Support for new version of loader-utils?

Question

Support for new version of loader-utils?

plasticlobster opened this issue 2 years ago · comments

Josh Mullin commented 2 years ago

The current version of bootstrap-loader has a hard-versioned dependency on loader-utils 1.2.3.

loader-utils < 1.4.1 has a critical CVE (9.8/10) (CVE-2022-37601) - https://nvd.nist.gov/vuln/detail/CVE-2022-37601

Is there any chance this lib can be bumped without causing issues?

Josh Mullin · Answer 1 · Wed Dec 21 2022 08:36:00 GMT+0800 (China Standard Time)

Looks like #410 resolves this.

Is there a scheduled NPM release that may include this?

Josh Mullin · Answer 2 · Tue Jan 03 2023 23:10:22 GMT+0800 (China Standard Time)

@justin808 sorry to be so persistent.. I see that @dargmuesli asked a couple of weeks ago in #410 if you would tag a new release. Can that please happen? This CVE is extremely serious.

Justin Gordon · Answer 3 · Wed Jan 04 2023 15:35:21 GMT+0800 (China Standard Time)

@plasticlobster I just pushed 4.0.2.

Josh Mullin · Answer 4 · Thu Jan 05 2023 00:16:32 GMT+0800 (China Standard Time)

@plasticlobster I just pushed 4.0.2.

Thanks so much! This cleared our critical dependabot alerts...

There's a less serious CVE-2022-37603 (7.5/10) that needs a version bump to loader-utils 1.4.2 to clear, but I'm able to force that install on my end using yarn.

It would be amazing if bootstrap-loader could change its dependency to ^1.0.0 (or better yet ^2.0.0) instead of hard-versioning on individual versions.

But I do appreciate you getting this released. It's a huge help. Thank you.