Npm Audit report

[vbjay]

Tying to #124 and pugjs/pug#3395

npm --version
9.8.1

node --version
v18.18.0

npm audit

pug  <3.0.1
Severity: high
Remote code execution via the `pretty` option. - https://github.com/advisories/GHSA-p493-635q-r6gr
No fix available
node_modules/pug
  pug-loader  >=2.0.0
  Depends on vulnerable versions of pug
  node_modules/pug-loader
    @bluemodus/bluepack  *
    Depends on vulnerable versions of pug-loader
    node_modules/@bluemodus/bluepack

Can we get an update to use the updated pug package?

[webdiscus]

@vbjay the pug-loader is not maintained for more than 5 years :-/

You can use the modern alternative @webdiscus/pug-loader.
This loader is 100% compatible with the original pug-loader and also has many very useful features.

If you use the pug-loader with html-webpack-plugin, you should try to use the pug-plugin.

[vbjay]

Then at least can we do a deprecation in npm so that npm audit/install reports that info and suggests the replacement.

[webdiscus]

@vbjay it would be great, but maintemers don't react at all

[vbjay]

Bummer. Thanks.