Skip to content

[Security] Bump terser from 5.14.1 to 5.14.2 in /webapp

Dependabot requested to merge dependabot-npm_and_yarn-webapp-terser-5.14.2 into master

Bumps terser from 5.14.1 to 5.14.2. This update includes a security fix.

Vulnerabilities fixed

Terser insecure use of regular expressions before v4.8.1 and v5.14.2 leads to ReDoS The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Patched versions: 5.14.2 Affected versions: >= 5.0.0, < 5.14.2

Changelog

Sourced from terser's changelog.

v5.14.2

  • Security fix for RegExps that should not be evaluated (regexp DDOS)
  • Source maps improvements (#1211)
  • Performance improvements in long property access evaluation (#1213)
Commits

Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot rebase will rebase this MR
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

Merge request reports