search

pmmmwh / react-refresh-webpack-plugin

A Webpack plugin to enable "Fast Refresh" (also previously known as Hot Reloading) for React components.
MIT License
3.13k stars 192 forks source link

Updates loader-utils to 3.2.1 due to Security Vulnerability #834

Closed boroth closed 3 months ago

boroth commented 5 months ago

Been resolving some Dependabot alerts in another repo, and ran into an issue with react-refresh-webpack-plugin needing to be updated to the newer version of loader-utils. This just updates the loader-utils package, but I'm also open to doing some additional yarn updating/auditing if people are interested in that.

Tests seem to be passing, just need to run a build and see if it's all good to go 👍🏾

codesandbox[bot] commented 5 months ago

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders
Open Preview

boroth commented 5 months ago

I guess this fix may only work on Webpack 5, not sure what the standard way of handling that is in this project.

I wouldn't be opposed to trying to get react-refresh-webpack-plugin to a 1.0.0 version with Node 16+ and Webpack 5+ if y'all are up for it.

pmmmwh commented 4 months ago

I guess this fix may only work on Webpack 5, not sure what the standard way of handling that is in this project.

I wouldn't be opposed to trying to get react-refresh-webpack-plugin to a 1.0.0 version with Node 16+ and Webpack 5+ if y'all are up for it.

I'll look a bit into if it's possible to have both supported and resolve the vulnerability. In any case I don't think we're really using the code path that is reported, but it's nonetheless good to be on a version where this doesn't warn.

pmmmwh commented 3 months ago

Will be fixed in v0.6.0.