sookie/blog-web
1
0
Fork 0
Code Issues 12 Pull Requests Projects Releases Wiki Activity
413 Commits 2 Branches 1 Tag
Commit Graph

43 Commits

Author SHA1 Message Date
灌糖包子
c4e47fe9fa
安全加固：升级依赖消除高危漏洞，修复构建兼容性问题 
【主项目依赖升级】
- hexo 6.x → 8.1.2：移除 swig-templates、swig-extras、旧版 cheerio、
  hexo-fs/hexo-util 等大量漏洞依赖链，解决 critical/high 级别漏洞
- hexo-renderer-marked 5.x → 7.0.1：修复 dompurify XSS 漏洞（GHSA-hpcv）
- gulp 4.x → 5.0.1：修复 vinyl-fs、glob/glob-stream、chokidar、
  braces 等 high 级漏洞链
- hexo-generator-sitemap 2.2.0 → 3.0.1：同步升级

【替换高危依赖】
- gulp-htmlmin 替换为 gulp-html-minifier-terser@7.1.0：
  gulp-htmlmin 依赖的 html-minifier 存在 ReDoS 高危漏洞且无修复版本，
  改用其维护分支 html-minifier-terser，API 完全兼容
- optimist 替换为 minimist@1.2.8（devDependency）：
  optimist 捆绑的 minimist@<=0.2.3 存在 prototype pollution critical 漏洞，
  直接使用修复版 minimist 替代

【移除无修复版本的高危包】
- 移除 hexo-generator-baidu-sitemap（无维护更新，内部捆绑 hexo@4.x
  导致一系列 critical 漏洞），在 scripts/generator.js 中实现等效的
  自定义 Baidu Sitemap 生成器替代，功能与原包完全一致

【npm overrides 修复传递依赖漏洞】
- 添加 overrides: { ejs: "^6.0.1" }：
  hexo-renderer-ejs@2.x 依赖 ejs@3.x，ejs@3.x 存在 SSTI critical 漏洞
  且引入 jake → filelist → minimatch → brace-expansion 漏洞链；
  ejs@6.x 已无 jake 依赖，critical 漏洞全部消除

【yilia 主题依赖升级】
- @babel/core 7.26.x → 7.29.7：修复 Arbitrary File Read 漏洞
- @babel/plugin-transform-runtime / @babel/preset-env 同步升级至 7.29.x
- postcss 8.5.3 → 8.5.25：修复 XSS 及路径遍历漏洞
- 移除 clean-webpack-plugin（依赖链含 brace-expansion 高危漏洞），
  改用 webpack 5 内置 output.clean 实现等效的增量清理功能
- 添加 overrides: { brace-expansion: "5.0.9" } 修复剩余传递依赖漏洞

【构建兼容性修复】
- scripts/generator.js 新增 jsfiddle tag 注册：
  hexo@8 移除了内置 {% jsfiddle %} tag 导致构建 FATAL，
  重新实现该 tag 保持原有 iframe 嵌入行为
- gulpfile.js generate 任务错误处理修正：
  原代码在 hexo FATAL 时调用 hexo.exit(err) 但不向 gulp 抛出异常，
  导致 series 继续执行后续任务（compressHtml 因 public/ 不存在而报错），
  修改为在 hexo 退出后重新 throw err 确保 gulp 正确感知失败

【修复结果】
- 主项目：56 个漏洞（8 低危、14 中危、25 高危、9 严重）→ 0 个漏洞
- yilia 主题：8 个漏洞 → 1 个低危
  （剩余 1 个为 vue@2.x ReDoS，仅影响构建时自身模板解析，
  修复需整体迁移到 Vue 3 重写主题，暂不处理）
 2026-07-31 20:38:04 +08:00
dependabot[bot]
1d990a3df5
Bump decode-uri-component from 0.2.0 to 0.2.2 
Bumps [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) from 0.2.0 to 0.2.2.
- [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases)
- [Commits](https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.0...v0.2.2)

