wireless-security-camera icon indicating copy to clipboard operation
wireless-security-camera copied to clipboard

[Snyk] Security upgrade webpack-dev-server from 2.11.5 to 3.11.0

Open twilio-product-security opened this issue 3 years ago • 0 comments

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • angular/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: webpack-dev-server The new version differs by 250 commits.
  • 4ab1f21 chore(release): 3.11.0
  • 0e51fb1 fix: invalidate route (#2584)
  • f857c40 chore: deps and tests
  • 41d1d0c fix(deps): security vulnerability in yargs-parser (#2566)
  • 375ab23 ci: add node@14 (#2530)
  • 776e7d4 chore(deps): update dependency html-entities to ^1.3.1 (master) (#2513)
  • 984536c chore: update lint-staged config (#2524)
  • 89ffb86 feat: add invalidate endpoint (#2493)
  • 0e9bffb chore(deps): update all patch dependencies (#2508)
  • 99ccfd8 fix: update jquery (#2516)
  • 06583f2 fix: do not swallow errors from server (#2512)
  • 0d5c681 fix(server): don't crash on setupExitSignals(undefined) (#2507)
  • c436058 chore(deps): update all patch dependencies (master) (patch) (#2503)
  • 4808abd feat(progess): emit progress-update (#2498)
  • adeb92e feat: allow open option to accept an object (#2492)
  • c6bdfe4 feat(contentBasePublicPath): allow multiple paths (#2489)
  • f317358 chore(deps): update all patch dependencies (master) (patch) (#2481)
  • de763e9 chore(deps): update all minor dependencies (master) (minor) (#2473)
  • f7b6fa1 chore(deps): update package-lock.json (#2482)
  • 3bf43a7 chore(deps): update all patch dependencies (#2477)
  • 12d76be docs: fix typos across the project (#2452)
  • 9a6e4a1 chore(deps): update all patch dependencies (#2468)
  • d4739f8 chore(deps): update dependency husky to v4 (#2383)
  • 5f357f3 chore(deps): update all patch dependencies (#2450)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

twilio-product-security avatar Jun 15 '22 20:06 twilio-product-security