security: clear serialize-javascript High alert (terser-webpack-plugin refresh) (#21397)
## What
Clears the High `serialize-javascript` alert (GHSA-5c6j-r48x-rmvq) — a
plain in-range refresh, **no resolution**, only `yarn.lock` (net −22
lines).
`serialize-javascript@6.0.2` was pulled only by
**`terser-webpack-plugin@5.3.16`** (webpack's minifier). The patched
line (7.x) is outside terser's old `^6.0.2` range — but
**`terser-webpack-plugin@5.6.1` dropped the `serialize-javascript`
dependency entirely**, and webpack already requests
`terser-webpack-plugin@^5.3.16` (which allows 5.6.1).
So `yarn up -R terser-webpack-plugin` → 5.6.1 removes the vulnerable
6.0.2; only the patched **7.0.5** (twenty-website's direct dep) remains.
## Verification
- No `serialize-javascript@6.x` left in the lockfile
- `nx build twenty-server` (exercises the `@nestjs/cli` webpack/terser
path) ✅
- `yarn install --immutable` clean
This commit is contained in:
@@ -48373,15 +48373,6 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"randombytes@npm:^2.1.0":
|
||||
version: 2.1.0
|
||||
resolution: "randombytes@npm:2.1.0"
|
||||
dependencies:
|
||||
safe-buffer: "npm:^5.1.0"
|
||||
checksum: 10c0/50395efda7a8c94f5dffab564f9ff89736064d32addf0cc7e8bf5e4166f09f8ded7a0849ca6c2d2a59478f7d90f78f20d8048bca3cdf8be09d8e8a10790388f3
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"range-parser@npm:^1.2.1, range-parser@npm:~1.2.1":
|
||||
version: 1.2.1
|
||||
resolution: "range-parser@npm:1.2.1"
|
||||
@@ -50751,7 +50742,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
|
||||
"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
|
||||
version: 5.2.1
|
||||
resolution: "safe-buffer@npm:5.2.1"
|
||||
checksum: 10c0/6501914237c0a86e9675d4e51d89ca3c21ffd6a31642efeba25ad65720bce6921c9e7e974e5be91a786b25aa058b5303285d3c15dbabf983a919f5f630d349f3
|
||||
@@ -51383,15 +51374,6 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"serialize-javascript@npm:^6.0.2":
|
||||
version: 6.0.2
|
||||
resolution: "serialize-javascript@npm:6.0.2"
|
||||
dependencies:
|
||||
randombytes: "npm:^2.1.0"
|
||||
checksum: 10c0/2dd09ef4b65a1289ba24a788b1423a035581bef60817bea1f01eda8e3bda623f86357665fe7ac1b50f6d4f583f97db9615b3f07b2a2e8cbcb75033965f771dd2
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"serialize-javascript@npm:^7.0.5":
|
||||
version: 7.0.5
|
||||
resolution: "serialize-javascript@npm:7.0.5"
|
||||
@@ -53730,31 +53712,9 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"terser-webpack-plugin@npm:^5.3.16":
|
||||
version: 5.3.16
|
||||
resolution: "terser-webpack-plugin@npm:5.3.16"
|
||||
dependencies:
|
||||
"@jridgewell/trace-mapping": "npm:^0.3.25"
|
||||
jest-worker: "npm:^27.4.5"
|
||||
schema-utils: "npm:^4.3.0"
|
||||
serialize-javascript: "npm:^6.0.2"
|
||||
terser: "npm:^5.31.1"
|
||||
peerDependencies:
|
||||
webpack: ^5.1.0
|
||||
peerDependenciesMeta:
|
||||
"@swc/core":
|
||||
optional: true
|
||||
esbuild:
|
||||
optional: true
|
||||
uglify-js:
|
||||
optional: true
|
||||
checksum: 10c0/39e37c5b3015c1a5354a3633f77235677bfa06eac2608ce26d258b1d1a74070a99910319a6f2f2c437eb61dc321f66434febe01d78e73fa96b4d4393b813f4cf
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"terser-webpack-plugin@npm:^5.3.17":
|
||||
version: 5.4.0
|
||||
resolution: "terser-webpack-plugin@npm:5.4.0"
|
||||
"terser-webpack-plugin@npm:^5.3.16, terser-webpack-plugin@npm:^5.3.17":
|
||||
version: 5.6.1
|
||||
resolution: "terser-webpack-plugin@npm:5.6.1"
|
||||
dependencies:
|
||||
"@jridgewell/trace-mapping": "npm:^0.3.25"
|
||||
jest-worker: "npm:^27.4.5"
|
||||
@@ -53763,13 +53723,31 @@ __metadata:
|
||||
peerDependencies:
|
||||
webpack: ^5.1.0
|
||||
peerDependenciesMeta:
|
||||
"@minify-html/node":
|
||||
optional: true
|
||||
"@swc/core":
|
||||
optional: true
|
||||
"@swc/css":
|
||||
optional: true
|
||||
"@swc/html":
|
||||
optional: true
|
||||
clean-css:
|
||||
optional: true
|
||||
cssnano:
|
||||
optional: true
|
||||
csso:
|
||||
optional: true
|
||||
esbuild:
|
||||
optional: true
|
||||
html-minifier-terser:
|
||||
optional: true
|
||||
lightningcss:
|
||||
optional: true
|
||||
postcss:
|
||||
optional: true
|
||||
uglify-js:
|
||||
optional: true
|
||||
checksum: 10c0/1feed4b9575af795dae6af0c8f0d76d6e1fb7b357b8628d90e834c23a651b918a58cdc48d0ae6c1f0581f74bc8169b33c3b8d049f2d2190bac4e310964e59fde
|
||||
checksum: 10c0/841674dab9b58ee242a64a548f2797f83eca3debc010afb2aa1a4be7149e7195a6a546a746324803ba05f72d0c9dc4357e34f17e4b6d6c054bd49a0913c413b9
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
|
||||
Reference in New Issue
Block a user