Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: replace ansi-html with ansi-html-community #3813

Closed
wants to merge 1 commit into from

Conversation

fabienmoyon
Copy link

This fixes the ReDoS vulnerability CVE-2021-23424

  • This is a bugfix
  • This is a feature
  • This is a code refactor
  • This is a test update
  • This is a docs update
  • This is a metadata update

For Bugs and Features; did you add new tests?

I only replaced a dependency which has tests on its own.

Motivation / Use-Case

Fixes #3576
Replaces #3798

Breaking Changes

None

Additional Info

@linux-foundation-easycla
Copy link

CLA Not Signed

@alexander-akait
Copy link
Member

webpack-dev-server v3 has other security problems, it is only one of them...

@fabienmoyon
Copy link
Author

@alexander-akait yes, maybe I'm trying to fix this issue because it's a blocking one for a project.

What do you more expect for me ?

@alexander-akait
Copy link
Member

glob-parent has security problems too, why do not update webpack-dev-server v4?

@racedale
Copy link

@alexander-akait sounds like scope creep. This PR has a very specific scope, can you articulate why it needs to be widened to include other packages?

@alexander-akait
Copy link
Member

@racedale because there are other security problem in webpack-dev-server v3

@racedale
Copy link

@alexander-akait yes and this fixes one of them

@alexander-akait
Copy link
Member

Why do not update to v4?

@G-Rath
Copy link

G-Rath commented Oct 26, 2021

I've outlined the "why" in my comment here.

Effectively while moving to v4 would be the best thing to do, it's currently not possible for ecosystems where we're locked into v3 by major frameworks (e.g. Rails, via @rails/webpacker) and who themselves are currently exploring alternatives to their tooling that make it very unlikely to let us move to v4 within the next few years.

@alexander-akait
Copy link
Member

@fabienmoyon Can you accept CLA?

@fabienmoyon
Copy link
Author

@alexander-akait yes, need to be validated by my organization manager.

@deejayy
Copy link

deejayy commented Oct 27, 2021

@alexander-akait as I see webpack-dev-server v4 first stable was out 2 months ago. Are you saying that v3 is no longer supported?

@alexander-akait
Copy link
Member

I can accept only security fixes, need accept CLA here

@G-Rath
Copy link

G-Rath commented Nov 1, 2021

@alexander-akait @fabienmoyon if getting the SLA signed is an issue, I'm happy to open a PR & sign the SLA instead :)

@snitin315
Copy link
Member

@alexander-akait @fabienmoyon if getting the SLA signed is an issue, I'm happy to open a PR & sign the SLA instead :)

Feel free to do it.

@G-Rath
Copy link

G-Rath commented Nov 7, 2021

@snitin315 have opened #4011

@fabienmoyon
Copy link
Author

Hello,
I asked some help to the linux foundation, my organization can't see the active CLA to be able to accept it since one week.
I keep you in touch

@alexander-akait
Copy link
Member

Done #4011

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants