diff --git a/package-lock.json b/package-lock.json
index adb21b4..2748ebf 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -857,12 +857,12 @@
       }
     },
     "config": {
-      "version": "1.31.0",
-      "resolved": "https://registry.npmjs.org/config/-/config-1.31.0.tgz",
-      "integrity": "sha512-Ep/l9Rd1J9IPueztJfpbOqVzuKHQh4ZODMNt9xqTYdBBNRXbV4oTu34kCkkfdRVcDq0ohtpaeXGgb+c0LQxFRA==",
+      "version": "3.3.8",
+      "resolved": "https://registry.npmjs.org/config/-/config-3.3.8.tgz",
+      "integrity": "sha512-rFzF6VESOdp7wAXFlB9IOZI4ouL05g3A03v2eRcTHj2JBQaTNJ40zhAUl5wRbWHqLZ+uqp/7OE0BWWtAVgrong==",
       "dev": true,
       "requires": {
-        "json5": "^1.0.1"
+        "json5": "^2.2.1"
       }
     },
     "console-control-strings": {
@@ -2978,21 +2978,10 @@
       "dev": true
     },
     "json5": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-      "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
-      "dev": true,
-      "requires": {
-        "minimist": "^1.2.0"
-      },
-      "dependencies": {
-        "minimist": {
-          "version": "1.2.0",
-          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
-          "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
-          "dev": true
-        }
-      }
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true
     },
     "jsonfile": {
       "version": "4.0.0",
diff --git a/package.json b/package.json
index ac40602..426099c 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
   "repository": "https://github.com/zuixjs/zuix-web-starter",
   "devDependencies": {
     "chokidar": "^2.1.5",
-    "config": "^1.31.0",
+    "config": "^3.3.8",
     "delay": "^2.0.0",
     "es6-promise": "^4.2.6",
     "eslint": "^4.19.1",