Repository navigation
[Security] Issue with serialize-javascript #8100
Description
Right now, react-scripts relies on terser-webpack-plugin, which in turn relies on serialize-javascript. It will need a bump once released. This is causing GitHub to display security alerts on a lot of react repos. I am working to collaborate a fix downstream at terser-webpack-plugin, just opening this issue for meta.
NOTE: This WILL MOST LIKELY NOT HARM YOUR APP. The library is only used at build time.
Reacted by dillontsmith, akilman, Pete Nykänen, Shankar, Joshua, Moch Agung Hermawan, Reece Dunham and Michael Antczak
Activity
AWIXOR-zz commentedon Dec 14, 2019
You can try adding
serialize-javascriptin the resolutions insidepackage.jsonso you can force it to use the last update. then runyarn upgrade. This worked for me.