Problem
svgo 3.0.0–3.3.3 — GHSA-2p49-hgcm-8545 (removeScripts plugin leaves some executable scripts intact).
Pulled in transitively via node-tikzjax (used for build-time SVG optimization of LaTeX rendering) — not in the runtime request path, but it is a production dependency (unlike the other two audit findings, tracked separately in #187).
Investigation done
npm audit fix and npm audit fix --force both come back with no available patched svgo version — there is currently no upstream fix.
Action
No code change is actionable today. Track for:
- Upstream svgo patch, or a
node-tikzjax release that bumps its svgo dependency.
- Whether
node-tikzjax is still needed / can be swapped if this drags on.
Acceptance
npm audit no longer reports this svgo advisory.
Problem
svgo 3.0.0–3.3.3 — GHSA-2p49-hgcm-8545 (removeScripts plugin leaves some executable scripts intact).
Pulled in transitively via
node-tikzjax(used for build-time SVG optimization of LaTeX rendering) — not in the runtime request path, but it is a production dependency (unlike the other two audit findings, tracked separately in #187).Investigation done
npm audit fixandnpm audit fix --forceboth come back with no available patched svgo version — there is currently no upstream fix.Action
No code change is actionable today. Track for:
node-tikzjaxrelease that bumps its svgo dependency.node-tikzjaxis still needed / can be swapped if this drags on.Acceptance
npm auditno longer reports this svgo advisory.