Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency @rspack/cli to v1 #75

Merged
merged 1 commit into from
Jan 7, 2025
Merged

chore(deps): update dependency @rspack/cli to v1 #75

merged 1 commit into from
Jan 7, 2025

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 21, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@rspack/cli (source) ^0.3.6 -> ^1.1.8 age adoption passing confidence

Release Notes

web-infra-dev/rspack (@​rspack/cli)

v1.1.8

Security Vulnerability Report

Overview

This is a re-release version of v1.1.6

On 12/19/2024, 02:01 (UTC), we discovered that our npm packages @rspack/core and @rspack/cli were maliciously attacked. The attacker released v1.1.7 using a compromised npm token, which contained malicious code. We took immediate action upon discovering the issue.

Impact

  • Affected versions: @rspack/core and @rspack/cli v1.1.7
  • Duration: 12/19/2024, 02:01 (UTC), lasting approximately 1 hour
  • Malicious code impact: After npm install, the postinstall script in package.json runs malicious code in dist/util/support.js. See Malicious code analysis for more details.

Actions Taken

Upon discovery, we immediately deprecated the affected v1.1.7, redirected the npm latest tag to v1.1.6, and reset all related tokens.
Subsequently, we released a secure new version v1.1.8.

Recommended Actions

If you installed v1.1.7 during the affected period, please:

  1. Update to the latest safe version immediately: @rspack/core and @rspack/cli to >= 1.1.8
  2. Check your system for any unusual activity

Apology and Commitment

We deeply apologize for the risks caused by this incident. To prevent similar incidents from happening again, we will implement stricter token management protocols and enhance our security review processes.

If you have any questions or discover any suspicious activity, please create an issue or send an email to: web-infra-security@bytedance.com

We will continue to follow and respond to community feedback.

v1.1.6

Compare Source

What's Changed

Highlights 💡

Reduced memory usage

Rspack's memory usage in large projects has been significantly reduced since v1.1.6:

Related PRs:

Performance Improvements ⚡
Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rspack@v1.1.5...v1.1.6

v1.1.5

Compare Source

What's Changed

Highlights 💡

refactor css loading

Since #​7306, we have aligned with webpack's CSS loading strategy, which assumed that CSS finished loading before executing JavaScript, which is not true. Both Rspack and webpack have changed the CSS loading strategy to address this issue.

For more specific details on the original problem, please refer to this link.
Webpack fixed this in https://github.com/webpack/webpack/pull/19021
Rspack fixed this in #​8534

Performance Improvements ⚡
Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖
Other Changes

Full Changelog: web-infra-dev/rspack@v1.1.4...v1.1.5

v1.1.4

Compare Source

What's Changed

Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rspack@v1.1.3...v1.1.4

v1.1.3

Compare Source

What's Changed

Performance Improvements ⚡
Exciting New Features 🎉
Bug Fixes 🐞
Other Changes

Full Changelog: web-infra-dev/rspack@v1.1.2...v1.1.3

v1.1.2

Compare Source

What's Changed

💡 Highlights

DefinePlugin destructuring optimization

Rspack v1.1.2 improved the output of DefinePlugin by eliminating unused object properties from the final bundle, resulting in a smaller output size:

Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rspack@v1.1.1...v1.1.2

v1.1.1

Compare Source

💡 Highlights

Support for DllPlugin

This release introduced rspack.DllPlugin and rspack.DllReferencePlugin in #​8296 to be compatible with webpack's DLLPlugin and DllReferencePlugin.

DLL plugins help you improve build performance by separating rarely-changed code (like vendor dependencies) into separate bundles. The term "DLL" stands for Dynamic-link library. See here for more information.

What's Changed

Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖
Other Changes

Full Changelog: web-infra-dev/rspack@v1.1.0...v1.1.1

v1.1.0

Compare Source

See Announcing Rspack 1.1 for more details.

What's Changed

Performance Improvements ⚡
Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖

Configuration

📅 Schedule: Branch creation - "after 10:00 before 19:00 every weekday except after 13:00 before 14:00" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from prisis as a code owner December 21, 2024 20:42
@renovate renovate bot added the c: dependencies Pull requests that adds/updates a dependency label Dec 21, 2024
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 21, 2024 •
edited
Loading

Thank you for following the naming conventions! 🙏

@socket-security Socket Security
Copy link

socket-security bot commented Dec 21, 2024 •
edited
Loading

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher

View full report↗︎

@pkg-pr-new pkg.pr.new
Copy link

pkg-pr-new bot commented Dec 21, 2024 •
edited
Loading

Open in Stackblitz

More templates

npm i https://pkg.pr.new/anolilab/unplugin-favicons/@anolilab/unplugin-favicons@75

commit: 9af2af3

@renovate renovate bot force-pushed the renovate/major-1-rspack-monorepo branch from 15ba765 to f609de3 Compare January 7, 2025 13:20
@renovate
chore(deps): update dependency @rspack/cli to v1
9af2af3 
BREAKING CHANGE: updated dependencies to major versions
@renovate renovate bot force-pushed the renovate/major-1-rspack-monorepo branch from 70825e1 to 9af2af3 Compare January 7, 2025 13:30
@prisis prisis merged commit da6b8bf into main Jan 7, 2025
19 of 20 checks passed
@prisis prisis deleted the renovate/major-1-rspack-monorepo branch January 7, 2025 13:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@prisis prisis prisis approved these changes

Assignees
No one assigned
Labels
c: dependencies Pull requests that adds/updates a dependency
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@prisis