Skip to content

[Snyk] Security upgrade parcel from 1.12.4 to 2.0.0#3306

Open
prodsecmachine wants to merge 1 commit intomasterfrom
snyk-fix-0cbc775a1299bdd01edd30029cdb3c25
Open

[Snyk] Security upgrade parcel from 1.12.4 to 2.0.0#3306
prodsecmachine wants to merge 1 commit intomasterfrom
snyk-fix-0cbc775a1299bdd01edd30029cdb3c25

Conversation

@prodsecmachine
Copy link

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • package.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AJV-15274295
  803  

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-15274295
@prodsecmachine
Copy link
Author

Merge Risk: High

The upgrade from Parcel v1 to v2 is a major rewrite with significant breaking changes that require developer action and configuration updates. It is not a simple drop-in replacement.

Key Breaking Changes:

  • Package Name: The npm package has been renamed from parcel-bundler to parcel. You must update your package.json dependencies.
  • Configuration & Plugins: Parcel 2 introduces an entirely new, extensible plugin system and a .parcelrc configuration file. Any custom configurations or plugins from v1 are not compatible and must be migrated.
  • Transpilation Is No Longer Default: Parcel 1 transpiled modern JavaScript by default. Parcel 2 does not. You must define your supported browsers in a browserslist field in your package.json to enable transpilation.
  • HTML Script Handling: To align with browser standards, JavaScript files referenced via <script> tags are no longer treated as modules by default. You must use <script type="module"> to enable ES module support.
  • Asset Imports: Importing non-code assets like ZIP files from JavaScript now requires using the new URL('file.zip', import.meta.url) constructor syntax.
  • Cache Directory: The cache folder has been renamed from .cache to .parcel-cache, requiring an update to your .gitignore file.

Recommendation: This is a major migration effort. Developers must follow the official migration guide to update package names, configuration files, and potentially application code related to asset imports and script tags. Thorough testing is required.

Source: Official Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@prodsecmachine prodsecmachine requested a review from a team as a code owner February 14, 2026 18:54
@github-actions
Copy link

A documentation preview will be available soon.

Request a new doc build by commenting
  • Rebuild this PR: run docs-build
  • Rebuild this PR and all Elastic docs: run docs-build rebuild

run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.

If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants