epam/edp-headlamp

Manually Resolve Path Traversal Vulnerability in `webpack-dev-middleware`

Opened this issue · 0 comments

Dependabot has identified a path traversal vulnerability in webpack-dev-middleware but cannot automatically update to a non-vulnerable version due to conflicting dependencies within @kinvolk/headlamp-plugin@0.8.0. The conflicting requirements are as follows:

  • @kinvolk/headlamp-plugin@0.8.0 requires webpack-dev-middleware@^3.7.3 via transitive dependencies on @storybook/builder-webpack4@6.4.13 and @storybook/manager-webpack4@6.4.13.
  • @kinvolk/headlamp-plugin@0.8.0 also requires webpack-dev-middleware@^4.1.0 via @storybook/builder-webpack5@6.4.13 and @storybook/manager-webpack5@6.4.13.

The earliest fixed version of webpack-dev-middleware is 5.3.4. We need to manually resolve this dependency conflict and update webpack-dev-middleware to a secure version.

Acceptance Criteria

  • Investigate and resolve the conflicting dependency requirements for webpack-dev-middleware within @kinvolk/headlamp-plugin@0.8.0.
  • Update webpack-dev-middleware to version 5.3.4 or above, ensuring compatibility with both Webpack 4 and Webpack 5 storybook dependencies.
  • Ensure the application builds successfully with the updated webpack-dev-middleware version.
  • Perform a thorough testing to confirm that the update does not break existing functionality.
  • Confirm that all automated tests pass with the updated dependency.