Skip to content

[Snyk] Security upgrade laravel-mix from 5.0.5 to 6.0.0 - #75

Open
ohnotnow wants to merge 1 commit into
masterfrom
snyk-fix-40b004f7bcd0db3c00dff124a0180af2
Open

[Snyk] Security upgrade laravel-mix from 5.0.5 to 6.0.0#75
ohnotnow wants to merge 1 commit into
masterfrom
snyk-fix-40b004f7bcd0db3c00dff124a0180af2

Conversation

@ohnotnow

Copy link
Copy Markdown
Contributor

snyk-top-banner

Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • package.json
  • package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
critical severity Interpretation Conflict
SNYK-JS-NODEFORGE-14114940
  751  
high severity Uncontrolled Recursion
SNYK-JS-NODEFORGE-14125745
  721  
medium severity Integer Overflow or Wraparound
SNYK-JS-NODEFORGE-14125097
  601  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Comment thread package.json
Comment on lines 29 to 32
"eslint-plugin-vue": "^5.2.3",
"laravel-mix": "^5.0.4",
"laravel-mix": "^6.0.0",
"livewire-vue": "^0.3.1",
"moment": "^2.28.0",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Webpack 5, bundled with Laravel Mix 6, does not support the --hide-modules flag used in package.json build scripts.
Severity: CRITICAL | Confidence: High

🔍 Detailed Analysis

The development and production npm scripts in package.json directly invoke webpack.js with the --hide-modules flag. With the upgrade to Laravel Mix 6, which bundles Webpack 5, this flag is no longer supported. Consequently, running npm run dev, npm run production, or npm run watch will result in an "Unknown argument: --hide-modules" error, preventing the application from building successfully in any environment.

💡 Suggested Fix

Remove the --hide-modules flag from the development and production scripts in package.json as it is deprecated in Webpack 5.

🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L29-L32

Potential issue: The `development` and `production` npm scripts in `package.json`
directly invoke `webpack.js` with the `--hide-modules` flag. With the upgrade to Laravel
Mix 6, which bundles Webpack 5, this flag is no longer supported. Consequently, running
`npm run dev`, `npm run production`, or `npm run watch` will result in an "Unknown
argument: --hide-modules" error, preventing the application from building successfully
in any environment.

Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 4268935

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants