Security vulnerability via transitive dependency on `serialize-javascript` via `rollup-plugin-terser`

[jagthedrummer]

I've started to see vulnerability reports on a number of projects that all look like this: https://github.com/bullet-train-co/bullet_train-core/security/dependabot/557

The issue arises because microbundle depends on the deprecated rollup-plugin-terser package which has its dependency on serialize-javascript declared with ^4.0.0.

Updating microbundle to @rollup/plugin-terser should fix the dependency chain, but I don't know if it would introduce other issues.

[rschristian]

Your link 404's, but like most "vulnerabilities" in build tooling, it's likely they're completely non-applicable for users. They tend to only be relevant if you're running untrusted user data through it on (say) a web server.

That being said, Microbundle is no longer maintained so it's unlikely those audit warnings will go away.

[jagthedrummer]

Oops, sorry, didn't realize that link was protected. But thanks for the info about microbundle being unmaintained. We'll look for an alternative.