tree ea8cf0c8c7ae39e6539960270dbdfb4a86e13a37
parent 0a2cbd67103a4750e9262802d138fd64e4c265d2
author Gunnar Mills <gmills@us.ibm.com> 1546982051 -0600
committer Gunnar Mills <gmills@us.ibm.com> 1546983745 -0600

Address webpack-dev-server security vulnerability

Although we only use webpack-dev-server for development and
this isn't a security vulnerability for us, still going to fix.

From GitHub:

"We found a potential security vulnerability in one of your
dependencies.

Remediation
Upgrade webpack-dev-server to version 3.1.11 or later."

"An issue was discovered in lib/Server.js in webpack-dev-server
before 3.1.11. Attackers are able to steal developer's code because
the origin of requests is not checked by the WebSocket server,
which is used for HMR (Hot Module Replacement). Anyone can receive
the HMR message sent by the WebSocket server via a
ws://127.0.0.1:8080/ connection from any origin."

More information can be found at:
https://nvd.nist.gov/vuln/detail/CVE-2018-14732

Edited webpack-dev-server in package.json to be 3.1.11 then
did a npm install to create the package-lock.json.

Tested: Launched the dev server and pointed it at a Witherspoon.
Change-Id: Id6615ce387db8c6e1d2b64ff1e059db9167e11d0
Signed-off-by: Gunnar Mills <gmills@us.ibm.com>