Manually Resolve Path Traversal Vulnerability in `webpack-dev-middleware`
Opened this issue · 0 comments
SergK commented
Dependabot has identified a path traversal vulnerability in webpack-dev-middleware
but cannot automatically update to a non-vulnerable version due to conflicting dependencies within @kinvolk/headlamp-plugin@0.8.0
. The conflicting requirements are as follows:
@kinvolk/headlamp-plugin@0.8.0
requireswebpack-dev-middleware@^3.7.3
via transitive dependencies on@storybook/builder-webpack4@6.4.13
and@storybook/manager-webpack4@6.4.13
.@kinvolk/headlamp-plugin@0.8.0
also requireswebpack-dev-middleware@^4.1.0
via@storybook/builder-webpack5@6.4.13
and@storybook/manager-webpack5@6.4.13
.
The earliest fixed version of webpack-dev-middleware
is 5.3.4
. We need to manually resolve this dependency conflict and update webpack-dev-middleware
to a secure version.
Acceptance Criteria
- Investigate and resolve the conflicting dependency requirements for
webpack-dev-middleware
within@kinvolk/headlamp-plugin@0.8.0
. - Update
webpack-dev-middleware
to version5.3.4
or above, ensuring compatibility with both Webpack 4 and Webpack 5 storybook dependencies. - Ensure the application builds successfully with the updated
webpack-dev-middleware
version. - Perform a thorough testing to confirm that the update does not break existing functionality.
- Confirm that all automated tests pass with the updated dependency.