# Broccoli middleware - Security update

**URL:** <https://discuss.emberjs.com/t/broccoli-middleware-security-update/21356>\
**Category:** Ember CLI\
**Created:** [October 17, 2024, 9:16am UTC](https://discuss.emberjs.com/t/broccoli-middleware-security-update/21356 "2024-10-17T09:16:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JanEaton](https://sea1.discourse-cdn.com/flex019/user_avatar/discuss.emberjs.com/janeaton/32/18420_2.png) [@JanEaton](https://discuss.emberjs.com/u/JanEaton)\
**Post date:** [October 17, 2024, 9:16am UTC](https://discuss.emberjs.com/t/broccoli-middleware-security-update/21356/1 "2024-10-17T09:16:54Z")

</div>

Hi, would it be possible to accept a PR to address security vulnerabilities in **ansi-html** library: [Security Vulnerability: ansi-html@0.0.7 · Issue #56 · ember-cli/broccoli-middleware · GitHub](https://github.com/ember-cli/broccoli-middleware/issues/56)

Could you update the broccoli-middleware project ? There is no real activity in the last couple of years.

Thank you, Jan

---

<div class="post-metadata">

**Author:** ![gorner](https://sea1.discourse-cdn.com/flex019/user_avatar/discuss.emberjs.com/gorner/32/15048_2.png) [@gorner](https://discuss.emberjs.com/u/gorner)\
**Post date:** [October 21, 2024, 1:48pm UTC](https://discuss.emberjs.com/t/broccoli-middleware-security-update/21356/2 "2024-10-21T13:48:14Z")

</div>

Hi. Just as a disclaimer, I am **not** part of the Ember-CLI team, just trying to help as one of the many people here working on apps in the Ember ecosystem.

My understanding is that Broccoli, broccoli-middleware, and other packages of that type have indeed gone dormant over the past couple of years the Ember community has shifted their focus to building out [Embroider](https://github.com/embroider-build/embroider) as the eventual replacement for Broccoli.

My quick review of how Broccoli and broccoli-middleware use `ansi-html` suggest it would only be a realistic concern if you are using Broccoli / Ember-CLI to serve your live production server. The **much** more common case is building assets for deploy, in which case the only data you’re feeding into `ansi-html` would be content you control (and even then it seems to be used mainly for rendering error data).

That said, I know some companies are sticklers about this sort of thing. If you still need to apply this fix, you should use npm [`overrides`](https://docs.npmjs.com/cli/v10/configuring-npm/package-json?v=true#overrides) (or the equivalents for other package managers) in your package.json file:

```json
"overrides": {
  "ansi-html": "^0.0.9"
}

```

We have used a similar setup in our app for the past several months without concern.

---

<div class="post-metadata">

**Author:** ![JanEaton](https://sea1.discourse-cdn.com/flex019/user_avatar/discuss.emberjs.com/janeaton/32/18420_2.png) [@JanEaton](https://discuss.emberjs.com/u/JanEaton)\
**Post date:** [October 29, 2024, 3:33pm UTC](https://discuss.emberjs.com/t/broccoli-middleware-security-update/21356/3 "2024-10-29T15:33:24Z")

</div>

Hi, thanks for the tip. Eventually, we’ve used the package manager resolution ([Selective dependency resolutions | Yarn](https://classic.yarnpkg.com/lang/en/docs/selective-version-resolutions/)) to apply latest version of **ansi-html** library. Does it make sense to use **Embroider** for the build pipeline right now ? Is it production ready ? Or should we wait for official process, when it becomes part of EmberCLI ?

Is there an example how to migrate from Brocolli to Embroider ?

Thank you, Jan

---

<div class="post-metadata">

**Author:** ![gorner](https://sea1.discourse-cdn.com/flex019/user_avatar/discuss.emberjs.com/gorner/32/15048_2.png) [@gorner](https://discuss.emberjs.com/u/gorner)\
**Post date:** [October 30, 2024, 1:20am UTC](https://discuss.emberjs.com/t/broccoli-middleware-security-update/21356/4 "2024-10-30T01:20:34Z")

</div>

@JanEaton I can point you to the [“How to try it” section](https://github.com/embroider-build/embroider?tab=readme-ov-file#how-to-try-it) of the Embroider readme, but I haven’t really tried it with the app I work on yet.

From that same readme: “Several large, heavily-tested Ember apps are shipping to production with Embroider.” If that’s correct (and I have no reason to doubt it), the risk of switching now should be relatively low.

However even if you switch to an Embroider build, Broccoli (and therefore ansi-html) will still be installed as dependencies of Ember-CLI for some time to come, until Broccoli support is removed. So I wouldn’t (yet) switch to Embroider _just_ to try to remove ansi-html from your build tree.