dep: update compression-webpack-plugin

[vince-fugnitto]

What it does

The pull-request updates the use of @theia/compression-webpack-plugin (an outdated fork) to it's upstream counterpart, since the former included security vulnerabilities.

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Insecure serialization leading to RCE in                     │
│               │ serialize-javascript                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ serialize-javascript                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.1.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @theia/application-manager                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @theia/application-manager >                                 │
│               │ @theia/compression-webpack-plugin > serialize-javascript     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1004041                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Insecure serialization leading to RCE in                     │
│               │ serialize-javascript                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ serialize-javascript                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.1.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @theia/cli                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @theia/cli > @theia/application-manager >                    │
│               │ @theia/compression-webpack-plugin > serialize-javascript     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1004041                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

The cache is now a configuration option directly from webpack, and was removed as part of compression-webpack-plugin@7.0.0.

How to test

1. confirm that executing yarn audit --level=high does not yield results for compression-webpack-plugin
2. confirm that the build is successful, and the generated webpack configuration is correct (examples/browser/gen-webpack.config.js)
3. confirm that compression works examples/browser/lib/ should contain *.gz compressions such as bundle.js.gz
4. confirm with compression off the *.gz files are not present

Compression Off

Review checklist

• As an author, I have thoroughly tested my changes and carefully followed the review guidelines

Reminder for reviewers

• As a reviewer, I agree to behave in accordance with the review guidelines

Signed-off-by: vince-fugnitto vincent.fugnitto@ericsson.com

[msujew]

The dependency update looks good to me 👍

• The dependency does not appear in the audit list anymore.
• Files continue to be served using a compressed format. (content-encoding: gzip)
• No additional build/bundling issues, Theia runs normally.