d46a86c9c5142dcc1646c788bc0e676eb09ba817810707e0b4e984f7cf93a5f languageName: node linkType: hard @@ -3155,7 +3005,7 @@ __metadata: languageName: node linkType: hard -"kind-of@npm:^6.0.0, kind-of@npm:^6.0.2": +"kind-of@npm:^6.0.0": version: 6.0.3 resolution: "kind-of@npm:6.0.3" checksum: 10c0/61cdff9623dabf3568b6445e93e31376bee1cdb93f8ba7033d86022c2a9b1791a1d9510e026e6465ebd701a6dd2f7b0808483ad8838341ac52f003f512e0b4c4 @@ -3713,13 +3563,6 @@ __metadata: languageName: node linkType: hard -"merge2@npm:^1.3.0": - version: 1.4.1 - resolution: "merge2@npm:1.4.1" - checksum: 10c0/254a8a4605b58f450308fc474c82ac9a094848081bf4c06778200207820e5193726dc563a0d2c16468810516a5c97d9d3ea0ca6585d23c58ccfff2403e8dbbeb - languageName: node - linkType: hard - "micromark-core-commonmark@npm:^2.0.0": version: 2.0.3 resolution: "micromark-core-commonmark@npm:2.0.3" @@ -4049,16 +3892,6 @@ __metadata: languageName: node linkType: hard -"micromatch@npm:^4.0.8": - version: 4.0.8 - resolution: "micromatch@npm:4.0.8" - dependencies: - braces: "npm:^3.0.3" - picomatch: "npm:^2.3.1" - checksum: 10c0/166fa6eb926b9553f32ef81f5f531d27b4ce7da60e5baf8c021d043b27a388fb95e46a8038d5045877881e673f8134122b59624d5cecbd16eb50a42e7a6b5ca8 - languageName: node - linkType: hard - "mime@npm:^1.6.0": version: 1.6.0 resolution: "mime@npm:1.6.0" @@ -4415,13 +4248,6 @@ __metadata: languageName: node linkType: hard -"picomatch@npm:^2.3.1": - version: 2.3.2 - resolution: "picomatch@npm:2.3.2" - checksum: 10c0/a554d1709e59be97d1acb9eaedbbc700a5c03dbd4579807baed95100b00420bc729335440ef15004ae2378984e2487a7c1cebd743cfdb72b6fa9ab69223c0d61 - languageName: node - linkType: hard - "picomatch@npm:^4.0.2, picomatch@npm:^4.0.4, picomatch@npm:^4.0.7": version: 4.0.7 resolution: "picomatch@npm:4.0.7" @@ -4539,13 +4365,6 @@ __metadata: languageName: node linkType: hard -"queue-microtask@npm:^1.2.2": - version: 1.2.3 - resolution: "queue-microtask@npm:1.2.3" - checksum: 10c0/900a93d3cdae3acd7d16f642c29a642aea32c2026446151f0778c62ac089d4b8e6c986811076e1ae180a694cedf077d453a11b58ff0a865629a4f82ab558e102 - languageName: node - linkType: hard - "read@npm:^1.0.7": version: 1.0.7 resolution: "read@npm:1.0.7" @@ -4680,13 +4499,6 @@ __metadata: languageName: node linkType: hard -"reusify@npm:^1.0.4": - version: 1.1.0 - resolution: "reusify@npm:1.1.0" - checksum: 10c0/4eff0d4a5f9383566c7d7ec437b671cc51b25963bd61bf127c3f3d3f68e44a026d99b8d2f1ad344afff8d278a8fe70a8ea092650a716d22287e8bef7126bb2fa - languageName: node - linkType: hard - "rolldown-plugin-dts@npm:^0.28.5": version: 0.28.6 resolution: "rolldown-plugin-dts@npm:0.28.6" @@ -4784,15 +4596,6 @@ __metadata: languageName: node linkType: hard -"run-parallel@npm:^1.1.9": - version: 1.2.0 - resolution: "run-parallel@npm:1.2.0" - dependencies: - queue-microtask: "npm:^1.2.2" - checksum: 10c0/200b5ab25b5b8b7113f9901bfe3afc347e19bb7475b267d55ad0eb86a62a46d77510cb0f232507c9e5d497ebda569a08a9867d0d14f57a82ad5564d991588b39 - languageName: node - linkType: hard - "safe-buffer@npm:^5.0.1": version: 5.2.1 resolution: "safe-buffer@npm:5.2.1" @@ -5025,13 +4828,6 @@ __metadata: languageName: node linkType: hard -"sprintf-js@npm:~1.0.2": - version: 1.0.3 - resolution: "sprintf-js@npm:1.0.3" - checksum: 10c0/ecadcfe4c771890140da5023d43e190b7566d9cf8b2d238600f31bec0fc653f328da4450eb04bd59a431771a8e9cc0e118f0aa3974b683a4981b4e07abc2a5bb - languageName: node - linkType: hard - "ssri@npm:^12.0.0": version: 12.0.0 resolution: "ssri@npm:12.0.0" @@ -5098,13 +4894,6 @@ __metadata: languageName: node linkType: hard -"strip-bom-string@npm:^1.0.0": - version: 1.0.0 - resolution: "strip-bom-string@npm:1.0.0" - checksum: 10c0/5c5717e2643225aa6a6d659d34176ab2657037f1fe2423ac6fcdb488f135e14fef1022030e426d8b4d0989e09adbd5c3288d5d3b9c632abeefd2358dfc512bca - languageName: node - linkType: hard - "structured-source@npm:^4.0.0": version: 4.0.0 resolution: "structured-source@npm:4.0.0" @@ -5184,15 +4973,6 @@ __metadata: languageName: node linkType: hard -"to-regex-range@npm:^5.0.1": - version: 5.0.1 - resolution: "to-regex-range@npm:5.0.1" - dependencies: - is-number: "npm:^7.0.0" - checksum: 10c0/487988b0a19c654ff3e1961b87f471702e708fa8a8dd02a298ef16da7206692e8552a0250e8b3e8759270f62e9d8314616f6da274734d3b558b1fc7b7724e892 - languageName: node - linkType: hard - "tree-kill@npm:^1.2.2": version: 1.2.2 resolution: "tree-kill@npm:1.2.2"