Potential security vulnerabilities with hexo-cli dependency package

[ShineSmile]

Environment Info

Node version(node -v):
v9.3.0
Your site _config.yml (Optional):

Your theme _config.yml (Optional):

Hexo and Plugin version(npm ls --depth 0):
hexo-site@0.0.0 /Users/shine/Projects/GitHub/Blog
├── hexo@3.4.4
├── hexo-asset-image@0.0.3 (git+https://github.com/CodeFalling/hexo-asset-image.git#dc5a811c118564368e75ab493b2d7b8480dacb92)
├── hexo-deployer-git@0.2.0
├── hexo-generator-archive@0.1.5
├── hexo-generator-category@0.1.3
├── hexo-generator-index@0.2.1
├── hexo-generator-sitemap@1.2.0
├── hexo-generator-tag@0.2.0
├── hexo-pagination@0.1.0
├── hexo-renderer-ejs@0.2.0
├── hexo-renderer-marked@0.2.11
├── hexo-renderer-stylus@0.3.3
└── hexo-server@0.2.2

For BUG

Potential security vulnerabilities with hexo-cli dependency package from github.

For question

I don't know whether hexo will still work after I edit the package.json by myself.

For feature request

[JLHwung]

@ShineSmile On ejs issues, please run

npm update --save hexo-renderer-ejs

On uglify-js issue, could you run

npm ls uglify-js

to see why we depends on uglify-js? Thank you.

[ShineSmile]

npm update --save hexo-renderer-ejs

Nothing happenes.

---

npm ls uglify-js

hexo-site@0.0.0 /Users/shine/Projects/GitHub/Blog
└─┬ hexo@3.4.4
└─┬ swig@1.4.2
└── uglify-js@2.4.24

[ShineSmile]

[stale]

This issue has been automatically marked as stale because lack of recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[ShineSmile]

more vulnerabilities comes. :(

BTW, I use master branch for my page source file and project storage. and I just care about the vulnerabilities but no function. None error happens when i run hexo. I will dismiss them until hexo-cli doesn't work.

THX