Skip to content

[Security] Bump terser from 5.14.0 to 5.14.2 in /frontend

Dependabot requested to merge dependabot-npm_and_yarn-frontend-terser-5.14.2 into master

Bumps terser from 5.14.0 to 5.14.2. This update includes a security fix.

Vulnerabilities fixed

Terser insecure use of regular expressions before v4.8.1 and v5.14.2 leads to ReDoS The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Patched versions: 5.14.2 Affected versions: >= 5.0.0, < 5.14.2

Changelog

Sourced from terser's changelog.

v5.14.2

  • Security fix for RegExps that should not be evaluated (regexp DDOS)
  • Source maps improvements (#1211)
  • Performance improvements in long property access evaluation (#1213)

v5.14.1

  • keep_numbers option added to TypeScript defs (#1208)
  • Fixed parsing of nested template strings (#1204)
Commits

Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot rebase will rebase this MR
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

Merge request reports