Skip to content

[Security] Update terser webpack plugin - #8102

Merged
andriijas merged 6 commits into
react:masterfrom
RDIL:master
Dec 11, 2019
Merged

[Security] Update terser webpack plugin#8102
andriijas merged 6 commits into
react:masterfrom
RDIL:master

Conversation

@RDIL

@RDILRDIL commented Dec 6, 2019

Copy link
Copy Markdown
Contributor

Updates the terser webpack plugin.
Fixes#8100

@RDILRDIL changed the title security: update terser webpack plugin[Security] Update terser webpack pluginDec 6, 2019
@heyimalex

Copy link
Copy Markdown
Contributor

For context:

  • GHSA-h9rv-jmmf-4pgx
  • we pin terser-webpack-plugin at 2.2.1
  • terser-webpack-plugin 2.2.1 depends on serialize-javascript ^1.7.0
  • vulnerability was fixed in serialize-javascript 2.1.1

So we either bump or wait for serialize-javascript to backport a security fix to the 1.x branch. The issue doesn't really affect us since there's no xss at build time, but people complain in the tracker either way.

@heyimalexheyimalex added this to the 3.3.1 milestone Dec 6, 2019
@andriijas

andriijas commented Dec 11, 2019

Copy link
Copy Markdown
Contributor

@RDIL Want to upgrade to 2.2.3 in this PR? Don't forget react-error-overlay Thanks

@andriijas
andriijas merged commit 8d1a4f2 into react:masterDec 11, 2019
@heyimalexheyimalex mentioned this pull request Dec 12, 2019
@locklockBot locked and limited conversation to collaborators Dec 16, 2019
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Issue with serialize-javascript

4 participants

@RDIL@heyimalex@andriijas@facebook-github-bot