found 1 high severity vulnerability

[MiniMarvin]

Summary

High | Remote Code Execution
Package | serialize-javascript
Patched in | >=3.1.0
Dependency of | next-pwa
Path | next-pwa > workbox-webpack-plugin > workbox-build > rollup-plugin-terser > serialize-javascript
More info | https://npmjs.com/advisories/1548

How To Reproduce

Steps to reproduce the behavior:

npm install --save next-pwa
npm audit

Link to minimal reproduce setup repository if any.

Expected Behaviors

The lib to be updated and do not have this critical vulnerability

[shadowwalker]

Thanks for raising this issue.

yarn audit v1.22.4
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Remote Code Execution                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ serialize-javascript                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.1.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ workbox-webpack-plugin                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ workbox-webpack-plugin > workbox-build >                     │
│               │ rollup-plugin-terser > serialize-javascript                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1548                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
1 vulnerabilities found - Packages audited: 593
Severity: 1 High

This is used in build time, which should be a less risk vulnerability. Prefer to raise this issue in workbox project as I'm not sure if I update it here, if it will break some scenarios.

[Yonom]

Just opened an issue here:

GoogleChrome/workbox#2626

[shadowwalker]

Resolved