[Snyk] Security upgrade laravel-mix from 5.0.5 to 6.0.0 - #75
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-NODEFORGE-14114940 - https://snyk.io/vuln/SNYK-JS-NODEFORGE-14125745 - https://snyk.io/vuln/SNYK-JS-NODEFORGE-14125097
| "eslint-plugin-vue": "^5.2.3", | ||
| "laravel-mix": "^5.0.4", | ||
| "laravel-mix": "^6.0.0", | ||
| "livewire-vue": "^0.3.1", | ||
| "moment": "^2.28.0", |
There was a problem hiding this comment.
Bug: Webpack 5, bundled with Laravel Mix 6, does not support the --hide-modules flag used in package.json build scripts.
Severity: CRITICAL | Confidence: High
🔍 Detailed Analysis
The development and production npm scripts in package.json directly invoke webpack.js with the --hide-modules flag. With the upgrade to Laravel Mix 6, which bundles Webpack 5, this flag is no longer supported. Consequently, running npm run dev, npm run production, or npm run watch will result in an "Unknown argument: --hide-modules" error, preventing the application from building successfully in any environment.
💡 Suggested Fix
Remove the --hide-modules flag from the development and production scripts in package.json as it is deprecated in Webpack 5.
🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: package.json#L29-L32
Potential issue: The `development` and `production` npm scripts in `package.json`
directly invoke `webpack.js` with the `--hide-modules` flag. With the upgrade to Laravel
Mix 6, which bundles Webpack 5, this flag is no longer supported. Consequently, running
`npm run dev`, `npm run production`, or `npm run watch` will result in an "Unknown
argument: --hide-modules" error, preventing the application from building successfully
in any environment.
Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 4268935
Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonpackage-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-NODEFORGE-14114940
SNYK-JS-NODEFORGE-14125745
SNYK-JS-NODEFORGE-14125097
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.