webpack-bundle-analyzer - unnecessary dependency?

[apptio-mkrawczynsk]

Hi, we have a vurnerability problem with webpack-bundle-analyzer. Is it necessary to keep this package as a dependency for @docusaurus/[email protected]?

[slorber]

We have a docusaurus build --bundle-analyzer option and removing it is a breaking change that I'm willing to consider for v4.

Now if there's a vulnerability, please link to it. We can't remove the option immediately, but upgrading the dependency to fix the vulnerability should be possible.

[apptio-mkrawczynsk]

There is a problem with one of the webpack-bundle-analyzer dependency - ws "^7.3.1":
https://security.snyk.io/vuln/SNYK-JS-WS-7266574
Also there is no new version of webpack-bundle-analyzer so probably the only thing you could do currently is to add "ws" resolution

[slorber]

"ws": "^7.3.1" allows 7.5.10 which is not vulnerable so you should be able to use this new version of ws without resolution.