updated packages to remove security issue: Cross-site Scripting (XSS) in serialize-javascript#515
Open
nightness wants to merge 5 commits into
Open
updated packages to remove security issue: Cross-site Scripting (XSS) in serialize-javascript#515nightness wants to merge 5 commits into
nightness wants to merge 5 commits into
Conversation
… in serialize-javascript
Deps / security: npm audit 24 → 0 (6 low, 6 moderate, 9 high, 3 critical cleared); workbox → 7.4, serialize-javascript pinned via overrides; dropped vestigial webpack.config.js and its devDeps (bundle was never referenced — main is index.js, which is plain CommonJS). Correctness: - fallback.js: switch fall-through no longer leaks image/audio/video/font/data fallbacks when only one type is configured. - build-custom-worker.js / build-fallback-worker.js: replaced process.exit(-1) with thrown errors so worker build failures no longer nuke the consumer's dev server / CI run. - index.js: removed dead experimental.modern branch (Next 12+). Next 14–16 support: - Turbopack guard: detect process.env.TURBOPACK and return nextConfig unmodified with a one-line warning. Avoids Next 16's "webpack config without turbopack config" hard failure under the new default bundler. - App Router: inject register.js into the `main-app` client entry alongside `main.js` so App Router apps actually register the service worker. Breaking changes (hence v7.0.0): - peerDependencies.next: ">=9.0.0" → ">=14.0.0". - Removed deprecated `subdomainPrefix` option. - `reloadOnOnline` default flipped true → false (no more mid-interaction reloads when connectivity returns). - New `trustStartUrlRedirects` option (default false). Previously next-pwa unconditionally rewrote opaque/redirected start-URL responses to 200 OK and cached them under the canonical key. Now opt-in. Consumers using `dynamicStartUrlRedirect` or start-URL redirecting middleware must set `trustStartUrlRedirects: true`. Metadata: repository → Brainwires/next-pwa, README migration section, new CHANGELOG 7.0.0 entry, workbox doc references updated v6 → v7. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ects closure leak Library fix (index.js): - `trustStartUrlRedirects` was referenced inside the start-url `cacheWillUpdate` callback, which workbox-webpack-plugin serializes to a string and injects into sw.js. The variable leaked into the service worker as a free reference, throwing ReferenceError at runtime. Decide at build time whether to include the rewrite plugin at all — never capture build-time variables in callbacks workbox will serialize. Caught by smoke-testing the examples. Examples pass: - Deleted `examples/next-9/` — contradicts the v7.0.0 peer dep of Next >=14. - New `examples/app-router/` — minimal App Router showcase, demonstrates the `main-app` client entry injection landed in v7.0.0. - `cookie/next.config.js` — added required `trustStartUrlRedirects: true` (breaking change from v7.0.0). Verified the resulting sw.js contains the inlined `cacheWillUpdate` handler. - `offline-fallback/` + `offline-fallback-v2/next.config.js` — migrated deprecated `images.domains` → `images.remotePatterns` (Next 12+ API). - `minimal/` — dropped the fastify custom server; it existed only to hand-serve sw.js from .next/, which `dest: 'public'` makes unnecessary. Now genuinely minimal. - `next-i18next/` — dropped the express custom server; rewrote for the serverSideTranslations / appWithTranslation Pages Router API; moved locales from `public/static/locales/` → `public/locales/` per next-i18next convention. Pinned `next-i18next@^15.4.3` because v16 is App-Router-only and removed the Pages Router helpers this example uses. - `cache-on-front-end-nav/pages/_app.js` — renamed `_App` to `App`; the underscore-prefixed name made ESLint's react-hooks/rules-of-hooks reject the hook calls in newer Next.js (blocking the build). - `custom-ts-worker/next-env.d.ts` — regenerated by Next 15 during build. All remaining 11 examples now build clean on Next 15.5.15 against next-pwa 7.0.0 (smoke-tested via `npm pack` tarball + `next build` in each directory): service worker + workbox chunks emitted for the 10 Pages Router examples, and the App Router example's `main-app` entry correctly includes register.js. Dep floor across all examples: - next ^15.5.15 (user chose 15.x — webpack default, no --webpack flag needed) - react / react-dom ^19.2.5 - next-pwa ^7.0.0 - eslint-config-next ^15.5.15 - eslint ^8.57.1 (pinned 8.x; ESLint 9 drops eslintrc support, and migrating 12 .eslintrc.json files to flat config is out of scope here) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- package.json: name → @brainwires/next-pwa - README + 12 examples: update require() and dependency refs to scoped name - .npmignore: drop .claude/, dist/, .gitpod.yml; stop excluding CHANGELOG.md - Remove vestigial .babelrc (unused — build workers configure babel inline, and main:index.js ships as CommonJS with no transpile step) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixed without rewriting the source files...