chore(deps): bump terser-webpack-plugin to drop serialize-javascript#60236
Conversation
serialize-javascript 6.x carries a HIGH RCE (GHSA-5c6j-r48x-rmvq) and a moderate CPU-exhaustion DoS (GHSA-qj8w-gfj5-8c6v). It reached the tree only as a dependency of terser-webpack-plugin (via @storybook/builder-webpack5 -> webpack). terser-webpack-plugin removed serialize-javascript entirely in 5.3.17, and webpack's range (^5.3.7) already permits the current 5.6.0, so refreshing the lockfile to terser-webpack-plugin 5.6.0 drops serialize-javascript from the tree with no override and no manifest change. The rest of the lockfile churn is peer-hash re-keys (jest, storybook, webpack, etc. are unchanged in version) caused by terser-webpack-plugin's new version appearing in their dependency graphs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
robbie-c
force-pushed
the
claude/bump-serialize-javascript
branch
from
2a92a7d to
8cf7c95
Compare
|
🎭 Playwright didn't run on this PR — your changes touch code that could affect E2E behavior, but Playwright is opt-in via label now to keep CI cost down. Add the Most PRs don't need this. Real regressions still get caught on master and fix-forward. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub. |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
Size Change: 0 B Total Size: 80.2 MB ℹ️ View Unchanged
|
gantoine
left a comment
gantoine
left a comment
There was a problem hiding this comment.
looks like its transitive, approved
…60236) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2 participants
Problem
Standard caveat about how
npm auditis broken, see https://overreacted.io/npm-audit-broken-by-design/Let's bump
terser-webpack-pluginso it no longer transitively includes a version ofserialize-javascriptthat audit complains aboutClaude code continues:
serialize-javascript@6.xcarries a HIGH-severity RCE (GHSA-5c6j-r48x-rmvq, viaRegExp.flags/Date.prototype.toISOString, CVSS 8.1) and a moderate CPU-exhaustion DoS (GHSA-qj8w-gfj5-8c6v), both fixed in 7.0.3 / 7.0.5. It's flagged by security review on the dependency audit work but was deliberately left out of the main audit PR (#60023) because the only way to bump it there would have been apnpm.overridesentry, which that PR avoids.It is a transitive, build-time-only dependency, reaching the tree via a single path:
@storybook/builder-webpack5→webpack→terser-webpack-plugin@5.3.9→serialize-javascript.Changes
Rather than override the version, this bumps the parent:
terser-webpack-pluginremoved itsserialize-javascriptdependency entirely in 5.3.17 (it's absent in 5.3.17 through the current 5.6.0).webpack's declared range (terser-webpack-plugin@^5.3.7) already permits 5.6.0, so this is a lockfile refresh toterser-webpack-plugin@5.6.0— no override, no manifest change. The result:serialize-javascriptdrops out of the tree completely (0 entries), so the advisory is resolved at the source rather than papered over.The remaining lockfile churn is peer-hash re-keys (
jest,storybook,webpack,@segment/*,@temporalio/*are all unchanged in resolved version, verified) that pnpm rewrites becauseterser-webpack-plugin's version appears in their dependency graphs.How did you test this code?
I am an agent (Claude Code), automated checks only:
pnpm audit:serialize-javascriptis gone from the tree (0 entries), advisory cleared.pnpm install --frozen-lockfile: passes (lockfile consistent with the unchanged manifests).@segment/action-destinations,@temporalio/worker,jest,@storybook/builder-webpack5,webpackall resolve to the same versions asmaster.terser-webpack-plugin5.3.9 → 5.6.0 is a minor bump within webpack's existing range and a widely-used stable release; the Storybook / visual-regression CI checks are the real validation.Publish to changelog?
no
Docs update
No docs changes needed.
🤖 Agent context
Authored by Claude Code (Claude Opus 4.7), agent-driven. Requires human review; do not self-merge.
Split out from the main audit PR (#60023) at the maintainer's request. The first attempt used a
pnpm.overridesentry forcingserialize-javascript@^7.0.5; the maintainer asked to instead update the dependency that pulls it in. Investigation showedterser-webpack-plugindroppedserialize-javascriptin 5.3.17, so a parent bump removes it cleanly. An initialpnpm update terser-webpack-plugin --depth Infinitycaused broad incidental churn (storybook/vitest/jest version moves), so this uses a temporary override to force onlyterser-webpack-plugin@5.6.0, then removes the override (the in-range version persists in the lockfile) to keep the diff tight.