search

imodeljs / create-react-app

Set up a modern web app by running one command.
https://create-react-app.dev
MIT License
2 stars 7 forks source link

webpack-dev-server version needs bump #74

Closed blackandwhitezephyr closed 2 years ago

blackandwhitezephyr commented 2 years ago

webpack-dev-server 3.x depends on selfsigned 1.x, which depends on node-forge^0.10.0, which has security vulnerabilities. See the fix for selfsigned: https://github.com/jfromaniello/selfsigned/issues/55 Need top bump the webpack-dev-server version to get the fixed version of selfsigned.

aruniverse commented 2 years ago

Please take a look at this discussion thread regarding security vulnerabilities on our fork here: https://github.com/iTwin/itwinjs-core/discussions/3397

https://twitter.com/dan_abramov/status/1412376404738686984

blackandwhitezephyr commented 2 years ago

Thank you @aruniverse. Closing this.