Security advisory for serialize-javascript package

[samelliottdlt]

Hey folks 👋🏽

A security advisory was raised by npm for this serialize-javascript package. More info here: https://www.npmjs.com/advisories/1548

Looks like this package is brought in to our dependency trees by way of terser-webpack-plugin. A fix could be to update and publish to the latest version of terser-webpack-plugin which doesn't depend on a vulnerable version of serialize-javascript.

[webmaster128]

terser-webpack-plugin version ^4, ^3 and ^2 use a sufficiently high version range of serialize-javascript (^4.0.0 and ^3.1.0). So webpack 5 is not affected.

For webpack 4 there is a semver-matching terser-webpack-plugin version 1.4.4 that bumps serialize-javascript from "^2.1.2" to "^3.1.0".

[alexander-akait]

Please update deps to latest, fixed, all versions of terser-webpacj-plugin using serialize-javascript@4

[trivikr]

Is the dependency on vulnerable version of serialize-javascript going to be removed in webpack@4?

Latest version of webpack@4, i.e. v4.44.1 depends on serialize-javascript@2.1.3

webpack/yarn.lock

Lines 5789 to 5792 in cd4af16

	serialize-javascript@^2.1.2:
	version "2.1.2"
	resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-2.1.2.tgz#ecec53b0e0317bdc95ef76ab7074b7384785fa61"
	integrity sha512-rs9OggEUF0V4jUSecXazOYsLfu7OGK2qIn3c7IPBiffz32XniEp/TX9Xmc9LQfK2nQ2QKHvZ2oygKUGU0lG4jQ==

To fix, it needs to be updated to >3.1.0

[trivikr]

webpack@4 just need to update it's terser-webpack-plugin dependency to v1.4.5 which updates serialize-javascript package version to 4.0.0

• Code: https://github.com/webpack-contrib/terser-webpack-plugin/blob/v1.4.5/package-lock.json#L10713-L10720
• PR: fix: security problem webpack-contrib/terser-webpack-plugin#259

Question: Is this fix going to be released in webpack@4.44.2 or webpack@4.45.0?

[alexander-akait]

@trivikr update your deps, you need regenerate lock file, it is transitive dep

[trivikr]

For those who're visiting this issue from Dependabot security alerts, here is an example PR where dependency is updated aws-samples/aws-sdk-js-tests#47
I just deleted yarn.lock entry for terser-webpack-plugin@^1.4.3 and re-run yarn command. You can do the same for package-lock.json file if you're using npm.

Dependabot cannot automatically create a pull request to fix this as "one or more other dependencies require a version that is incompatible with this update."
As of now, the webpack team is not planning to release a patch version webpack@4 with explicit dependency on terser-webpack-plugin@v1.4.5