Using webpack-dev-middleware results with npm audit high vulnerability #38920
Labels
status: triage needed
Issue or pull request that need to be triaged and assigned to a reviewer
type: bug
An issue or pull request relating to a bug in Gatsby
Preliminary Checks
Description
Hi folks!
There is a
webpack-dev-middleware
usage in packages/gatsby/src/utils/start-server.ts which results with a high severity npm audit issue.Version
^4.3.0
has some reported vulnerabilities, which were fixed in patched versions hereWhat is the ETA of updating the mentioned package?
Reproduction Link
gatsby/packages/gatsby/package.json
Line 174 in 5723972
Steps to Reproduce
Run
![Screenshot 2024-04-04 at 12 02 46](https://private-user-images.githubusercontent.com/25795929/319536675-93bec305-e9cf-4913-83c8-3cf82507bd65.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU2MDE4NjIsIm5iZiI6MTcyNTYwMTU2MiwicGF0aCI6Ii8yNTc5NTkyOS8zMTk1MzY2NzUtOTNiZWMzMDUtZTljZi00OTEzLTgzYzgtM2NmODI1MDdiZDY1LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDYlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA2VDA1NDYwMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTJhNGViMmRkZTg4Yzk5MmVlYzEzZDg5MmI5Yzk3YTA5NWE3OTkxNmQ1ZWY4Y2UzZjEzYzdhNjUzNmI4OTY2N2EmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.PDRzuGpsK4CCNE3mVidazLqJoVv27CBfEY5MY6vWoZA)
npm audit
on a fresh Gatsby project.Expected Result
No high severity vulnerabilities found.
webpack-dev-middleware
should be bumped to v. 5.3.4 at leastActual Result
A high severity vulnerability was found.
Environment
Config Flags
No response
The text was updated successfully, but these errors were encountered: