Workbox webpack plugin version 3.1.0 introduces a maintenance update over the previous stable version 3.0.1, primarily focusing on improvements within its dependencies. The core functionality of simplifying Webpack build processes for generating precache manifests compatible with workbox-sw remains consistent across both versions. Developers using Webpack to manage their assets and integrate service workers will appreciate the plugin's ability to automate the creation of these manifests, crucial for enabling offline capabilities and improving website performance through caching.
The key difference lies in the updated "workbox-build" dependency, moving from version 3.0.1 to version 3.1.0. This likely incorporates bug fixes, performance enhancements, and potentially new features within the underlying Workbox build tools. If you relies on the workbox-build library directly, inspecting the changelog for workbox-build 3.1.0 would be beneficial. The "json-stable-stringify" dependency remains unchanged at version 1.0.1, suggesting no modifications were needed in how JSON data is handled.
Both versions maintain compatibility with Webpack versions 2, 3, and 4, ensuring a smooth upgrade process for existing projects using the plugin. The update also signifies ongoing maintenance from the Workbox team, reinforcing its reliability for developers invested in service worker integration. The newer version has an increase in the package size, from 49134 to 63611 unpacked, and number of files, from 14 to 17, probably due to the workbox-build updated dependency.
All the vulnerabilities related to the version 3.1.0 of the package
hoek subject to prototype pollution via the clone function.
hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the proto key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1.
Command Injection in lodash
lodash
versions prior to 4.17.21 are vulnerable to Command Injection via the template function.