update serialize-javascript to 3.1.0+ to address security vulnerabili…

[zhao-li]

This PR updates serialize-javascript to 3.1.0+ to address security vulnerabilities of serialize-javascript < 3.1.0, a sub-dependency of copy-webpack-plugin.

What kind of change does this PR introduce? (check at least one)

• Bugfix
• Feature
• Code style update
• Refactor
• Docs
• Underlying tools (?dependency?)
• Other, please describe:

Does this PR introduce a breaking change? (check one)

• Yes
• No
• not sure, this project isn't containerized and I don't want to install yarn and other artifacts on my host

Other information:
I'm hoping your CI will figure out if this is a breaking change or not.

High            Remote Code Execution
Package         serialize-javascript
Patched in      >=3.1.0
Dependency of   @vue/cli-service [dev]
Path            @vue/cli-service > copy-webpack-plugin >
                serialize-javascript
More info       https://npmjs.com/advisories/1548

`-- @vue/cli-service@4.4.6
  +-- copy-webpack-plugin@5.1.1
  | `-- serialize-javascript@2.1.2 
  `-- terser-webpack-plugin@2.3.7
    `-- serialize-javascript@3.1.0 

[jonathanpmartins]

any updates on this?

[zhao-li]

I'm not quite sure what the next steps are...

[sirlancelot]

Fixes #5782. Can this get merged in to remove the high severity vulnerability warning when using vue-cli?

[HTGAzureX1212]

Still waiting for this dependency update to fix the vulnerability...

[ThBastos]

Still waiting for this dependency update to fix the vulnerability...

[jsb989]

It's taking too much time. I just updated by hand changing @vue/cli-service/package.json
copy-webpack-plugin: "^6.0.3" and running $npm i... twice.
(one for each dependency. NPM looks just like a joke, though...)

[HTGAzureX1212]

Does a dependency update take this much time... I am considering to use the same approach of jsb989 now :/

[sodatea]

It breaks almost all of the CI tests.

We need another way to address this issue. Not blindly updating the dependency version.

[yashha]

@sodatea Just an Idea:
webpack-contrib/copy-webpack-plugin#520