Vulnerability in terser-webpack-plugin dependency

[mheathcote1977]

Our corporate scanning software is preventing the use of the latest version 11.0.x due to a vulnerability in one of the dependencies.

Currently version 11.0.8 depends on terser-webpack-plugin@2.2.0 (in lock file). This in turn depends on serialize-javascript@2.1.2. The vulnerability is in the serialize javascript plugin.

Please could you update terser-webpack-plugin to version 2.3.6 or greater, as they have updated to serialize-javascript 3.0 which no longer has the blocking vulnerability.

Huge thanks and great work.

[sapegin]

Feel free to send a pull request with a fix.

[dhavalsingh]

Is anyone working on this? Can i take a shot at it?

[carlosruana]

Duplicate of #1658 terser-webpack-plugin has already been updated to ^4.1.0