fix(security): drop vulnerable serialize-javascript via terser-webpack-plugin bump (#21871)

## fix(security): drop vulnerable serialize-javascript via
terser-webpack-plugin bump

Resolves [Dependabot Alert
#548](https://github.com/twentyhq/twenty/security/dependabot/548) and
[#1290](https://github.com/twentyhq/twenty/security/dependabot/1290).

### What

`serialize-javascript` `< 7.0.5` is affected by:
- **RCE via `RegExp.flags` / `Date.prototype.toISOString`**
([#548](https://github.com/twentyhq/twenty/security/dependabot/548),
High)
- **CPU-exhaustion DoS via crafted array-like objects**
([#1290](https://github.com/twentyhq/twenty/security/dependabot/1290),
Moderate)

### How — parent-bump, no resolution

The only consumer of the vulnerable `serialize-javascript@^6.0.2` in the
tree was `terser-webpack-plugin`, which **removed the
`serialize-javascript` dependency in 5.4.0**. This bumps
`terser-webpack-plugin` `5.3.16 -> 5.6.1` within its existing `^5.3.16`
range — an in-range parent-bump that drops `serialize-javascript` from
the tree **entirely** (preferred over a `resolutions` override).

### Verification

- `serialize-javascript` no longer resolves anywhere in the tree (both
the vulnerable `6.0.2` and the prior `7.0.5` copies are gone).
- `terser-webpack-plugin` is dev/build tooling (webpack minification),
not imported in our source.
- Lockfile-only change (net −22 lines); `yarn install --immutable`
passes.
This commit is contained in:
Abdullah.
2026-06-19 22:05:52 +05:00
committed by GitHub
parent fecf699bc5
commit bf2ff5899e
+23 -45
View File
@@ -47799,15 +47799,6 @@ __metadata:
languageName: node
linkType: hard
"randombytes@npm:^2.1.0":
version: 2.1.0
resolution: "randombytes@npm:2.1.0"
dependencies:
safe-buffer: "npm:^5.1.0"
checksum: 10c0/50395efda7a8c94f5dffab564f9ff89736064d32addf0cc7e8bf5e4166f09f8ded7a0849ca6c2d2a59478f7d90f78f20d8048bca3cdf8be09d8e8a10790388f3
languageName: node
linkType: hard
"range-parser@npm:^1.2.1, range-parser@npm:~1.2.1":
version: 1.2.1
resolution: "range-parser@npm:1.2.1"
@@ -50038,7 +50029,7 @@ __metadata:
languageName: node
linkType: hard
"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
version: 5.2.1
resolution: "safe-buffer@npm:5.2.1"
checksum: 10c0/6501914237c0a86e9675d4e51d89ca3c21ffd6a31642efeba25ad65720bce6921c9e7e974e5be91a786b25aa058b5303285d3c15dbabf983a919f5f630d349f3
@@ -50642,15 +50633,6 @@ __metadata:
languageName: node
linkType: hard
"serialize-javascript@npm:^6.0.2":
version: 6.0.2
resolution: "serialize-javascript@npm:6.0.2"
dependencies:
randombytes: "npm:^2.1.0"
checksum: 10c0/2dd09ef4b65a1289ba24a788b1423a035581bef60817bea1f01eda8e3bda623f86357665fe7ac1b50f6d4f583f97db9615b3f07b2a2e8cbcb75033965f771dd2
languageName: node
linkType: hard
"serve-index@npm:^1.9.1":
version: 1.9.2
resolution: "serve-index@npm:1.9.2"
@@ -52902,31 +52884,9 @@ __metadata:
languageName: node
linkType: hard
"terser-webpack-plugin@npm:^5.3.16":
version: 5.3.16
resolution: "terser-webpack-plugin@npm:5.3.16"
dependencies:
"@jridgewell/trace-mapping": "npm:^0.3.25"
jest-worker: "npm:^27.4.5"
schema-utils: "npm:^4.3.0"
serialize-javascript: "npm:^6.0.2"
terser: "npm:^5.31.1"
peerDependencies:
webpack: ^5.1.0
peerDependenciesMeta:
"@swc/core":
optional: true
esbuild:
optional: true
uglify-js:
optional: true
checksum: 10c0/39e37c5b3015c1a5354a3633f77235677bfa06eac2608ce26d258b1d1a74070a99910319a6f2f2c437eb61dc321f66434febe01d78e73fa96b4d4393b813f4cf
languageName: node
linkType: hard
"terser-webpack-plugin@npm:^5.3.17":
version: 5.4.0
resolution: "terser-webpack-plugin@npm:5.4.0"
"terser-webpack-plugin@npm:^5.3.16, terser-webpack-plugin@npm:^5.3.17":
version: 5.6.1
resolution: "terser-webpack-plugin@npm:5.6.1"
dependencies:
"@jridgewell/trace-mapping": "npm:^0.3.25"
jest-worker: "npm:^27.4.5"
@@ -52935,13 +52895,31 @@ __metadata:
peerDependencies:
webpack: ^5.1.0
peerDependenciesMeta:
"@minify-html/node":
optional: true
"@swc/core":
optional: true
"@swc/css":
optional: true
"@swc/html":
optional: true
clean-css:
optional: true
cssnano:
optional: true
csso:
optional: true
esbuild:
optional: true
html-minifier-terser:
optional: true
lightningcss:
optional: true
postcss:
optional: true
uglify-js:
optional: true
checksum: 10c0/1feed4b9575af795dae6af0c8f0d76d6e1fb7b357b8628d90e834c23a651b918a58cdc48d0ae6c1f0581f74bc8169b33c3b8d049f2d2190bac4e310964e59fde
checksum: 10c0/841674dab9b58ee242a64a548f2797f83eca3debc010afb2aa1a4be7149e7195a6a546a746324803ba05f72d0c9dc4357e34f17e4b6d6c054bd49a0913c413b9
languageName: node
linkType: hard