[Snyk] Upgrade webpack from 4.43.0 to 4.44.1 #29

snyk-bot · 2020-10-02T08:43:06Z

Snyk has created this PR to upgrade webpack from 4.43.0 to 4.44.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 2 versions ahead of your current version.
The recommended version was released 2 months ago, on 2020-07-30.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Arbitrary Code Injection SNYK-JS-SERIALIZEJAVASCRIPT-570062	492/1000 Why? Proof of Concept exploit, CVSS 7.7	Proof of Concept
	Cryptographic Issues SNYK-JS-ELLIPTIC-571484	492/1000 Why? Proof of Concept exploit, CVSS 7.7	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: webpack

4.44.1 - 2020-07-30
Bugfixes
- fix bug in sideEffects optimization when using export * from "non-esm" and a default export.
- add missing optional peerDependencies for webpack-cli and webpack-command to support Yarn 2
4.44.0 - 2020-07-24
Features
- Improve sideEffects flag behavior when dynamic modules are part of the tree
  - Fixes a bug which causes empty modules (or type-only modules) to "break" Tree Shaking
- add splitChunks.enforceSizeThreshold to allow enfore splitting larger chunks unrelated from other limiations
  - Not set by default to avoid breaking change
  - It will be set by default to 50k in webpack 5
  - It's recommended to set it in webpack 4 too
- add support for resolve.roots and default resolve.roots: [context]
  - This allows to resolve server-relative urls (e.g. /src/abc) to the project root (or other locations when configured)
  - This allows to use loaders that rely on that behavior
Bugfixes
- fix bug where splitChunks produced non-optimal results when minSize is set to 0
  - This lead to NaNs in some places which breaks ordering
- Fix bug which lead to HMR not working for splitChunks in entrypoints
- force update watchpack and chokidar for chokidar bugfix which causes files to stop being watched
4.43.0 - 2020-04-21

from webpack GitHub release notes

Commit messages

Package name: webpack

cd4af16 4.44.1
7895778 Merge pull request #11244 from webpack/bugfix/dynamic-reexport-default
46304c8 ignore default export when reexporting a dynamic module
91e81c8 Merge pull request #11190 from merceyz/patch-2
087af7c Merge branch 'webpack-4' into patch-2
d4603c6 4.44.0
ea06f03 Merge pull request #11225 from webpack/deps/watchpack
eae1ba0 update watchpack
42dc038 Merge pull request #11210 from webpack/ci/timeout-4
21e3c11 Merge pull request #11207 from webpack/backport/add-roots
ce3ca7b watch test cases: close correctly, increase timeout
5c9c601 Improve description in config schema
a925e6a add roots option
f170b98 chore: only specify peerDependenciesMeta
e7c690e fix: add missing optional peer dependencies
1879a81 Merge pull request #10776 from jeffin143/fix-10775
0d8ff5f keep old code style
e128392 fix test case
a41994a Merge pull request #11168 from webpack/bugfix/split-chunks
f0568ec update snapshot
cff07cd splitChunks improvements
dfd2021 Merge pull request #10933 from webpack/test/dynamic-reexports
8063d2c add more test cases for dynamic reexports
b343020 Merge pull request #10919 from webpack/bugfixes/side-effect-optimization