Skip to content

Remove old serialize-javascript version dependency#7944

Open
acwhite211 wants to merge 1 commit intomainfrom
issue-7933
Open

Remove old serialize-javascript version dependency#7944
acwhite211 wants to merge 1 commit intomainfrom
issue-7933

Conversation

@acwhite211
Copy link
Copy Markdown
Member

Fixes #7933
Fixes https://github.com/specify/specify7/security/dependabot/186

Dependabot flagged serialize-javascript <= 7.0.2 as vulnerable to RCE. This issue was introduced transitively through terser-webpack-plugin@5.3.11 in the front-end dependency tree. We can use terser-webpack-plugin@5.4.0 since it no longer depends on serialize-javascript, so this change removes the vulnerable package entirely rather than pinning serialize-javascript directly.

Removed vulnerable serialize-javascript from front-end lockfile. Added an override for terser-webpack-plugin in specifyweb/frontend/js_src/package.json. Update specifyweb/frontend/js_src/package-lock.json to resolve terser-webpack-plugin to 5.4.0. Remove the transitive serialize-javascript@6.0.2 dependency from the front-end lockfile. Remove the now unused transitive randombytes entry that came from serialize-javascript.

Checklist

  • Self-review the PR after opening it to make sure the changes look good and
    self-explanatory (or properly documented)
  • Add relevant issue to release milestone
  • Add pr to documentation list

Testing instructions

  • Light general testing of the Specify UI.

@acwhite211 acwhite211 added this to the 7.12.1 milestone Apr 9, 2026
@acwhite211 acwhite211 requested review from a team April 9, 2026 17:21
@github-project-automation github-project-automation bot moved this to 📋Back Log in General Tester Board Apr 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: 📋Back Log

Development

Successfully merging this pull request may close these issues.

Solve dependabot issue by removing old serialize-javascript version dependency

1 participant