fix(security): drop vulnerable serialize-javascript via terser-webpack-plugin bump (#21871)
## fix(security): drop vulnerable serialize-javascript via terser-webpack-plugin bump Resolves [Dependabot Alert #548](https://github.com/twentyhq/twenty/security/dependabot/548) and [#1290](https://github.com/twentyhq/twenty/security/dependabot/1290). ### What `serialize-javascript` `< 7.0.5` is affected by: - **RCE via `RegExp.flags` / `Date.prototype.toISOString`** ([#548](https://github.com/twentyhq/twenty/security/dependabot/548), High) - **CPU-exhaustion DoS via crafted array-like objects** ([#1290](https://github.com/twentyhq/twenty/security/dependabot/1290), Moderate) ### How — parent-bump, no resolution The only consumer of the vulnerable `serialize-javascript@^6.0.2` in the tree was `terser-webpack-plugin`, which **removed the `serialize-javascript` dependency in 5.4.0**. This bumps `terser-webpack-plugin` `5.3.16 -> 5.6.1` within its existing `^5.3.16` range — an in-range parent-bump that drops `serialize-javascript` from the tree **entirely** (preferred over a `resolutions` override). ### Verification - `serialize-javascript` no longer resolves anywhere in the tree (both the vulnerable `6.0.2` and the prior `7.0.5` copies are gone). - `terser-webpack-plugin` is dev/build tooling (webpack minification), not imported in our source. - Lockfile-only change (net −22 lines); `yarn install --immutable` passes.
This commit is contained in:
@@ -47799,15 +47799,6 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"randombytes@npm:^2.1.0":
|
||||
version: 2.1.0
|
||||
resolution: "randombytes@npm:2.1.0"
|
||||
dependencies:
|
||||
safe-buffer: "npm:^5.1.0"
|
||||
checksum: 10c0/50395efda7a8c94f5dffab564f9ff89736064d32addf0cc7e8bf5e4166f09f8ded7a0849ca6c2d2a59478f7d90f78f20d8048bca3cdf8be09d8e8a10790388f3
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"range-parser@npm:^1.2.1, range-parser@npm:~1.2.1":
|
||||
version: 1.2.1
|
||||
resolution: "range-parser@npm:1.2.1"
|
||||
@@ -50038,7 +50029,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
|
||||
"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
|
||||
version: 5.2.1
|
||||
resolution: "safe-buffer@npm:5.2.1"
|
||||
checksum: 10c0/6501914237c0a86e9675d4e51d89ca3c21ffd6a31642efeba25ad65720bce6921c9e7e974e5be91a786b25aa058b5303285d3c15dbabf983a919f5f630d349f3
|
||||
@@ -50642,15 +50633,6 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"serialize-javascript@npm:^6.0.2":
|
||||
version: 6.0.2
|
||||
resolution: "serialize-javascript@npm:6.0.2"
|
||||
dependencies:
|
||||
randombytes: "npm:^2.1.0"
|
||||
checksum: 10c0/2dd09ef4b65a1289ba24a788b1423a035581bef60817bea1f01eda8e3bda623f86357665fe7ac1b50f6d4f583f97db9615b3f07b2a2e8cbcb75033965f771dd2
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"serve-index@npm:^1.9.1":
|
||||
version: 1.9.2
|
||||
resolution: "serve-index@npm:1.9.2"
|
||||
@@ -52902,31 +52884,9 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"terser-webpack-plugin@npm:^5.3.16":
|
||||
version: 5.3.16
|
||||
resolution: "terser-webpack-plugin@npm:5.3.16"
|
||||
dependencies:
|
||||
"@jridgewell/trace-mapping": "npm:^0.3.25"
|
||||
jest-worker: "npm:^27.4.5"
|
||||
schema-utils: "npm:^4.3.0"
|
||||
serialize-javascript: "npm:^6.0.2"
|
||||
terser: "npm:^5.31.1"
|
||||
peerDependencies:
|
||||
webpack: ^5.1.0
|
||||
peerDependenciesMeta:
|
||||
"@swc/core":
|
||||
optional: true
|
||||
esbuild:
|
||||
optional: true
|
||||
uglify-js:
|
||||
optional: true
|
||||
checksum: 10c0/39e37c5b3015c1a5354a3633f77235677bfa06eac2608ce26d258b1d1a74070a99910319a6f2f2c437eb61dc321f66434febe01d78e73fa96b4d4393b813f4cf
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"terser-webpack-plugin@npm:^5.3.17":
|
||||
version: 5.4.0
|
||||
resolution: "terser-webpack-plugin@npm:5.4.0"
|
||||
"terser-webpack-plugin@npm:^5.3.16, terser-webpack-plugin@npm:^5.3.17":
|
||||
version: 5.6.1
|
||||
resolution: "terser-webpack-plugin@npm:5.6.1"
|
||||
dependencies:
|
||||
"@jridgewell/trace-mapping": "npm:^0.3.25"
|
||||
jest-worker: "npm:^27.4.5"
|
||||
@@ -52935,13 +52895,31 @@ __metadata:
|
||||
peerDependencies:
|
||||
webpack: ^5.1.0
|
||||
peerDependenciesMeta:
|
||||
"@minify-html/node":
|
||||
optional: true
|
||||
"@swc/core":
|
||||
optional: true
|
||||
"@swc/css":
|
||||
optional: true
|
||||
"@swc/html":
|
||||
optional: true
|
||||
clean-css:
|
||||
optional: true
|
||||
cssnano:
|
||||
optional: true
|
||||
csso:
|
||||
optional: true
|
||||
esbuild:
|
||||
optional: true
|
||||
html-minifier-terser:
|
||||
optional: true
|
||||
lightningcss:
|
||||
optional: true
|
||||
postcss:
|
||||
optional: true
|
||||
uglify-js:
|
||||
optional: true
|
||||
checksum: 10c0/1feed4b9575af795dae6af0c8f0d76d6e1fb7b357b8628d90e834c23a651b918a58cdc48d0ae6c1f0581f74bc8169b33c3b8d049f2d2190bac4e310964e59fde
|
||||
checksum: 10c0/841674dab9b58ee242a64a548f2797f83eca3debc010afb2aa1a4be7149e7195a6a546a746324803ba05f72d0c9dc4357e34f17e4b6d6c054bd49a0913c413b9
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
|
||||
Reference in New Issue
Block a user