fix(js): update @swc/cli version to fix vulnerability (#30575)

The `@swc/cli` version we're currently using has a security
vulnerability due to dependency on `cross-spawn`. This PR updates it to
the version that fixes the vulnerability.

Advisory: https://github.com/advisories/GHSA-3xgq-45jj-v275


## Current Behavior
Existing and new JS workspaces have a high security warning.

## Expected Behavior
No high security warning for new workspaces, and existing ones are
updated.

## Related Issue(s)
<!-- Please link the issue being fixed so it gets closed when this is
merged. -->

Fixes #
This commit is contained in:
Jack Hsu 2025-04-02 09:51:36 -04:00 committed by GitHub
parent 962aa7606a
commit 538fd8cbf6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
8 changed files with 543 additions and 469 deletions

View File

@ -2624,6 +2624,16 @@
}
},
"migrations": {
"/nx-api/js/migrations/20.7.1-beta.0-package-updates": {
"description": "",
"file": "generated/packages/js/migrations/20.7.1-beta.0-package-updates.json",
"hidden": false,
"name": "20.7.1-beta.0-package-updates",
"version": "20.7.1-beta.0",
"originalFilePath": "/packages/js",
"path": "/nx-api/js/migrations/20.7.1-beta.0-package-updates",
"type": "migration"
},
"/nx-api/js/migrations/20.5.0-package-updates": {
"description": "",
"file": "generated/packages/js/migrations/20.5.0-package-updates.json",

View File

@ -2606,6 +2606,16 @@
}
],
"migrations": [
{
"description": "",
"file": "generated/packages/js/migrations/20.7.1-beta.0-package-updates.json",
"hidden": false,
"name": "20.7.1-beta.0-package-updates",
"version": "20.7.1-beta.0",
"originalFilePath": "/packages/js",
"path": "js/migrations/20.7.1-beta.0-package-updates",
"type": "migration"
},
{
"description": "",
"file": "generated/packages/js/migrations/20.5.0-package-updates.json",

View File

@ -0,0 +1,14 @@
{
"name": "20.7.1-beta.0-package-updates",
"version": "20.7.1-beta.0",
"packages": {
"@swc/cli": { "version": "~0.6.0", "alwaysAddToPackageJson": false }
},
"aliases": [],
"description": "",
"hidden": false,
"implementation": "",
"path": "/packages/js",
"schema": null,
"type": "migration"
}

View File

@ -29,9 +29,7 @@ describe('js:swc executor', () => {
const libPackageJson = readJson(`libs/${lib}/package.json`);
expect(libPackageJson.scripts).toBeUndefined();
expect(runCLI(`build ${lib}`)).toContain(
'Successfully compiled: 2 files with swc'
);
expect(() => runCLI(`build ${lib}`)).not.toThrow();
checkFilesExist(
`dist/libs/${lib}/package.json`,
`dist/libs/${lib}/src/index.js`,

View File

@ -121,7 +121,7 @@
"@svgr/rollup": "^8.1.0",
"@svgr/webpack": "^8.0.1",
"@swc-node/register": "1.9.1",
"@swc/cli": "0.3.12",
"@swc/cli": "0.6.0",
"@swc/core": "1.5.7",
"@swc/helpers": "0.5.11",
"@swc/jest": "0.2.36",

View File

@ -146,6 +146,15 @@
"alwaysAddToPackageJson": false
}
}
},
"20.7.1-beta.0": {
"version": "20.7.1-beta.0",
"packages": {
"@swc/cli": {
"version": "~0.6.0",
"alwaysAddToPackageJson": false
}
}
}
}
}

View File

@ -2,7 +2,7 @@ export const nxVersion = require('../../package.json').version;
export const esbuildVersion = '^0.19.2';
export const prettierVersion = '^2.6.2';
export const swcCliVersion = '~0.3.12';
export const swcCliVersion = '~0.6.0';
export const swcCoreVersion = '~1.5.7';
export const swcHelpersVersion = '~0.5.11';
export const swcNodeVersion = '~1.9.1';

961
pnpm-lock.yaml generated

File diff suppressed because it is too large Load Diff