[Snyk] Fix for 1 vulnerabilities

[adamlaska]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/app/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	698/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.1	Cross-site Scripting (XSS) SNYK-JS-SERIALIZEJAVASCRIPT-6147607	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: copy-webpack-plugin

The new version differs by 29 commits.

• 797a006 chore(release): update `serialize-javascript`
• f233c55 chore(deps): serialize-javascript and deps updated ([Snyk] Fix for 1 vulnerabilities #613)
• 966d723 chore(deps): update ([Snyk] Security upgrade webpack from 4.31.0 to 5.1.1 #610)
• 2abdddf chore: fix typo ([Snyk] Security upgrade @storybook/react from 5.3.21 to 6.5.0 #609)
• d041d85 chore(release): 9.0.0
• beff64e refactor: nodejs v10 dropped ([Snyk] Security upgrade jest from 24.9.0 to 27.0.0 #606)
• 3a1139e docs: fix unintended cyrillics in README.md ([Snyk] Security upgrade jest from 24.9.0 to 27.0.0 #604)
• 8857968 chore(release): 8.1.1
• d8fa32a fix: `stage` for processing assets ([Snyk] Security upgrade chromatic from 4.0.3 to 6.0.0 #600) ([Snyk] Security upgrade webpack-cli from 2.1.5 to 3.0.0 #601)
• a571f07 chore(release): 8.1.0
• 82b10e3 chore(deps): update ([Snyk] Fix for 1 vulnerabilities #598)
• a8ace71 docs: update ([Snyk] Security upgrade axios from 0.19.2 to 1.6.4 #597)
• dde71f0 feat: added the `transformAll` option ([Snyk] Security upgrade axios from 0.19.2 to 1.6.4 #596)
• 4ca7f80 docs: fix broken link to #globoptions ([Snyk] Security upgrade axios from 0.19.2 to 1.6.4 #595)
• 01fa91b docs: fix typo
• 1787d2d chore(release): 8.0.0
• 83601dc refactor: code ([Snyk] Security upgrade lint-staged from 8.1.0 to 9.0.0 #593)
• 9e12a33 refactor: code ([Snyk] Security upgrade semantic-release from 6.3.6 to 10.0.0 #592)
• d68a8eb chore(deps): update ([Snyk] Security upgrade chromatic from 4.0.3 to 5.6.1 #591)
• ea610bc feat: added `priority` option ([Snyk] Security upgrade axios from 0.19.2 to 0.21.1 #590)
• a9b06a6 docs(readme): add example to skip minimizing source files ([Snyk] Security upgrade axios from 0.19.2 to 0.21.1 #588)
• f2c1bc8 refactor: template strings in `to` option ([Snyk] Security upgrade gatsby from 2.13.72 to 2.31.0 #589)
• 8d5ab9a chore: updated deps ([Snyk] Security upgrade chromatic from 4.0.2 to 5.6.1 #587)
• f5e661b test: issue 496 ([Snyk] Security upgrade chromatic from 4.0.3 to 5.6.1 #586)

See the full diff

Package name: terser-webpack-plugin

The new version differs by 184 commits.

