fix(bundler-plugins): Integration with monorepo build#21479
Conversation
Update the bundler-plugins so that integration tests run in CI, and the module follows the same patterns as the rest of sentry-javascript.
|
If CI passes, this can be landed after the |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d665aad. Configure here.
![semgrep-code-getsentry[bot]](https://avatars.githubusercontent.com/in/1153895?s=60&v=4){kind=small}
| resolved "https://registry.yarnpkg.com/webpack-virtual-modules/-/webpack-virtual-modules-0.6.2.tgz#057faa9065c8acf48f24cb57ac0e77739ab9a7e8" | ||
| integrity sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ== | ||
|
|
||
| webpack@5.76.0: |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 30753 lists a dependency (webpack) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of webpack are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). webpack's AutoPublicPathRuntimeModule emits runtime code that derives the asset public path from document.currentScript. Because document.currentScript can be DOM-clobbered by an injected scriptless element (e.g. ), an attacker who can inject markup into the page can redirect dynamic chunk/asset loading to an attacker-controlled origin, resulting in cross-site scripting (XSS).
To resolve this comment:
Check if you build with output.publicPath unset.
- If you're affected, upgrade this dependency to at least version 5.94.0 at yarn.lock.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
size-limit report 📦
|
1 participant
Update the bundler-plugins so that integration tests run in CI, and the module follows the same patterns as the rest of sentry-javascript.