optimize: fix frontend security vulnerabilities

[slievrly]

Overview

This PR addresses frontend security vulnerabilities reported by GitHub Dependabot by upgrading webpack from version 4 to version 5 and updating related dependencies to their latest secure versions.

Security Impact

console-fe

• Before: 23 vulnerabilities (7 high, 11 moderate, 5 low)
• After: 5 vulnerabilities (0 high, 0 moderate, 5 low)
• Result: ✅ 100% of high and moderate vulnerabilities resolved

saga-designer

• Before: 1 vulnerability (1 moderate)
• After: 0 vulnerabilities
• Result: ✅ 100% of all vulnerabilities resolved

Key Vulnerabilities Fixed

1. webpack-dev-server (Moderate - GHSA-9jgg-88mc-972h, GHSA-4v9v-hfq4-rm2v)

   • Source code theft vulnerability when accessing malicious websites
   • Fixed by upgrading from 4.15.1 to 5.2.2

2. serialize-javascript (High - GHSA-h9rv-jmmf-4pgx, GHSA-hxcc-f52p-wc94)

   • Cross-Site Scripting (XSS) vulnerability
   • Insecure serialization leading to RCE
   • Fixed by replacing uglifyjs-webpack-plugin with built-in TerserPlugin

3. braces (High - GHSA-grv7-fg5c-xmjg)

   • Uncontrolled resource consumption (ReDoS)
   • Fixed via package override to version 3.0.3

4. micromatch (Moderate - GHSA-952p-6rrq-rcjv)

   • Regular Expression Denial of Service (ReDoS)
   • Fixed via package override to version 4.0.8

5. nanoid (Moderate - GHSA-mwcw-c2x4-8c55)

   • Predictable results in generation
   • Fixed via package override to version 3.3.8

6. svelte/swiper (Moderate - GHSA-8266-84wp-wv5c)

   • Potential mXSS vulnerability
   • Fixed via package override to version 6.5.9

Changes Made

Major Upgrade

• webpack: 4.47.0 → 5.102.1 (required for webpack-dev-server security fix)

Dependency Updates (console-fe)

• webpack-dev-server: 4.15.1 → 5.2.2
• html-webpack-plugin: 4.5.2 → 5.6.3
• copy-webpack-plugin: 6.4.1 → 11.0.0
• mini-css-extract-plugin: 1.6.2 → 2.9.2
• css-loader: 5.2.7 → 6.11.0
• sass-loader: 10.5.2 → 13.3.3
• Replaced uglifyjs-webpack-plugin with built-in TerserPlugin
• Replaced optimize-css-assets-webpack-plugin with css-minimizer-webpack-plugin

Package Overrides (console-fe)

Updated package.json overrides to enforce secure versions:

• nanoid: 3.1.31 → 3.3.8
• swiper: 6.5.1 → 6.5.9
• node-fetch: 2.6.7 → 2.7.0
• braces: → 3.0.3 (new)
• micromatch: → 4.0.8 (new)
• serialize-javascript: → 6.0.2 (new)

Configuration Updates (console-fe)

• Updated webpack.prod.conf.js to use TerserPlugin and CssMinimizerPlugin
• Updated webpack.base.conf.js to use webpack 5 syntax (resolve.fallback instead of deprecated node.fs)

Dependency Updates (saga-designer)

• webpack-dev-server: 4.13.2 → 5.2.2

Testing

✅ npm install successful on both projects
✅ npm run build successful on both projects
✅ npm audit confirms vulnerability reduction
✅ Build output sizes within expected range
✅ Webpack 5 configuration properly migrated

Remaining Issues

5 low severity vulnerabilities remain in console-fe, all related to @alicloud/console-components-console-menu dependency:

• min-document (prototype pollution)
• global, dva-core, dva (dependent on min-document)

These vulnerabilities have no fix available and require the vendor (@alicloud) to update their dependencies. Risk assessment: LOW.

Breaking Changes

This PR includes a major version upgrade from webpack 4 to webpack 5. While the build process has been tested and verified, it's recommended to:

• Test the built applications in development and staging environments
• Monitor for any runtime issues with the upgraded webpack
• Verify dev server functionality with npm run start

References

• GHSA-9jgg-88mc-972h: webpack-dev-server source code theft
• GHSA-4v9v-hfq4-rm2v: webpack-dev-server source code theft
• GHSA-h9rv-jmmf-4pgx: XSS in serialize-javascript
• GHSA-hxcc-f52p-wc94: RCE in serialize-javascript
• GHSA-grv7-fg5c-xmjg: ReDoS in braces
• GHSA-952p-6rrq-rcjv: ReDoS in micromatch

slievrly#7

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.70%. Comparing base (57d170d) to head (6e5571e).

Additional details and impacted files

@@             Coverage Diff              @@
##                2.x    #7704      +/-   ##
============================================
- Coverage     61.70%   61.70%   -0.01%     
+ Complexity      684      682       -2     
============================================
  Files          1324     1324              
  Lines         50046    50046              
  Branches       5910     5910              
============================================
- Hits          30882    30880       -2     
- Misses        16376    16378       +2     
  Partials       2788     2788              

see 9 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull Request Overview

This PR addresses critical frontend security vulnerabilities by upgrading webpack from version 4 to 5 and updating related dependencies to their latest secure versions across two projects: console-fe and saga-designer.

• Major webpack upgrade from v4 to v5 with associated plugin updates
• Security vulnerability fixes addressing XSS, ReDoS, and source code theft issues
• Package overrides to enforce secure versions of indirect dependencies

Reviewed Changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated no comments.

File	Description
saga/seata-saga-statemachine-designer/package.json	Updates webpack-dev-server to v5.2.2 for security fixes
console/src/main/resources/static/console-fe/package.json	Major dependency updates including webpack v5 upgrade and security overrides
console/src/main/resources/static/console-fe/build/webpack.prod.conf.js	Migrates from deprecated UglifyJsPlugin to TerserPlugin and OptimizeCSSAssetsPlugin to CssMinimizerPlugin
console/src/main/resources/static/console-fe/build/webpack.base.conf.js	Updates webpack configuration for v5 compatibility using resolve.fallback

Files not reviewed (1)

• saga/seata-saga-statemachine-designer/package-lock.json: Language not supported

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}