🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.
All Depfu comment commands
@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ webpack (5.75.0 → 5.76.1) · Repo
Security Advisories 🚨
🚨 Cross-realm object access in Webpack 5
Release Notes
5.76.1
5.76.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 41 commits:
Merge pull request #16804 from webpack/chore-patch-release
chore(release): 5.76.1
Merge pull request #16803 from ryanwilsonperkin/revert-16759-real-content-hash-regex-perf
Revert "Improve performance of hashRegExp lookup"
Merge pull request #16766 from piranna/patch-1
Merge pull request #16789 from dmichon-msft/contenthash-hashsalt
Merge pull request #16792 from webpack/update-version
chore(release): 5.76.0
Merge pull request #16781 from askoufis/loader-context-target-type
Merge pull request #16759 from ryanwilsonperkin/real-content-hash-regex-perf
Respect output.hashSalt in RealContentHashPlugin
Merge pull request #16493 from piwysocki/patch-1
feat: Add `target` to `LoaderContext` type
Merge pull request #16703 from ryanwilsonperkin/ryanwilsonperkin/fix-16160
Merge branch 'webpack:main' into patch-1
Merge pull request #16446 from akhilgkrishnan/patch-1
Merge pull request #16613 from jakebailey/ts-logo
Merge pull request #16614 from jakebailey/html5-logo
Added `assert/strict` built-in
Improve performance of hashRegExp lookup
Add test for behaviour of filesystem-cached assets with loaders
lint: remove trailing comma
Serialize code generator data to support generated assets
Merge pull request #16491 from lvivski/main
Fix formatting
Fix formatting
Fix HTML5 logo in README
Replace TypeScript logo in README
Merge branch 'webpack:main' into patch-1
Merge pull request #16500 from Jack-Works/avoid-cross-realm-object
fix: type error
chore: revert breaking change
update dts
fix: test fail
fix: remove extra change
fix: avoid cross-realm objects
ci: test workflow - bump actions/cache
Initialize hash conditionally
Yarn lint issue fix
Yarn lock updated
Merge branch 'webpack:main' into patch-1
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase
.All Depfu comment commands