Laravel-mix: Vulnerability in laravel-mix

[mwleinad]

• Laravel Mix Version: 4.0.7 (But I checked master and the dependency is still the same)
• Node Version 10.13.0
• NPM Version 6.4.1
• OS: Centos

Description:

I know this is not your fault but this is something to keep in mind.
There's nested dependency called set-value with a vulnerability. The dependency tree looks like this.

├─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ ├── [email protected]
│ └─┬ [email protected]
│ └── [email protected]

The vulnerability is this one
https://nvd.nist.gov/vuln/detail/CVE-2019-10747

Might be all is needed is to update chokidar? Chokidar uses a 3.0.2 version of braces which looks like doesn't depend on snapdragon anymore?

[Stokoe0990]

Getting this in a production environment on latest release.

[Stokoe0990]

Seems to be a duplicate of #2350, but this issue is better formatted.

[sibenye]

@Stokoe0990 any update on this? What version is this fix expected to be on?

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[jbardnz]

This issue still persists.

[bradydan]

@JeffreyWay Any plans to address this vulnerability?

The dependency fix was released over a year ago (19 Jun 2019)

As @mwleinad said in the top comment:

Might be all is needed is to update chokidar? Chokidar uses a 3.0.2 version of braces which looks like doesn't depend on snapdragon anymore?

[roddypratt]

Chokidar 2 is giving warnings of breakage with Node 14+, so another reason to do this.

warning laravel-mix > webpack > watchpack > watchpack-chokidar2 > [email protected]: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[bradydan]

Bump

[roddypratt]

Looks like this is resolved in the 6.0 prerelease which requires Webpack 5.