Daniel Vaz Gaspar eff77319e9 chore(deps-dev): bump copy-webpack-plugin to 14.0.0 and css-minimizer-webpack-plugin to 8.0.0 (#690) ...

Bumps copy-webpack-plugin 13.0.0→14.0.0 and css-minimizer-webpack-plugin
7.0.2→8.0.0 to resolve serialize-javascript 6.0.2→7.0.5 (CVE-2026-34043,
BDSA-2020-4569 CVSS 8.1, tagged Zero-click RCE).

Note: webpack's bundled terser-webpack-plugin still pulls serialize-javascript
6.0.2 as a transitive dep — requires webpack upgrade to fully resolve.

Cherry-picked from upstream apache/superset commits 361afff798, a2c23a2a58.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-29 09:12:55 -07:00

16 KiB

Raw Blame History

View Raw