fix: update html-minifier to be html-minifier-terser to solve vulnerability (#634)

khendrikse · web-flow · commit 43f7d159a16a · 2025-11-11T15:02:22.000+01:00
diff --git a/package.json b/package.json
@@ -28,7 +28,7 @@
     "compression": "^1.7.4",
     "dotenv": "^16.0.0",
     "express": "^4.17.1",
-    "html-minifier": "^4.0.0",
+    "html-minifier-terser": "^7.2.0",
     "lighthouse": "^9.6.3",
     "puppeteer": "^24.8.2"
   },
diff --git a/src/format.js b/src/format.js
@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import { minify } from 'html-minifier';
+import { minify } from 'html-minifier-terser';
 
 import makeReplacements from './replacements.js';
 
@@ -40,7 +40,7 @@ export const formatShortSummary = (categories) => {
     .join(', ');
 };
 
-export const formatResults = ({ results, thresholds }) => {
+export const formatResults = async ({ results, thresholds }) => {
   const runtimeError = results.lhr.runtimeError;
 
   const categories = Object.values(results.lhr.categories).map(
@@ -71,7 +71,7 @@ export const formatResults = ({ results, thresholds }) => {
   const installable = results.lhr.audits['installable-manifest']?.score === 1;
   const details = { installable, formFactor, locale };
 
-  const report = minify(formattedReport, {
+  const report = await minify(formattedReport, {
     removeAttributeQuotes: true,
     collapseWhitespace: true,
     removeRedundantAttributes: true,
diff --git a/src/format.test.js b/src/format.test.js
@@ -140,8 +140,10 @@ describe('format', () => {
       report: '<!doctype html>\n' + '<html lang="en">Hi</html>\n',
     });
 
-    it('should return formatted results', () => {
-      expect(formatResults({ results: getResults(), thresholds: {} })).toEqual({
+    it('should return formatted results', async () => {
+      expect(
+        await formatResults({ results: getResults(), thresholds: {} }),
+      ).toEqual({
         details: {
           formFactor: undefined,
           installable: false,
@@ -154,11 +156,11 @@ describe('format', () => {
       });
     });
 
-    it('should return formatted results with passing thresholds', () => {
+    it('should return formatted results with passing thresholds', async () => {
       const thresholds = {
         performance: 0.1,
       };
-      const formattedResults = formatResults({
+      const formattedResults = await formatResults({
         results: getResults(),
         thresholds,
       });
@@ -173,11 +175,11 @@ describe('format', () => {
       ]);
     });
 
-    it('should return formatted results with failing thresholds', () => {
+    it('should return formatted results with failing thresholds', async () => {
       const thresholds = {
         performance: 1,
       };
-      const formattedResults = formatResults({
+      const formattedResults = await formatResults({
         results: getResults(),
         thresholds,
       });
@@ -197,7 +199,7 @@ describe('format', () => {
       ]);
     });
 
-    it('should use supplied config settings and data to populate `details`', () => {
+    it('should use supplied config settings and data to populate `details`', async () => {
       const results = getResults();
       results.lhr.configSettings = {
         locale: 'es',
@@ -208,7 +210,7 @@ describe('format', () => {
         score: 1,
       };
 
-      const formattedResults = formatResults({ results, thresholds: {} });
+      const formattedResults = await formatResults({ results, thresholds: {} });
       expect(formattedResults.details).toEqual({
         formFactor: 'desktop',
         installable: true,
diff --git a/src/lib/run-audit-with-server/index.js b/src/lib/run-audit-with-server/index.js
@@ -36,7 +36,7 @@ const runAuditWithServer = async ({
       return { error };
     } else {
       const { summary, shortSummary, details, report, errors, runtimeError } =
-        formatResults({
+        await formatResults({
           results,
           thresholds,
         });
diff --git a/src/lib/run-audit-with-url/index.js b/src/lib/run-audit-with-url/index.js
@@ -22,7 +22,7 @@ const runAuditWithUrl = async ({ path = '', url, thresholds, settings }) => {
       return { error };
     } else {
       const { summary, shortSummary, details, report, errors, runtimeError } =
-        formatResults({
+        await formatResults({
           results,
           thresholds,
         });
diff --git a/yarn.lock b/yarn.lock
