Skip to content

Upgrade Webpack dependencies to resolve security advisories#10350

Merged
aduth merged 4 commits intomainfrom
aduth-webpack-deps
Apr 3, 2024
Merged

Upgrade Webpack dependencies to resolve security advisories#10350
aduth merged 4 commits intomainfrom
aduth-webpack-deps

Conversation

@aduth
Copy link
Contributor

@aduth aduth commented Apr 2, 2024

🛠 Summary of changes

Upgrades Webpack-related dependencies to their latest versions.

Initially this was targeted at webpack-dev-server, which has some related open security advisories (GHSA-wr3j-pwj9-hqq6, GHSA-rv95-896h-c2vc, GHSA-cxjh-pqwp-8mfp), but I decided to upgrade a few others since webpack-dev-server at least required a version bump of webpack-cli to >5.0.

Related CHANGELOG:

These security updates don't block builds since we only check for dependencies installed in production environments, but it's prudent to resolve them, and minimizes noise in the GitHub UI and push messages..

📜 Testing Plan

  1. yarn install
  2. make run
  3. Visit http://localhost:3000
  4. Observe no errors in the browser or in the Terminal output

changelog: Internal, Dependencies, Upgrade dependencies to latest versions to resolve security advisories
'actual946.en.js',
'actual946.es.js',
'actual946.fr.js',
'actual278.en.js',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is it a valuable test to hardcode the specific files? would it make sense to have like a count + regex approach?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll check again in the morning if there's a strong reason to test them specifically. I think I wasn't expecting the suffix to change all that often since it's meant to be deterministic, but this isn't the first time I've had to update these as part of a version upgrade.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated this in 6452166 to be hopefully more resilient to these sorts of deterministic ID changes.

@aduth aduth merged commit 0b946b5 into main Apr 3, 2024
@aduth aduth deleted the aduth-webpack-deps branch April 3, 2024 12:51
@aduth aduth mentioned this pull request Apr 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants