Currently packages/cli/package.json and packages/devtools-server/package.json point to gray-matter v4.0.3.
That gray-matter repo appears to be unmaintained with it's last release was in January 2019: https://github.com/jonschlinkert/gray-matter/tags
Luckily 11ty maintain a fork of this library: https://github.com/11ty/gray-matter which means that its dependencies are also upgraded as there are CVEs etc.
I propose that refine should move to this maintained version of the gray-matter library. I'll put in a PR with the required changes.
This was provoked by a recent security alert on js-yaml that is a dependency of both gray-matter and @11th/gray-matter but is only likely to be addressed by @11ty/gray-matter.
Currently
packages/cli/package.jsonandpackages/devtools-server/package.jsonpoint togray-matterv4.0.3.That
gray-matterrepo appears to be unmaintained with it's last release was in January 2019: https://github.com/jonschlinkert/gray-matter/tagsLuckily
11tymaintain a fork of this library: https://github.com/11ty/gray-matter which means that its dependencies are also upgraded as there are CVEs etc.I propose that refine should move to this maintained version of the
gray-matterlibrary. I'll put in a PR with the required changes.This was provoked by a recent security alert on
js-yamlthat is a dependency of bothgray-matterand@11th/gray-matterbut is only likely to be addressed by@11ty/gray-matter.