Mjml: CVE-2021-33587 package vulnerability

[dilumn]

Describe the bug

=> Found "[email protected]"
info Reasons this module exists
   - "_project_#mjml-core#cheerio#css-select" depends on it

https://avd.aquasec.com/nvd/cve-2021-33587/

Is it possible to update mjml packages to have css-what >= 5.0.1?
Looks like for this to fully work we need https://github.com/Automattic/juice package to update their dependencies also. But that can be done from juice side

Expected behavior
css-what to be 5.0.1 in yarn.lock file

MJML environment (please complete the following information):

• MJML Version - latest

[pfmnzone]

According to this updating to [email protected] should do the trick.

Here is a pull request

[mashpie]

please don't forget to publish :)

[iRyusa]

We'll do it in 4.9.x. It's not really that critical in MJML context.

[mashpie]

@iRyusa Thanks for info. Is there any eta on when you will release? Because, currently, some CI Pipelines fail and block due to that high CVE. If it takes some more time, I'd rather tend to monkey patch cheerio and/or css-what though resolutions in yarn than waiting too long for a release.

[iRyusa]

We'll see if we can get sometime around next week as we can't automate releases.

[iRyusa]

This should be solved in 4.10.0, note that there's a dep issue with babel runtime you should regenerate your lockfile 👍 closing

[mashpie]

@iRyusa perfect time! I can confirm all working fine. Thanks a lot!