Workbox webpack plugin version 3.4.1 introduces subtle yet impactful improvements over its predecessor, version 3.3.1, offering developers enhanced control and potentially optimized build processes. Both versions serve the core purpose of simplifying service worker integration within Webpack projects, automating the generation of precaching manifests crucial for offline capabilities within progressive web apps (PWAs).
The primary difference lies in the updated dependency on workbox-build, moving from version 3.3.1 to 3.4.1. While the specifics of changes within workbox-build would require deeper investigation, this upgrade likely encompasses bug fixes, performance enhancements, or new features related to service worker generation and management. Developers should consult the workbox-build changelog for detailed information.
A noticeable difference in the dist section reveals a slight reduction in fileCount (from 18 to 17) and unpackedSize (from 64430 to 53088 bytes) in version 3.4.1. This suggests potential code optimization or removal of redundant assets, possibly leading to faster installation times and potentially smaller bundle sizes for users.
Developers already using workbox-webpack-plugin will benefit from upgrading to version 3.4.1, ensuring they are leveraging the latest improvements and bug fixes within the Workbox ecosystem. Projects deploying PWA and aiming for the best performance should consider upgrading to benefit from this subtle optimization. The update maintain the same peer dependency of webpack versions ^2.0.0 || ^3.0.0 || ^4.0.0.
All the vulnerabilities related to the version 3.4.1 of the package
hoek subject to prototype pollution via the clone function.
hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the proto key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1.
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
