Backport of GHSA-5c6j-r48x-rmvq to version 6

[bjohansebas]

Hi, webpack needs a backport of GHSA-5c6j-r48x-rmvq in order to update and avoid being vulnerable to this issue.

We’re unable to upgrade to version 7 due to our Node.js support (node >=10), which limits us from updating. So would it be possible to please backport this fix?

[okuryu]

This is a classic example of "Ecosystem drift". I honestly question the necessity of supporting EOL versions of Node.js. For instance, Node.js 10 contains 17+ known vulnerabilities.

• https://nodejs.org/en/about/eol

Furthermore, given that webpack is primarily a build tool used in development environments, I doubt how much of an actual impact these vulnerabilities have on most users. Maintaining compatibility for such a limited and risky use case seems like an undue burden on open-source maintenance.

We should prioritize the health and security of the modern ecosystem over legacy support that offers little practical benefit.

Related:

• Stop supporting EoL versions of Node.js webpack/security-wg#21
• serialise-javascript outdated! webpack/minimizer-webpack-plugin#644

[abrom]

Thanks @okuryu 👍

I believe at the root of what you're getting at is that given the v6 => v7 bump was simply to EoL support for older node versions, and not a functional API change, so long as you're running v20+ (which you should be if you're concerned about vulnerabilities) then a simple override will resolve the issue raised.

ie

  "overrides": {
    "serialize-javascript": "^7.0.3"
  }

That then gives the webpack team time to responsibly EoL older node versions

[testPerfDave]

I don't think overrides are a valid solution for this.
Probably a large percentage of people who add something there will forget about it, next time serialize-javascript releases an actually breaking change to the API for example in version 8 or 9 etc, couldn't it cause breakage when the dependent package upgrades but the user still has it pinned?

[vskosp]

A v6.0.3 release with fix #209 would clear npm audit warnings for projects with serialize-javascript v6 in their dependency tree and remove the need for the "overrides": { "serialize-javascript": "^7.0.3" } workaround - good security practice for a widely-used package.

If it helps, here's what would be needed to land #209:

1. Create the maintenance branch

   git branch 6.0.x v6.0.2
   git push origin 6.0.x

2. Retarget the PR to 6.0.x.
3. Merge, bump version in package.json to 6.0.3
4. Tag and publish

[long76]

up vote

[long76]

please merge mr #209

[long76]

@okuryu i agree but some packages seems unmaintained(For example). We would up versions in our projects but it's not our

[varghese1508]

We're facing the same issue, where one of our projects was build on node 18, but serialize-javascript 7.x only supports node 20=< versions. Are we expecting this to get release to 6.x? This would be really helpful to the users as this is a high vulnerability.