Webpacker: compression-webpack-plugin and serialize-javascript@^1.4.0 dependency

[WillHen]

One of this repros dependancies (compression-webpack-plugin) has a dependency of serialize-javascript@^1.4.0 which has a known issue https://github.com/advisories/GHSA-h9rv-jmmf-4pgx .
The compression-webpack-plugin repro has not been updated in 6 months, someone has submitted a PR to fix the issue and upgrade serialize-javascript but it has not been approved or merged as of yet.

Is it possible to move away from compression-webpack-plugin?

[clearyandzap]

compression-webpack-plugin has made a fix https://github.com/webpack-contrib/compression-webpack-plugin/pull/139

[vfonic]

This should fix the issue:
yarn upgrade "terser-webpack-plugin@^1.4.1"

After this, run yarn audit to make sure there are no known security issues in your project dependencies.

[Yenwod]

To pickup the fix mentioned by @clearyandzap, this worked for me:

$ yarn upgrade "@rails/webpacker@^4.2.2"
$ yarn audit

Yarn audit confirmed the fix.

[guillaumebriday]

Is this issue can be closed ?

[Levii01]

@Yenwod solution works for me