You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@seata.apache.org by "slievrly (via GitHub)" <gi...@apache.org> on 2025/10/17 02:12:59 UTC
[PR] optimize: fix frontend security vulnerabilities [incubator-seata]
slievrly opened a new pull request, #7704:
URL: https://github.com/apache/incubator-seata/pull/7704
## Overview
This PR addresses frontend security vulnerabilities reported by GitHub Dependabot by upgrading webpack from version 4 to version 5 and updating related dependencies to their latest secure versions.
## Security Impact
### console-fe
- **Before**: 23 vulnerabilities (7 high, 11 moderate, 5 low)
- **After**: 5 vulnerabilities (0 high, 0 moderate, 5 low)
- **Result**: ✅ 100% of high and moderate vulnerabilities resolved
### saga-designer
- **Before**: 1 vulnerability (1 moderate)
- **After**: 0 vulnerabilities
- **Result**: ✅ 100% of all vulnerabilities resolved
## Key Vulnerabilities Fixed
1. **webpack-dev-server** (Moderate - GHSA-9jgg-88mc-972h, GHSA-4v9v-hfq4-rm2v)
- Source code theft vulnerability when accessing malicious websites
- Fixed by upgrading from 4.15.1 to 5.2.2
2. **serialize-javascript** (High - GHSA-h9rv-jmmf-4pgx, GHSA-hxcc-f52p-wc94)
- Cross-Site Scripting (XSS) vulnerability
- Insecure serialization leading to RCE
- Fixed by replacing uglifyjs-webpack-plugin with built-in TerserPlugin
3. **braces** (High - GHSA-grv7-fg5c-xmjg)
- Uncontrolled resource consumption (ReDoS)
- Fixed via package override to version 3.0.3
4. **micromatch** (Moderate - GHSA-952p-6rrq-rcjv)
- Regular Expression Denial of Service (ReDoS)
- Fixed via package override to version 4.0.8
5. **nanoid** (Moderate - GHSA-mwcw-c2x4-8c55)
- Predictable results in generation
- Fixed via package override to version 3.3.8
6. **svelte/swiper** (Moderate - GHSA-8266-84wp-wv5c)
- Potential mXSS vulnerability
- Fixed via package override to version 6.5.9
## Changes Made
### Major Upgrade
- **webpack**: 4.47.0 → 5.102.1 (required for webpack-dev-server security fix)
### Dependency Updates (console-fe)
- **webpack-dev-server**: 4.15.1 → 5.2.2
- **html-webpack-plugin**: 4.5.2 → 5.6.3
- **copy-webpack-plugin**: 6.4.1 → 11.0.0
- **mini-css-extract-plugin**: 1.6.2 → 2.9.2
- **css-loader**: 5.2.7 → 6.11.0
- **sass-loader**: 10.5.2 → 13.3.3
- Replaced **uglifyjs-webpack-plugin** with built-in **TerserPlugin**
- Replaced **optimize-css-assets-webpack-plugin** with **css-minimizer-webpack-plugin**
### Package Overrides (console-fe)
Updated package.json overrides to enforce secure versions:
- **nanoid**: 3.1.31 → 3.3.8
- **swiper**: 6.5.1 → 6.5.9
- **node-fetch**: 2.6.7 → 2.7.0
- **braces**: → 3.0.3 (new)
- **micromatch**: → 4.0.8 (new)
- **serialize-javascript**: → 6.0.2 (new)
### Configuration Updates (console-fe)
- Updated `webpack.prod.conf.js` to use TerserPlugin and CssMinimizerPlugin
- Updated `webpack.base.conf.js` to use webpack 5 syntax (`resolve.fallback` instead of deprecated `node.fs`)
### Dependency Updates (saga-designer)
- **webpack-dev-server**: 4.13.2 → 5.2.2
## Testing
✅ **npm install** successful on both projects
✅ **npm run build** successful on both projects
✅ **npm audit** confirms vulnerability reduction
✅ Build output sizes within expected range
✅ Webpack 5 configuration properly migrated
## Remaining Issues
5 low severity vulnerabilities remain in console-fe, all related to `@alicloud/console-components-console-menu` dependency:
- min-document (prototype pollution)
- global, dva-core, dva (dependent on min-document)
These vulnerabilities have **no fix available** and require the vendor (@alicloud) to update their dependencies. Risk assessment: **LOW**.
## Breaking Changes
This PR includes a major version upgrade from webpack 4 to webpack 5. While the build process has been tested and verified, it's recommended to:
- Test the built applications in development and staging environments
- Monitor for any runtime issues with the upgraded webpack
- Verify dev server functionality with `npm run start`
## References
- [GHSA-9jgg-88mc-972h](https://github.com/advisories/GHSA-9jgg-88mc-972h): webpack-dev-server source code theft
- [GHSA-4v9v-hfq4-rm2v](https://github.com/advisories/GHSA-4v9v-hfq4-rm2v): webpack-dev-server source code theft
- [GHSA-h9rv-jmmf-4pgx](https://github.com/advisories/GHSA-h9rv-jmmf-4pgx): XSS in serialize-javascript
- [GHSA-hxcc-f52p-wc94](https://github.com/advisories/GHSA-hxcc-f52p-wc94): RCE in serialize-javascript
- [GHSA-grv7-fg5c-xmjg](https://github.com/advisories/GHSA-grv7-fg5c-xmjg): ReDoS in braces
- [GHSA-952p-6rrq-rcjv](https://github.com/advisories/GHSA-952p-6rrq-rcjv): ReDoS in micromatch
https://github.com/slievrly/fescar/pull/7
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] optimize: fix frontend security vulnerabilities [incubator-seata]
Posted by "funky-eyes (via GitHub)" <gi...@apache.org>.
funky-eyes merged PR #7704:
URL: https://github.com/apache/incubator-seata/pull/7704
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] optimize: fix frontend security vulnerabilities [incubator-seata]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #7704:
URL: https://github.com/apache/incubator-seata/pull/7704#issuecomment-3413539224
## [Codecov](https://app.codecov.io/gh/apache/incubator-seata/pull/7704?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 61.41%. Comparing base ([`b912ab7`](https://app.codecov.io/gh/apache/incubator-seata/commit/b912ab75861152bca3bf104aa8cfb9c029f91ea5?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`b02677d`](https://app.codecov.io/gh/apache/incubator-seata/commit/b02677dde3028807966a0668db1776ebbc673a00?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## 2.x #7704 +/- ##
============================================
- Coverage 61.51% 61.41% -0.11%
- Complexity 680 684 +4
============================================
Files 1323 1323
Lines 49930 49930
Branches 5881 5881
============================================
- Hits 30714 30663 -51
- Misses 16429 16505 +76
+ Partials 2787 2762 -25
```
[see 43 files with indirect coverage changes](https://app.codecov.io/gh/apache/incubator-seata/pull/7704/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
[](https://app.codecov.io/gh/apache/incubator-seata/pull/7704?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org