vulnerability with terser-webpack-plugin
Author: strommjCreated Apr 25, 2021Updated Jun 8, 2023
Vulnerability: https://npmjs.com/advisories/565
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ ssri │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=6.0.2 <7.0.0 || >=8.0.1 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ razzle [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ razzle > terser-webpack-plugin > cacache > ssri │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/565 │
└───────────────┴──────────────────────────────────────────────────────────────┘It looks like the terser-webpack-plugin package has fixed this as of v6.0.2 (released on Apr 7th, 2021), but it looks like Razzle is currently on 2.x.
This would be quite the version bump, so I'll let you guys mull over the consequences of this.
Source: jaredpalmer/razzle