Security vulnerability in webpack-dev-server dependency

[robrien-bcgov]

webpack-dev-server users' source code may be stolen when they access a malicious web site - GHSA-4v9v-hfq4-rm2v

The current @wordpress/scripts@30.20.0 depends on vulnerable webpack-dev-server <=5.2.0.

npm audit suggests fixing via npm audit fix --force which will downgrade @wordpress/scripts to 19.2.4, a breaking change.

Need to investigate a better fix, such as updating @wordpress/scripts to a version that uses a safe webpack-dev-server version, or overriding the dependency.

Current package.json has direct dependency on webpack-dev-server ^5.2.2, but @wordpress/scripts pulls in 4.15.2.

[robrien-bcgov]

Fixed by adding "overrides": { "webpack-dev-server": "^5.2.2" } to package.json, which forces all dependencies to use the safe version without breaking changes.

[robrien-bcgov]

@ShawnTurple What do you think of this fix?

[ShawnTurple]

@ShawnTurple What do you think of this fix?

if we used the webpack-dev-server, i would say this is a reasonable approach, but since we don't i'm ok with not adding the additional tech debt into our package.json, and living with the dependabot alert. I think creating the issue to indicate the problem is a good alternative, and owes us no debt.
So short answer is, no lets not do this, but thank you for the suggestion

[robrien-bcgov]

Webpack-dev-server override removed