Update sanitize-html from 2.1.0 to 2.12.1 fails. Module parse failed: Unexpected token.

[ricdev]

To Reproduce

Step by step instructions to reproduce the behavior:

1. npm install
2. npm run build

Expected behavior

Clean build.

Describe the bug

Details

Version of Node.js:

16.18.1

Server Operating System:

MacOs Monterey 12.5.1. Github Actions script.

Additional context:

Relates to #592 (comment) and #592

[BoDonkey]

Two comments:

1. Node16 is past the EOL - you should upgrade to 18 or 20. This might solve your problem.
2. I'm not sure what the build script is. It isn't part of the core repo.
   I thought we had done something to pin the version of htmlparser2, but I can't find it in the changelog. My latest version is installing 8.0.1.

[BoDonkey]

Can you provide better steps to replicate the error? Again, there isn't a build script.

[Insomniak313]

As state here the issue (I'm having the same one) is your webpack version.
You should update to v5. However, im not really satisfied with the author's answer and I'm wondering whether htmlparser2 should have a devDependency on webpack ^5

[BoDonkey]

Thanks @Insomniak313! - I thought it was something with the version of htmlparser2.

[NewEraCracker]

I am using sanitize-html in backend (...it explodes badly on non esm base with the update) and frontend (...this issue).

Updating Node.js or Webpack is not possible for us on all environments, or restructuring our backend for that matter. Webpack 5 behaves badly with circular imports (our project has over 500 of these) while Webpack 4 just chews 'em all good and produces a working bundle.

What works currently is locking this module using "sanitize-html": "~2.7.3" on the package.json dependencies, then I manually apply commit c5dbdf7 using patch-package to get rid of the security vulnerability.

I was comparing the source code of the project and not much changed. So another solution might be to force at the package.json overrides (npm) and/or resolutions (yarn) "htmlparser2": "^6.0.0" so the good old sub-dependency version is used.

My two cents. Alternatively just make a version 2.7.4 with the security patch. Thank you.

[ElectricS01]

Could this issue be fixed by bumping htmlparser2 to 9.0.0 or 9.1.0?

[adamreisnz]

Ran into the same issue, downgrading to 2.1.0 for now helped (as we are stuck on Node 16 for the time being).

Problem is not present when using a higher version of Node/Webpacker, and in our branch with upgraded Node/Webpacker version it works fine with 2.12.1.

[NewEraCracker]

@adamreisnz read my comment #663 (comment)

What works currently is locking this module using "sanitize-html": "~2.7.3" on the package.json dependencies, then I manually apply commit c5dbdf7 using patch-package to get rid of the security vulnerability.

Using earlier versions will make you vulnerable to exploits.

[adamreisnz]

Am aware, but as I said we have no choice as stuck on Node 16 for a while longer.

…

On Sat, 9 Nov 2024, 00:45 Jorge Oliveira, ***@***.***> wrote: @adamreisnz <https://github.com/adamreisnz> read my comment #663 (comment) <#663 (comment)> What works currently is locking this module using "sanitize-html": "~2.7.3" on the package.json dependencies, then I manually apply commit c5dbdf7 <c5dbdf7> using patch-package <https://www.npmjs.com/package/patch-package> to get rid of the security vulnerability. Using earlier versions will make you vulnerable to exploits. — Reply to this email directly, view it on GitHub <#663 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADXYQWRBFTUQPWBP7YBWLDZ7SP6JAVCNFSM6AAAAABGKSVWASVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINRUGUYTSNJRHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[NewEraCracker]

Version 2.7.3 works on node.js 16 (runs as far back as node.js 12).

Use this instead of 2.1.0 if you can. #663 (comment)

[adamreisnz]

Thanks, I'll check it out.

…

On Sat, 9 Nov 2024, 07:13 Jorge Oliveira, ***@***.***> wrote: Version 2.7.3 works on node.js 16 (runs as far back as node.js 12). Use this instead of 2.1.0 if you can. #663 (comment) <#663 (comment)> — Reply to this email directly, view it on GitHub <#663 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADXYQTBACVMWJJ6YC7P66LZ7T5K7AVCNFSM6AAAAABGKSVWASVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINRVGQ3TAOJRGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[adamreisnz]

Ended up using DOMPurify, as we were also running into #639 in the latest version using Vite.