Create-react-app: Security: Bump terser-webpack-plugin to address CVE-2020-7660

[AjkayAlan]

The Problem

react-scripts-3.4.1 relies on terser-webpack-plugin-2.3.5 which then relies on serialize-javascript-2.1.2, which is vulnerable per https://nvd.nist.gov/vuln/detail/CVE-2020-7660.

My Ask

Can terser-webpack-plugin be bumped to 2.3.7, which relies on serialize-javascript ^3.1.0? This would address this vulnerability.

This is similar to #8159.

[RinatRezyapov]

They've already fixed it in the master (https://github.com/facebook/create-react-app/pull/8950/files) so I guess we should wait for the next release?

[AjkayAlan]

Good catch, yeah, looks like next release should get us there.

[devchris]

Does anyone know when the next release happens?

[olliecurtis]

Do we know when this release will be coming? Just to be prepared for when to upgrade 😄

[stale[bot]]

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

[simonpasquier]

IMO it's still valid and a new release would be much appreciated :)

[stale[bot]]

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

[AjkayAlan]

Bump - this is still an issue and there still has not been any new release.

[olliecurtis]

@AjkayAlan - Not sure if this is helpful or not for you but raised this discussion for confirmation of releases as I have noticed their have been newer releases but also I am aware CRA 4 is also in progress so wanted to find out if these fixes are safe to use now
https://github.com/facebook/create-react-app/discussions/9484

[olliecurtis]

@AjkayAlan - I managed to get an answer here in #9484 about the new versions and getting this fix released

https://github.com/facebook/create-react-app/discussions/9484#discussioncomment-52089

[AjkayAlan]

Thanks @olliecurtis! Based on the new release existing in npmjs, I think it solves our issue.

Closing.