• 491b2fd chore(release): 5.1.4
• bc7580b chore(deps): serialize-javascript and deps updated ([Snyk] Fix for 1 vulnerabilities #408)
• ec65531 ci: update nodejs.yml ([Snyk] Security upgrade vscode from 1.1.30 to 1.1.31 #407)
• f8ce3bc chore: update deps ([Snyk] Security upgrade jest from 24.9.0 to 25.0.0 #404)
• 7fb9f43 chore: fix typo ([Snyk] Fix for 1 vulnerabilities #401)
• b44a447 chore(release): 5.1.3
• 55adbdb chore(deps): update ([Snyk] Fix for 1 vulnerabilities #400)
• 772584a chore: update `jest-worker` ([Snyk] Security upgrade vscode from 1.0.3 to 1.1.0 #399)
• da8e166 chore: fix prepare ([Snyk] Security upgrade vscode from 1.0.1 to 1.1.0 #396)
• 0babc1b chore(release): 5.1.2
• a177425 fix: don't crash in non-parallel mode ([Snyk] Security upgrade remap-istanbul from 0.6.4 to 0.10.0 #395)
• bfbb68a chore(deps): update ([Snyk] Security upgrade nodemon from 1.19.4 to 2.0.17 #387)
• ee1d938 chore: update deps ([Snyk] Fix for 1 vulnerabilities #381)
• 727ee60 docs: update usage for webpack v4 ([Snyk] Security upgrade vscode-languageclient from 5.2.1 to 7.0.0 #378)
• 4320006 chore(release): 5.1.1
• 3a3fe51 fix: remove verbose console log ([Snyk] Security upgrade chromatic from 4.0.3 to 6.0.0 #374)
• 1859a92 chore(release): 5.1.0
• fea6f20 feat: optimize JS assets added later by plugins ([Snyk] Security upgrade vscode-languageclient from 5.2.1 to 7.0.0 #373)
• e10b8b4 test: source maps ([Snyk] Fix for 1 vulnerabilities #372)
• 0633c9d chore(deps): update ([Snyk] Fix for 1 vulnerabilities #371)
• 809ef42 chore(deps): update ([Snyk] Fix for 1 vulnerabilities #368)
• 562d121 style: default prettier
• 8ef95a6 test: updated ([Snyk] Security upgrade karma from 3.0.0 to 5.0.8 #355)
• 661d1f8 docs: no need to install it if you use webpack v5+ ([Snyk] Security upgrade @storybook/react from 5.3.21 to 6.1.7 #353)

See the full diff

Package name: webpack

The new version differs by 250 commits.

• f2f998b 5.1.1
• bcd6190 Merge pull request #11704 from webpack/bugfix/delete-asset
• 11935a9 Merge pull request #11703 from webpack/bugfix/11678
• 63ba54c update chunk to files mapping when deleting assets
• 4669600 Merge pull request #11690 from webpack/bugfix/11673
• 234373e Merge pull request #11702 from webpack/deps/terser
• b6bc273 fix infinite loop in inner graph optimization
• 50c3a83 fix unused modules in chunk when optimizing runtime-specific
• 5d9d9b9 fix runtime-specific handling in concatenated modules
• 250e37c add test case
• 7925652 upgrade terser-webpack-plugin
• 27796db Merge pull request #11669 from webpack/dependabot/npm_and_yarn/ts-loader-8.0.5
• bd5aab8 Merge pull request #11692 from webpack/dependabot/npm_and_yarn/babel/core-7.12.0
• 886bbd5 Merge pull request #11693 from webpack/dependabot/npm_and_yarn/react-dom-16.14.0
• 3a14b3d Merge pull request #11694 from webpack/dependabot/npm_and_yarn/react-16.14.0
• ddf9936 chore(deps-dev): bump react from 16.13.1 to 16.14.0
• dc6e69a chore(deps-dev): bump react-dom from 16.13.1 to 16.14.0
• 8f18de9 chore(deps-dev): bump @ babel/core from 7.11.6 to 7.12.0
• c0410e8 Merge pull request #11686 from webpack/bugfix/11677
• 4504046 order runtime chunks correctly when they depend on each other
• 74a44cd add comment to help tagging for the bot
• e97efb7 chore(deps-dev): bump ts-loader from 8.0.4 to 8.0.5
• 77329b4 5.1.0
• 48c10f3 Merge pull request #11653 from log2-hwan/fix-moduletemplate-deprecation

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[socket-security]

New and updated dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
terser-webpack-plugin	5.3.10	None	+2	187 kB	evilebottnawi
copy-webpack-plugin	6.4.1...9.1.0	None	+2/-7	89.2 kB	evilebottnawi