Updating grunt to ^1.0.4, and grunt-contrib-jshint to ^2.1.0 solves a big majority of the dependency issues. However, three dev dependencies, grunt-imgcompress, grunt-newer, and grunt-surround needs grunt to be ~0.4.0. I could fork these dependencies and work from there.

My output:

npm WARN [email protected] requires a peer of grunt@~0.4.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of grunt@~0.4.1 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of grunt@~0.4.1 but none is installed. You must install peer dependencies yourself.

Forking them sounds like a lot of effort. I'd check whether we actually still need them (e.g. have they been folded into other packages), and are there newer alternatives which everyone now uses instead?

Yeah that's what I thought of too. @tsaoyu mind checking if we still need them? I'm going through them now myself too, but I may miss some things out.

I don't know if we need it or not. I setup this blog using made-mistakes template and they has updated the packages list to mitigate the security issue. Maybe worth to migrate to newer version.

I'll look at that this evening 👍

Going through Made Mistakes, there really doesn't seem to be an easy way to fix these vulnerabilities. The docs for that template itself says that we'd need to rework quite a bit of it in order to publish it to Github Pages. Case in point, it has a few plugins in its Gemfile that isn't allowed in Pages. On top of this, I'm struggling to even get the repo to build on my machine haha.

I should also mention that the NPM updates isn't as simple as updating the package.json in Made Mistakes.

Yeah that's true. Just thought I'd be able to tackle it :P