Using webpack-dev-middleware results with npm audit high vulnerability #38920
Labels
status: triage needed
Issue or pull request that need to be triaged and assigned to a reviewer
type: bug
An issue or pull request relating to a bug in Gatsby
Preliminary Checks
Description
Hi folks!
There is a
webpack-dev-middleware
usage in packages/gatsby/src/utils/start-server.ts which results with a high severity npm audit issue.Version
^4.3.0
has some reported vulnerabilities, which were fixed in patched versions hereWhat is the ETA of updating the mentioned package?
Reproduction Link
gatsby/packages/gatsby/package.json
Line 174 in 5723972
Steps to Reproduce
Run
![Screenshot 2024-04-04 at 12 02 46](https://private-user-images.githubusercontent.com/25795929/319536675-93bec305-e9cf-4913-83c8-3cf82507bd65.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjUwNTk3NzUsIm5iZiI6MTcyNTA1OTQ3NSwicGF0aCI6Ii8yNTc5NTkyOS8zMTk1MzY2NzUtOTNiZWMzMDUtZTljZi00OTEzLTgzYzgtM2NmODI1MDdiZDY1LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MzAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODMwVDIzMTExNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTViZjUxNGYyNTNmYWUyYzdjYWU3OGQwMjgwODMyMzQ2Mzk5MGYyMDI5YjYwMTJmMWQyY2JlMjc1Y2FkZWU4YjMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.hNmSsDCYHGYgCwJVY-T_lAmnwRVu7YrZCa1LigzODfY)
npm audit
on a fresh Gatsby project.Expected Result
No high severity vulnerabilities found.
webpack-dev-middleware
should be bumped to v. 5.3.4 at leastActual Result
A high severity vulnerability was found.
Environment
Config Flags
No response
The text was updated successfully, but these errors were encountered: