npm audit reports RegEx vulnerability in dependency (clean-css)

[heikkipora]

Need to update clean-css:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ clean-css                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.1.11                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ less-plugin-clean-css                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ less-plugin-clean-css > clean-css                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/785                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

[heikkipora]

It's a breaking update so likely needs more than a bit of work

[martonx]

+1 to update dependencies

[joeyparrish]

Would be fixed by upgrade proposed in #18, but there are breaking changes in the API: https://github.com/jakubpawlowicz/clean-css/blob/master/README.md#important-40-breaking-changes

Perhaps the vulnerable regex could be patched in clean-css v3 as well, and we could make a trivial update to a fixed version of v3?