Security issue with happy-dom dependency

[allencwang]

There is a security risk with happy-dom library that allows for server side code to be executed with a <script> tag capricorn86/happy-dom#1585. This was patched in version [email protected] but pigment-css is 3 majors versions behind at 12.10.3.

is it possible to update the library version?

GHSA-96g7-g7g9-jxw8

Search keywords:

[brijeshb42]

We'll wait for wyw-in-js release with Anber/wyw-in-js#111 before bumping the dependency here.

[allencwang]

Hi there, wondering if there is an expected timeline for this @brijeshb42 since the PR is merged

[oliviertassinari]

@allencwang We have created #320.

@brijeshb42 I'm removing the status: waiting for maintainer label as you already triaged this one. Effectively, the use of this label is to be able to not miss a single issue by knowing which one was triaged vs. wasn't https://github.com/mui/pigment-css/issues?q=is%3Aissue+is%3Aopen+label%3A%22status%3A+waiting+for+maintainer%22.

[github-actions]

This issue has been closed. If you have a similar problem but not exactly the same, please open a new issue.
Now, if you have additional information related to this issue or things that could help future readers, feel free to leave a comment.

Note

@allencwang How did we do? Your experience with our support team matters to us. If you have a moment, please share your thoughts in this short Support Satisfaction survey.

[brijeshb42]

Published new version 0.0.27.