chore: Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gad…

…get that leads to XSS
alibaba · Sep 11, 2024 · 801dbdd · 801dbdd
1 parent f08e49f
commit 801dbdd
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/websites/mini-program/package.json b/websites/mini-program/package.json
@@ -64,7 +64,7 @@
     "@tarojs/cli": "3.6.8",
     "@types/webpack-env": "^1.13.6",
     "@types/react": "^18.0.0",
-    "webpack": "5.78.0",
+    "webpack": "5.94.0",
     "@tarojs/taro-loader": "3.6.8",
     "@tarojs/webpack5-runner": "3.6.8",
     "babel-preset-taro": "3.6.8",

diff --git a/websites/mini-program/project.config.json b/websites/mini-program/project.config.json
@@ -15,7 +15,8 @@
       "disablePlugins": [],
       "outputPath": ""
     },
-    "condition": false
+    "condition": false,
+    "ignoreUploadUnusedFiles": true
   },
   "compileType": "miniprogram",
   "libVersion": "2.32.3",