Potential security vulnerability

[krissalvador27]

Hello!

Our repo Reactochart uses measure-text and we found that it may have a potential security vulnerability. Tracing our package-lock.json it maps to url-loader v0.5.9 which uses mime v1.3.6 which I believe has the vulnerability.

It's fixed in later versions broofa/mime#167.

Let me know if this is something I can help with!

[tptee]

Thanks for catching this! I'll fix this today!

[krissalvador27]

hey @tptee, just wanted to follow up on this issue and see if there are any recent updates you can share. Thanks!

[krissalvador27]

Hey @tptee . We're going to import measure-text's source code into our repo for now. Will try to get around to a PR but unfortunately don't have the bandwidth right now to update url-loader and fix any breaking dependencies upon upgrade. This also solves issue spotify/reactochart#123 for us.

Thanks!