search

turkdevops / pusher-js

Pusher Javascript library
http://pusher.com
MIT License
0 stars 0 forks source link

[Snyk] Upgrade webpack from 5.1.1 to 5.9.0 #25

Closed snyk-bot closed 3 years ago

snyk-bot commented 3 years ago

Snyk has created this PR to upgrade webpack from 5.1.1 to 5.9.0.

merge advice :sparkles: Snyk has automatically assigned this pull request, set who gets assigned.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Prototype Pollution
SNYK-JS-Y18N-1021887		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Prototype Pollution
SNYK-JS-NODEFORGE-598677		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Prototype Pollution
SNYK-JS-LODASH-590103		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Prototype Pollution
SNYK-JS-AJV-584908		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Server-Side Request Forgery (SSRF)
SNYK-JS-AXIOS-1038255		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Validation Bypass
SNYK-JS-KINDOF-537849		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: webpack
  • 5.9.0 - 2020-11-28

    Features

    • improve side effects analysis to report imported and reexported symbols as side-effect-free

    Bugfixes

    • fix problem when HMR and different runtimes (e. g. with Workers)
      • caused crash with ... has no hash info for runtime ...
  • 5.8.0 - 2020-11-26

    Features

    • add the ability to process assets generated in later stages during processAssets
    • new processAssets stage: PROCESS_ASSETS_STAGE_OPTIMIZE_INLINE
    • add hooks to the RealContentHashPlugin to allow to process custom hashes (e. g. SRI)

    Bugfixes

    • fix typing for child compiler plugins
    • SourceMapPlugin will process assets added in later stages during asset processing
  • 5.7.0 - 2020-11-26

    Features

    • CLI supports installing webpack-cli via pnpm

    Bugfixes

    • fix problem with ASI detection, causing semicolons inserted after if(...) etc.
  • 5.6.0 - 2020-11-19

    Bugfixes

    • emit warnings/errors for exports in commonjs modules for which we know that they don't exist
  • 5.5.1 - 2020-11-18

    Bugfixes

    • fix crash when __esModule is defined with defineProperty without value
  • 5.5.0 - 2020-11-17

    Bugfixes

    • fix ASI issues that occur between concatenated modules
    • fix incorrect handling of [id] and etc. in SourceMap sources
    • fix side-effect-free handling of exports for concatenated modules that causes an unused export
    • make ESM-CJS interop handling consistent
      • make __esModule flag consistent exposed
      • handle non enumerable exports
      • handle inherited exports
      • handle exported Promises
  • 5.4.0 - 2020-11-03

    Bugfixes

    • fix renaming in super class expression in nested scopes
    • fix parsing and handling of browserlist queries
    • fix a few edge cases with ESM-CJS interop and .mjs
    • fix ASI edge cases
  • 5.3.2 - 2020-10-29

    Bugfixes

    • runtime-dependent concatenated modules can generate code for runtime-dependent execution order of concatenated modules
  • 5.3.1 - 2020-10-28

    Bugfixes

    • fix incorrect concatenation of modules when multiple runtimes are involved
      • fixes a "This should not happen" error
      • fixes a __webpack_require__(null) problem
    • run CLI correctly after installing
    • fixes a huge performance issue when processing minimized code with SourceMap
    • Use string[] types instead of [string, ...string[]] for arrays that must not be empty
      • this is more convinient to use

    Performance

    • avoid incorrect store of counts in the ProgressPlugin, which causes unneeded serialization of the Persistent Cache
    • upgrade terser-webpack-plugin for performance improvements
    • upgrade webpack-sources for performance improvements
  • 5.3.0 - 2020-10-27

    Features and Bugfixes

    • generate runtime conditional code when modules are forcefully merged from multiple runtimes
      • This fixes a Cannot read property 'call' of undefined error in webpack runtime, because modules are used that are not in the graph in one runtime
    • disabled source code analysis for side effects in non-production modes
      • this causes unnecessary changes to parent modules in development
      • add optimization.sideEffects: "flag" as option for this
  • 5.2.1 - 2020-10-27
  • 5.2.0 - 2020-10-22
  • 5.1.3 - 2020-10-16
  • 5.1.2 - 2020-10-15
  • 5.1.1 - 2020-10-15
from webpack GitHub release notes
Commit messages
Package name: webpack
  • 0e7437d 5.9.0
  • 714ed0a Merge pull request #12073 from webpack/dependabot/npm_and_yarn/prettier-2.2.1
  • 99d7a20 prettier
  • 4600e03 chore(deps-dev): bump prettier from 2.2.0 to 2.2.1
  • 6278ac6 Merge pull request #12070 from webpack/dependabot/npm_and_yarn/simple-git-2.24.0
  • e2b600d Merge pull request #12067 from webpack/dependabot/npm_and_yarn/babel-loader-8.2.2
  • c16e968 Merge pull request #12075 from webpack/bugfix/hmr-multiple-runtimes
  • 81b3b7e Merge pull request #12076 from webpack/feature/side-effects-analysis
  • 4c3e18f skip worker tests when worker_threads is not supported
  • a0d72e6 fix test case
  • cf97d04 fix test cases
  • c7ea638 improve side effects analysis to report imported and reexports symbols as side-effect-free
  • c9fbdb9 avoid a breaking change and use a warning instead
  • d46f945 fix problem when HMR and different runtimes
  • 9ac2fae chore(deps-dev): bump simple-git from 2.23.0 to 2.24.0
  • b66ecfa chore(deps-dev): bump babel-loader from 8.2.1 to 8.2.2
  • fb7d09b 5.8.0
  • 2aacd90 Merge pull request #11956 from webpack/feature/asset-processing
  • ca29e7c add missing name argument in test case for validation
  • ed742e0 add test case like html-plugin
  • ccfe01a allow to process assets that are added during processAssets
  • eb5481a Merge pull request #11948 from jantimon/fix/plugin-types
  • fd056e2 Merge pull request #12060 from webpack/deps/update
  • 005316c Merge pull request #12062 from webpack/example/reexport
Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

👩‍💻 Set who automatically gets assigned

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs