webpack
Safeguard articles tagged "webpack" — guides, analysis, and best practices for software supply chain and application security.
18 articles
@angular-builders/custom-webpack: Extending Angular Builds Without Ejecting
The @angular-builders/custom-webpack package lets you merge custom webpack config into Angular CLI builds. Here is how it works and how to use it without adding risk.
babel-loader: Keeping Your Babel Toolchain Lean and Patched
The babel-loader npm package bridges webpack and Babel in millions of builds. Here's how to configure it for speed, keep the toolchain patched, and know when you no longer need it.
webpack-dev-middleware Security: The CVE-2024-29180 Path Traversal Fix
webpack-dev-middleware serves your bundle in development, but CVE-2024-29180 let a crafted URL read any file off a developer's machine. Here is the fix.
Webpack 5 Node Polyfills: node-polyfill-webpack-plugin Explained
node-polyfill-webpack-plugin restores the Node core shims webpack 5 removed. Before you install it, understand what you are re-adding to your bundle and why webpack removed it.
webpack-cli: What It Does and How to Keep It Secure
webpack-cli is the command-line front end to webpack, and as a build-time dependency it deserves the same supply-chain scrutiny as your runtime packages.
fork-ts-checker-webpack-plugin: A Security-Minded Guide
The fork-ts-checker-webpack-plugin speeds up TypeScript builds by moving type checking off the main thread, and treating it as a build-time dependency has real security implications.
Is workbox-webpack-plugin Safe? A Security Guide
workbox-webpack-plugin generates service workers for your PWA at build time. Here is what its security profile looks like and how to keep the caching layer it creates from becoming a liability.
CVE-2022-37601: Prototype Pollution in loader-utils Explained
CVE-2022-37601 is a prototype pollution flaw in the webpack loader-utils package. Here is what it affects, how it works, and how to remediate it.
dotenv-webpack: How to Keep Secrets Out of Your Bundle
dotenv-webpack loads .env values into a webpack build, but it inlines them into client code at compile time, so anything you reference ships to the browser in plaintext.
Webpack Latest Version: Why Staying Current Is a Security Move
The webpack latest version sits in the 5.x line and updates frequently. Here is how to check which version you run, why staying current matters for security, and how to upgrade safely.
copy-webpack-plugin and terser-webpack-plugin: Build Pipeline Hygiene
The copy-webpack-plugin npm package and terser-webpack-plugin sit in almost every webpack build. Here's how to configure both without leaking files or shipping stale minifiers.
webpack-bundle-analyzer: Find Bloat and Risky Dependencies in Your Bundle
webpack bundle analyzer turns your build output into a zoomable treemap. Used well, it finds not just bloat but duplicated packages, surprise transitive dependencies, and code you never meant to ship.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.