Workbox webpack plugin version 3.6.1 is a minor update to the 3.x series of this webpack plugin primarily designed to simplify the usage of Workbox within webpack builds. It helps generate a manifest of your local files that the workbox-sw library then uses to precache assets, making your web application more reliable and performant, especially in offline scenarios.
The key difference between versions 3.6.1 and the previous stable version 3.5.0 lies in the updated dependency on workbox-build. This likely introduces improvements, bug fixes, or new features within the underlying Workbox build tools that feed in to the plugin's functionality, particularly around service worker generation and asset precaching. Developers should investigate the workbox-build changelog for that version range to understand the specific changes.
While both versions share the same peer dependency requirement for webpack (versions 2, 3, or 4), a notable change is that the unpacked size of version 3.6.1 is smaller (53088 bytes) compared to version 3.5.0 (64430 bytes), indicating possible refinements to the plugin's internal structure or a reduction in included assets. The number of files included in the package also slightly decreased. These points suggest a leaner and potentially more efficient plugin.
For developers using this plugin, upgrading from 3.5.0 to 3.6.1 seems beneficial, promising refinements from workbox-build and a lighter package size, without breaking changes since there are no major version updates. Regularly updating ensures access to the latest improvements in service worker generation and asset management within webpack workflows that this plugin offers.
All the vulnerabilities related to the version 3.6.1 of the package
hoek subject to prototype pollution via the clone function.
hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the proto key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1.
Command Injection in lodash
lodash
versions prior to 4.17.21 are vulnerable to Command Injection via the template function.