bengrunfeld / expack

Express and Webpack boilerplate application
MIT License
284 stars 76 forks source link

Replacing uglify-webpack-plugin because of security vulnerability #17

Open micheldrescher opened 4 years ago

micheldrescher commented 4 years ago

This is my first pull request, so please be patient :-) Specifically I don't know how to exclude files from pull requests as my fork is deviating in some things from upstream.

This pull request replaces uglify-webpack-plugin with terser-webpack-plugin.

Reason: The former plugin is discontinued, but depends on a vulnerable version of serialize-javascript. It does not receive any further updates, so a replacement is necessary.

The only necessary changes are in webpack.prod.config.js and accordingly to package.json

The code change in webpack.prod.config.js should be sufficient, but cleanup in package.json and package-log.json is necessary, but a simple exercise for Node.js developers.