-
-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: replace ansi-html with ansi-html-community #3813
Conversation
This fixes the ReDoS vulnerability CVE-2021-23424
|
webpack-dev-server v3 has other security problems, it is only one of them... |
@alexander-akait yes, maybe I'm trying to fix this issue because it's a blocking one for a project. What do you more expect for me ? |
|
@alexander-akait sounds like scope creep. This PR has a very specific scope, can you articulate why it needs to be widened to include other packages? |
@racedale because there are other security problem in webpack-dev-server v3 |
@alexander-akait yes and this fixes one of them |
Why do not update to v4? |
I've outlined the "why" in my comment here. Effectively while moving to v4 would be the best thing to do, it's currently not possible for ecosystems where we're locked into v3 by major frameworks (e.g. Rails, via |
@fabienmoyon Can you accept CLA? |
@alexander-akait yes, need to be validated by my organization manager. |
@alexander-akait as I see webpack-dev-server v4 first stable was out 2 months ago. Are you saying that v3 is no longer supported? |
I can accept only security fixes, need accept CLA here |
@alexander-akait @fabienmoyon if getting the SLA signed is an issue, I'm happy to open a PR & sign the SLA instead :) |
Feel free to do it. |
@snitin315 have opened #4011 |
Hello, |
Done #4011 |
This fixes the ReDoS vulnerability CVE-2021-23424
For Bugs and Features; did you add new tests?
I only replaced a dependency which has tests on its own.
Motivation / Use-Case
Fixes #3576
Replaces #3798
Breaking Changes
None
Additional Info