NPM Vulnerabilities

[valioprea]

When I download this kit & do npm install - I get some vulnerabilities, 3 moderate and 5 high. I'm not a node dev, not sure exactly how to address them, I'd fix them myself.

[jonathan-durbin]

When I ran npm audit fix it resolved almost all of the issues. There's just one high priority issue left, which is @sherby/eleventy-plugin-files-minifier's dependency on html-minifier, which has a ReDoS vulnerability.

@ItsEthanH, it looks like most people are moving to html-minifier-terser from the original html-minifier, which might have been abandoned. Is the fix to simply replace the dependency in node_modules/@sherby/eleventy-plugin-files-minifier/package.json with the terser version? I'm not familiar with node's package management system, so any help is appreciated.

Edit:
After poking around, it looks like

package-lock.json#L821

and

package-lock.json#L2550

might be all that needs to change. But again, as a node novice, I couldn't say for certain.