css-what's Denial of Service vulnerabitlity

[leifjones]

Describe the bug
Projects that consume svgo (e.g., indirectly, @angular-devkit/build-angular via css-minimizer-webpack-plugin > cssnano > cssnano-preset-default > postcss-svgo > svgo > css-select > css-what) have a high severity DoS vulnerability due to something that was fixed in version 5.0.1 of css-what. css-select already fixed this in its latest release. Could there be a dependency update to address this?

To Reproduce
Steps to reproduce the behavior:

1. run npm install on an angular 12 project
2. run npm audit

Expected behavior
No vulnerability for projects that depend on patched versions of svgo

Screenshots

Desktop (please complete the following information):

• SVGO Version ^2.3.0
• NodeJs Version 14
• OS: Windows 10

[chappjc]

Appears to be #1488, but I second this.

[leifjones]

@chappjc ah, thanks. Yes, I'll close this.