fix!: Rollup build XSS vulnerability (CVE-2024-43788) #759
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for vite-plugin-pwa-legacy ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
commit: |
|
when will it work this update? |
|
Check #758 (comment) (I need to do some final test) |
fabianszabo
reviewed
Oct 2, 2024
|
This workbox PR merged but not yet released: GoogleChrome/workbox#3359 I guess we don't need this PR, we can just update Rollup version. |
Tested this new PR with Vite 3.2.1 and it is working: #781 |
|
superseded by #781 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR removes Rollup from dependencies, using the exported types from Vite.
This is breaking since we need Vite
4.2.0+to re-use exported Rollup types included in this PR vitejs/vite#12316 (included in Vite4.2.0-beta.2 (2023-03-13)).This PR doesn't solve CVE-2024-43788 since
workbox-buildand Vite have the same problem as pointed in the linked issue, the consumer should useoverrides,resolutionsorpnpm.overridesto override Rollup version.Once Vite and
workbox-buildfix the vulnerability the PWA plugin should be ready.superseded by #781
Linked Issues
closes #758
Additional Context
This PR may or may not work when overriding Rollup 4.22.4:
workbox-buildTip
The author of this PR can publish a preview release by commenting
/publishbelow.