Unanswered

Webpack in pcf-scripts out of date

(2) Share

Report

Posted on by davallen Microsoft Employee

Hello,

We have a high prioritiy security issue with the specified version of webpack (4.28.4) in the pcf-scripts npm package. Unfortunately it specifies exactly that version in package.json.

Is it ok to resolve to the latest webpack version or would this cause issues to pcf-scripts package?

Categories:

Power Apps Pro Dev & ISV

I have the same question (0)

All responses (2)

Answers (0)

Sort by

David Jenni Microsoft Employee on at

Like (2)

Report
Copy link

Link copied!

The soon-to-be-released March refresh for pcf-scripts (ETA mid next week) has already been updated to:
"webpack": "4.42.1",

It got flagged by our internal compliance/security tracking as well.
To work around until then, yes, you should be able to locally resolve to the latest 4.42.1

Was this reply helpful? Yes No
Ben Thompson 1,400 on at

Like (3)

Report
Copy link

Link copied!

While we are in this area, my gitgub repository is complaining about a number of security vulnerabilities with some webpack dependencies (but not yet webpack itself).

Minimist - Upgrade minimist to version 1.2.3 or later.
acorn - Upgrade acorn to version 5.7.4 or later
kind-of - Upgrade kind-of to version 6.0.3 or later

Will this next release resolve these complaints as well?

Was this reply helpful? Yes No