Upgrade to latest version of svgo

[michaeljonathanblack]

There's a PR open now: #35

It closes #34

It also closes #44

[jkrehm]

It will also resolve a security vulnerability that was found in js-yaml.

https://www.npmjs.com/advisories/788

[alex-born]

It will also resolve a code injection vulnerability:

https://nodesecurity.io/advisories/813

[ljharb]

Since no user yaml code is used as input, neither of these are actually vulnerabilities here - they’re just false positives.

[michaeljonathanblack]

That's true, but does create noise around npm vulnerabilities and should be fixed.

[OZZlE]

helloooo, should be pretty easy to fix right? I want to use this module since it's like half the size of react-svg-loader :)

[ljharb]

No, it’s not easy to fix, nor is it necessary except to avoid false-positive audit warnings.

[lencioni]

@OZZlE I think the next step to fixing this would be to expose a synchronous API from svgo: svg/svgo#1015

[Chengxuan]

Any outlook on fixing this?

[lencioni]

@Chengxuan please see #45 (comment)