Next release? about favicons HOT 10 CLOSED

yarn audit v1.22.17
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ critical      │ Prototype Pollution in minimist                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=1.2.6                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ favicons                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ favicons > to-ico > resize-img > jimp > mkdirp > minimist    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1067342                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

An update would really be encouraged.

from favicons.

What's the overall status of this? Been quite some time, is this scheduled to be part of the main release sometime soon? Thanks.

from favicons.

I think we will finish browserslist support, but we can do release right now if you want, even more I can add permission to do release, so you can do it without me

from favicons.

I am not sure if browserlist is actually needed.

1. Android Chrome icons depend on device's DPI, not on a browser's version
2. Apple icons and splash screens also depend on device, not a browser.
3. Windows platform is not a browser.
4. Yandex browser wants a single image and this may be turned on/off completely.
5. For standard icons favicons generates bare minimum.

from favicons.

@andy128k Can you give me npm name?

from favicons.

Found you, added https://www.npmjs.com/package/favicons/access, feel free to do release 👍

from favicons.

Any update on when the new release will be available? The audit headaches from the to-ico dependency are driving me nuts!

from favicons.

@mureni A version 7.0.0-beta.1 is already released.
Here is also a PR to one of downstream packages to test it.

from favicons.

What was the decision for 7.0.0-beta.1's dist/ files to move over to being ESModules vs. well established require like on 6.2.2?
I've got a downstream package (node 14.17.0) that I for the life of me can't seem to get working using 7.0.0-beta.1 cause dist/ is now all ESModules.

from favicons.

See #355

from favicons.