Migrate off purify-css

[benmccann]

Describe the bug

purify-css has not been updated in 6 years and is causing security warnings in the AMP example

Reproduction

kit/packages/kit/test/apps/amp/src/hooks.server.js

Line 25 in e133aba

css = purify(markup, css);

Logs

No response

System Info

`master`

Severity

annoyance

Additional Information

Some alternatives:

• https://github.com/FullHuman/purgecss
• https://github.com/leeoniya/dropcss

[ghostdevv]

going to look into it now 🙏

[ghostdevv]

So looking into it, I'm not sure why it's included in the tests when it's not included in the docs. #4710 has a comment about why you might need it:

One thing we lose is the ability to exclude CSS from components that are imported but not rendered for a given page. Given AMP's wholly arbitrary CSS size limit, that can be a problem. This can be solved (at least for prerendered pages, where it doesn't matter how expensive this sort of processing is) with something like purifycss/purifycss:

What is the preferred solution here?

• Migrate off purify css
• Migrate off purify css and add a note about this to the docs
• Remove it altogether

Will raise a PR for whatever is decided - tagging @Rich-Harris here too as he originally added this 🙏

[ghostdevv]

Some alternatives:

leeoniya/dropcss:

• No types
• CJS build only

FullHuman/purgecss:

• Uses Node Libs
• Big dependancies

[benmccann]

I think using dropcss might be the best solution then as I'd prefer not to pull in a lot of dependencies and it'd be nice to demonstrate usage for our users. I filed an issue there requesting some types, but in the meantime we can just do // @ts-ignore if needed

If that doesn't work for some reason then my second choice would be to remove it and add a comment like:

// you could invoke a library like purify-css/purgecss/dropcss here to exclude CSS from components that are imported, but not rendered

[ghostdevv]

I filed an issue there requesting some types, but in the meantime we can just do // @ts-ignore if needed

Ty! I ended up writing types for the tests in #10546 so submitted a pr to dropcss to add those types in - hopefully they take a look at it soon 🤞