Repository navigation
Update copy-webpack-plugin npm package to avoid critical security flaw in dependency #5
Description
The copy-webpack-plugin package requires in the currently mandated version serialize-javascript 7.0.4 which has a critical vulnerability.
With newer versions of the webpack plugin a fixed version of serialize-javascriped is installed.
The update 14 of the webpack plugin is apparently a breaking change, so this might require some work.
# npm audit report
serialize-javascript <=7.0.4
Severity: high
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - https://github.com/advisories/GHSA-5c6j-r48x-rmvq
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - https://github.com/advisories/GHSA-qj8w-gfj5-8c6v
fix available via `npm audit fix --force`
Will install copy-webpack-plugin@14.0.0, which is a breaking change
node_modules/serialize-javascript
copy-webpack-plugin 6.1.1 - 13.0.1
Depends on vulnerable versions of serialize-javascript
node_modules/copy-webpack-plugin
Activity