---
updated-dependencies:
- dependency-name: decode-uri-component
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-12-03 01:44:41 +00:00
dependabot[bot]
1c3ad4d69e
Bump moment-timezone from 0.5.23 to 0.5.37 
Bumps [moment-timezone](https://github.com/moment/moment-timezone) from 0.5.23 to 0.5.37.
- [Release notes](https://github.com/moment/moment-timezone/releases)
- [Changelog](https://github.com/moment/moment-timezone/blob/develop/changelog.md)
- [Commits](https://github.com/moment/moment-timezone/compare/0.5.23...0.5.37)

---
updated-dependencies:
- dependency-name: moment-timezone
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-08-30 22:33:13 +00:00
灌糖包子
57cc1f64f5
Merge pull request #46 from sookie2010/dependabot/npm_and_yarn/copy-props-2.0.5 
Bump copy-props from 2.0.4 to 2.0.5
 2022-03-09 13:51:09 +08:00
灌糖包子
41e7f1ea7c
Merge pull request #41 from sookie2010/dependabot/npm_and_yarn/tar-4.4.19 
Bump tar from 4.4.8 to 4.4.19
 2022-03-09 13:50:58 +08:00
灌糖包子
8f2afff210
Merge pull request #39 from sookie2010/dependabot/npm_and_yarn/path-parse-1.0.7 
Bump path-parse from 1.0.6 to 1.0.7
 2022-03-09 13:50:43 +08:00
灌糖包子
29a1c15418
Merge pull request #34 from sookie2010/dependabot/npm_and_yarn/hosted-git-info-2.8.9 
Bump hosted-git-info from 2.7.1 to 2.8.9
 2022-03-09 13:50:33 +08:00
dependabot[bot]
59024a87f4
Bump tar from 4.4.8 to 4.4.19 
Bumps [tar](https://github.com/npm/node-tar) from 4.4.8 to 4.4.19.
- [Release notes](https://github.com/npm/node-tar/releases)
- [Changelog](https://github.com/npm/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/npm/node-tar/compare/v4.4.8...v4.4.19)

---
updated-dependencies:
- dependency-name: tar
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-03-08 05:55:21 +00:00
dependabot[bot]
70627d22ee
Bump hosted-git-info from 2.7.1 to 2.8.9 
Bumps [hosted-git-info](https://github.com/npm/hosted-git-info) from 2.7.1 to 2.8.9.
- [Release notes](https://github.com/npm/hosted-git-info/releases)
- [Changelog](https://github.com/npm/hosted-git-info/blob/v2.8.9/CHANGELOG.md)
- [Commits](https://github.com/npm/hosted-git-info/compare/v2.7.1...v2.8.9)

Signed-off-by: dependabot[bot] <support@github.com>
 2022-03-08 05:55:15 +00:00
dependabot[bot]
0866b382dc
Bump prismjs from 1.23.0 to 1.27.0 
Bumps [prismjs](https://github.com/PrismJS/prism) from 1.23.0 to 1.27.0.
- [Release notes](https://github.com/PrismJS/prism/releases)
- [Changelog](https://github.com/PrismJS/prism/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PrismJS/prism/compare/v1.23.0...v1.27.0)

---
updated-dependencies:
- dependency-name: prismjs
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-03-08 05:55:15 +00:00
dependabot[bot]
b40367c6f0
Bump path-parse from 1.0.6 to 1.0.7 
Bumps [path-parse](https://github.com/jbgutierrez/path-parse) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/jbgutierrez/path-parse/releases)
- [Commits](https://github.com/jbgutierrez/path-parse/commits/v1.0.7)

