Closed (fixed)
Project:
Drupal core
Version:
10.3.x-dev
Component:
javascript
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
30 Sep 2024 at 13:57 UTC
Updated:
15 Oct 2024 at 14:39 UTC
Jump to comment: Most recent
Problem/Motivation
Webpack has released a security advisory: https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
It does not appear that Drupal core is affected; we only use Webpack to build CKEditor 5 and the output is no different on the old and new versions. However, we should upgrade anyway to avoid security scanners from complaining.
Steps to reproduce
Proposed resolution
Update Webpack to 5.94.0 or greater on all supported branches, down to 10.2.x if possible.
Remaining tasks
User interface changes
Introduced terminology
API changes
Data model changes
Release notes snippet
Webpack has been updated to version 5.95.0 to incorporate a security release which did not affect Drupal core. This update introduces a change to the supported browser list, which allows more modern CSS to be produced, notably the :dir pseudo class. Drupal core has required all browser versions to support :dir since December 2023, so this is applying what was already existing policy.
Issue fork drupal-3477805
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #3
longwaveComment #4
spokjeComment #10
spokje10.2.x MR !9701
10.3.x MR !9700
10.4.x MR !9699
11.0.x: MR !9698
11.x: MR !9697
The 11's-MRs were created using
node v20.17.0, the 10's MRs were created usingnode v18.20.4Comment #11
spokjeI've ran a
yarn buildin all MRs10.4.x and 10.3.x introduced a lot of CSS changes, not too sure where those came from.
10.2.x introduces jquery-ui map file changes on top of the above CSS changes. The same amount of confidence where those came from, namely none.
Either the webpack update introduces some CSS/JS linting changes, which I find unlikely, or the changes for these were already made before these MRs and somehow
yarn buildwas never ran.I'll leave that to the experts.
Comment #12
spokjeComment #13
longwaveDid some digging to find out what happened here.
As far as I can tell, the CSS changes are due to the bump in
caniuse-litewhich determines what thebrowserslistkey means in package.json. The bulk of the changes are swapping from prefixing with the[dir=rtl]attribute at the top of the DOM to using the:dir()pseudo-class. The pseudo-class is available since December 2023 according to caniuse so it makes sense that upgradingcaniuse-literesults in the use of newer features when rebuilding the CSS.In 10.2.x the change is adding
"ignoreList":[]to the generated source maps for jQuery UI. This also appears to be a relatively recent feature, I couldn't find where it was added exactly but the map files are generated by Terser which was also upgraded here, so it makes some sense for this to change. This change looks harmless anyway as the ignoreList is always empty.Therefore I think all these changes are valid and OK to commit.
Comment #14
quietone commentedComment #15
spokjeThanks @longwave for the sleuthing, sense = made.
Thanks @quietone, added release note snippet
Comment #16
spokjeComment #20
catchI double checked the caniuse data because I was concerned Firefox ESR when 10.3.0 might possibly have not supported this, but actually firefox was one of the first to support it and it's chrome and edge that didn't add full support until December 2023. This to me means we're clear back to 10.3.x
For 10.2.x, at the time that 10.2.x was released, we probably did support browser versions that didn't support the dir pseudoclass, so going to get a second opinion for that.
Comment #25
catchCommitted/pushed to 11.x, 11.0.x, 10.4.x and 10.3.x, leaving RTBC against 10.2.x
Comment #26
catchAdded a more detailed release not directly in the 10.3.6 release notes draft and also the issue summary https://docs.google.com/document/d/1xqpX5FHvfpFjN3Xg47ESFSFu5WUjCEP4sjiO...
Comment #28
longwaveGiven that Drupal is not affected by this security release and there is a risk of breaking CSS if users are still relying on the browsers initially supported by 10.2, I think this is not worth fixing there now. Users who are bothered by security scanners complaining about an insecure Webpack should upgrade to Drupal 10.3.