Problem/Motivation

$ yarn outdated
Package                   Current Wanted  Latest   
webpack                   5.75.0  5.77.0  5.77.0

$ yarn audit
yarn audit v1.22.19
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Cross-realm object access in Webpack 5                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ webpack                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.76.0                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1091367                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
1 vulnerabilities found - Packages audited: 779
Severity: 1 High
Done in 0.82s.

This vulnerability does not affect Drupal core so it is OK to update this in public without a security release of Drupal itself.

Steps to reproduce

Proposed resolution

$ yarn add -D webpack
$ yarn build

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#4 3351961-3-9.4.x.patch5.48 KBlongwave
#4 3351961-3-9.5.x.patch1.43 KBlongwave
#4 3351961-3-10.0.x.patch1.34 KBlongwave
#4 3351961-3.patch1.34 KBlongwave

Issue fork drupal-3351961

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

longwave created an issue. See original summary.

longwave credited Spokje.

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented

Crediting Spokje for bringing this to my attention.

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Title: Update webpack, terser and terser-webpack-plugin » Update webpack
Issue summary: View changes
Status: Active » Needs review
StatusFileSize
new 3351961-3.patch1.34 KB
new 3351961-3-10.0.x.patch1.34 KB
new 3351961-3-9.5.x.patch1.43 KB
new 3351961-3-9.4.x.patch5.48 KB

Actually as we need to backport this, we should only update Webpack itself here.

The last submitted patch, 4: 3351961-3.patch, failed testing. View results

The last submitted patch, 4: 3351961-3-9.5.x.patch, failed testing. View results

The last submitted patch, 4: 3351961-3-9.5.x.patch, failed testing. View results

spokje’s picture

spokje
Primary language Dutch
commented
Status: Needs review » Reviewed & tested by the community 
diff --git a/core/package.json b/core/package.json
@@ -115,7 +115,7 @@
     "terser": "^5.14.2",
     "terser-webpack-plugin": "^5.3.3",
     "underscore": "1.13.x",
-    "webpack": "^5.51.1",
+    "webpack": "^5.77.0",
     "webpack-cli": "^4.4.0"
   },

Technically, I think we should be using "webpack": "^5.76.0",, but I'm ok with this one.

RTBC for me.

keshav.k made their first commit to this issue’s fork.

  • catch committed a14a4fbe on 10.1.x 
    Issue #3351961 by longwave, Spokje: Update webpack

  • catch committed 69d41ff7 on 10.0.x 
    Issue #3351961 by longwave, Spokje: Update webpack

  • catch committed 36626798 on 9.4.x 
    Issue #3351961 by longwave, Spokje: Update webpack

  • catch committed ba994a0f on 9.5.x 
    Issue #3351961 by longwave, Spokje: Update webpack
catch’s picture

catch
he/him
Primary language English
commented
Version: 10.1.x-dev » 9.4.x-dev
Status: Reviewed & tested by the community » Fixed

Committed/pushed to 10.1.x, 10.0.x, 9.5.x and 9.4.x, thanks!

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Issue tags: +10.1.0 release notes

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.