---
updated-dependencies:
- dependency-name: path-parse
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-03-08 05:54:53 +00:00
朱进禄
802bec24b5 升级hexo相关依赖包 2022-03-08 13:53:54 +08:00
dependabot[bot]
405be8b671
Bump copy-props from 2.0.4 to 2.0.5 
Bumps [copy-props](https://github.com/gulpjs/copy-props) from 2.0.4 to 2.0.5.
- [Release notes](https://github.com/gulpjs/copy-props/releases)
- [Changelog](https://github.com/gulpjs/copy-props/blob/master/CHANGELOG.md)
- [Commits](https://github.com/gulpjs/copy-props/compare/2.0.4...2.0.5)

---
updated-dependencies:
- dependency-name: copy-props
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-03-07 11:52:02 +00:00
朱进禄
d75c41ebae 修改vue引入方式 2022-03-07 16:30:07 +08:00
夏夜梦星辰
d94afaea47
Merge pull request #31 from sookie2010/dependabot/npm_and_yarn/dot-prop-4.2.1 
Bump dot-prop from 4.2.0 to 4.2.1
 2021-04-20 09:52:24 +08:00
夏夜梦星辰
4a0528c9b6
Merge pull request #28 from sookie2010/dependabot/npm_and_yarn/yargs-parser-5.0.1 
Bump yargs-parser from 5.0.0 to 5.0.1
 2021-04-20 09:52:12 +08:00
dependabot[bot]
be7dc86d7e
Bump yargs-parser from 5.0.0 to 5.0.1 
Bumps [yargs-parser](https://github.com/yargs/yargs-parser) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/yargs/yargs-parser/releases)
- [Changelog](https://github.com/yargs/yargs-parser/blob/v5.0.1/CHANGELOG.md)
- [Commits](https://github.com/yargs/yargs-parser/compare/v5.0.0...v5.0.1)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-04-20 01:51:31 +00:00
dependabot[bot]
96ce935dcd
Bump lodash from 4.17.11 to 4.17.21 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.11 to 4.17.21.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.11...4.17.21)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-04-20 01:50:47 +00:00
dependabot[bot]
64757b48a0
Bump dot-prop from 4.2.0 to 4.2.1 
Bumps [dot-prop](https://github.com/sindresorhus/dot-prop) from 4.2.0 to 4.2.1.
- [Release notes](https://github.com/sindresorhus/dot-prop/releases)
- [Commits](https://github.com/sindresorhus/dot-prop/compare/v4.2.0...v4.2.1)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-04-20 01:50:40 +00:00
夏夜梦星辰
c96a169b7c
Merge pull request #22 from sookie2010/dependabot/npm_and_yarn/ini-1.3.8 
Bump ini from 1.3.5 to 1.3.8
 2021-04-20 09:50:25 +08:00
夏夜梦星辰
bbd55797e6
Merge pull request #24 from sookie2010/dependabot/npm_and_yarn/prismjs-1.23.0 
Bump prismjs from 1.22.0 to 1.23.0
 2021-04-20 09:49:33 +08:00
夏夜梦星辰
74d577b82c
Merge pull request #20 from sookie2010/dependabot/npm_and_yarn/y18n-3.2.2 
Bump y18n from 3.2.1 to 3.2.2
 2021-04-20 09:49:01 +08:00
dependabot[bot]
aae82af0c8
Bump ini from 1.3.5 to 1.3.8 
Bumps [ini](https://github.com/isaacs/ini) from 1.3.5 to 1.3.8.
- [Release notes](https://github.com/isaacs/ini/releases)
- [Commits](https://github.com/isaacs/ini/compare/v1.3.5...v1.3.8)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-04-20 01:47:31 +00:00
dependabot[bot]
9375705c6e
Bump y18n from 3.2.1 to 3.2.2 
Bumps [y18n](https://github.com/yargs/y18n) from 3.2.1 to 3.2.2.
- [Release notes](https://github.com/yargs/y18n/releases)
- [Changelog](https://github.com/yargs/y18n/blob/master/CHANGELOG.md)
- [Commits](https://github.com/yargs/y18n/commits)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-04-20 01:46:43 +00:00
dependabot[bot]
09a0eddf03
Bump node-fetch from 2.5.0 to 2.6.1 
Bumps [node-fetch](https://github.com/bitinn/node-fetch) from 2.5.0 to 2.6.1.
- [Release notes](https://github.com/bitinn/node-fetch/releases)
- [Changelog](https://github.com/node-fetch/node-fetch/blob/master/docs/CHANGELOG.md)
- [Commits](https://github.com/bitinn/node-fetch/compare/v2.5.0...v2.6.1)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-04-20 01:45:35 +00:00
dependabot[bot]
344a8695b3
Bump prismjs from 1.22.0 to 1.23.0 
Bumps [prismjs](https://github.com/PrismJS/prism) from 1.22.0 to 1.23.0.
- [Release notes](https://github.com/PrismJS/prism/releases)
- [Changelog](https://github.com/PrismJS/prism/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PrismJS/prism/compare/v1.22.0...v1.23.0)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-04-20 01:45:29 +00:00
dependabot[bot]
3c646d498d
Bump highlight.js from 9.15.6 to 9.18.5 
Bumps [highlight.js](https://github.com/highlightjs/highlight.js) from 9.15.6 to 9.18.5.
- [Release notes](https://github.com/highlightjs/highlight.js/releases)
- [Changelog](https://github.com/highlightjs/highlight.js/blob/9.18.5/CHANGES.md)
- [Commits](https://github.com/highlightjs/highlight.js/compare/9.15.6...9.18.5)

