Update terser-webpack-plugin version

[portexe]

Older versions of terser-webpack-plugin are using a highly vulnerable version of serialize-javascript. In order to fix this, we need to update the terser-webpack-plugin which has now addressed this vulnerability.

More info on the vulnerability located here

Screenshot:

[facebook-github-bot]

Hi @portexe!

Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file.

In order for us to review and merge your code, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

If you have received this in error or have any questions, please contact us at [email protected]. Thanks!

[portexe]

I just agreed to the CLA so that will check will need to be re-started.

[facebook-github-bot]

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Facebook open source project. Thanks!

[facebook-github-bot]

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Facebook open source project. Thanks!

[ajdaniel]

It will be nice to have this and release it

[gtlambert]

Hoping to have this one merged!

[gaearon]

As explained in #9469 (comment), there is no actual vulnerability here.

[gaearon]

We can't do a major version bump here. You need to work with terser-webpack-plugin to get them to release 3.x patch with this change. Then we can bump to that.

[portexe]

@gaearon it appears version 3.1.0 of terser-webpack-plugin contains the update that we want. I just updated the PR.

[gaearon]

Hmm. Actually this doesn't make sense either.

3.0.7 which we use on master already has the fix.

https://unpkg.com/browse/[email protected]/package.json
https://www.npmjs.com/advisories/1548

So what we need to do is update the version used by react-scripts@3 today.

[gaearon]

(I'll do this)