Signed-off-by: dependabot[bot] <support@github.com>
 2020-11-24 23:45:59 +00:00
dependabot[bot]
b2ee25bdc7
Bump mixin-deep from 1.3.1 to 1.3.2 
Bumps [mixin-deep](https://github.com/jonschlinkert/mixin-deep) from 1.3.1 to 1.3.2.
- [Release notes](https://github.com/jonschlinkert/mixin-deep/releases)
- [Commits](https://github.com/jonschlinkert/mixin-deep/compare/1.3.1...1.3.2)

Signed-off-by: dependabot[bot] <support@github.com>
 2019-08-29 01:14:35 +00:00
dependabot[bot]
7930d0bb91
Bump lodash.merge from 4.6.1 to 4.6.2 
Bumps [lodash.merge](https://github.com/lodash/lodash) from 4.6.1 to 4.6.2.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/commits)

Signed-off-by: dependabot[bot] <support@github.com>
 2019-07-10 23:11:59 +00:00
结发受长生
da0530d37a 定制文章内容xml模板 2019-07-01 14:48:12 +08:00
结发受长生
2b635d6783 优雅写异步与循环 2019-07-01 00:12:32 +08:00
结发受长生
c287a3e94e 文章分词数据同步 2019-06-29 12:12:11 +08:00
结发受长生
40d2b564a3 algolia-search你个废物,不能传全文执行检索要你何用 2019-06-28 20:23:34 +08:00
结发受长生
d2987e3a14 添加Algolia 2019-06-27 17:37:55 +08:00
结发受长生
83a464b2c2 冤枉gulp-plumber了,是服务器内存捉急 2019-05-18 16:32:15 +08:00
结发受长生
5decb8a7ca gulp-plumber坑我, 大概率会导致构建进程挂掉 2019-05-16 10:19:48 +08:00
结发受长生
a0a5800024 html压缩+图片同步 2019-05-11 00:47:37 +08:00
结发受长生
9c264c9f4e 更新依赖包 2019-04-14 18:20:53 +08:00
结发受长生
9aad0275e8 删除deployer-git依赖 2019-04-14 17:53:38 +08:00
sookie
edffbb8fda 依赖包升级 2018-12-07 17:40:21 +08:00
sookie
fa6b11463e shell通配符 2018-09-27 17:55:26 +08:00
结发受长生
6b08726f3c 依赖包升级 2018-05-19 19:38:10 +08:00
结发受长生
0d8a9f6739 initial 2018-05-06 01:00:35 +08:00