[Snyk] Fix for 5 vulnerabilities

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
713/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.4	Prototype Pollution SNYK-JS-JSON5-3182856	Yes	Proof of Concept
671/1000 Why? Recently disclosed, Has a fix available, CVSS 7.7	Improper Input Validation SNYK-JS-JSONWEBTOKEN-3180020	Yes	No Known Exploit
611/1000 Why? Recently disclosed, Has a fix available, CVSS 6.5	Improper Authentication SNYK-JS-JSONWEBTOKEN-3180022	Yes	No Known Exploit
611/1000 Why? Recently disclosed, Has a fix available, CVSS 6.5	Improper Restriction of Security Token Assignment SNYK-JS-JSONWEBTOKEN-3180024	Yes	No Known Exploit
526/1000 Why? Recently disclosed, Has a fix available, CVSS 4.8	Use of a Broken or Risky Cryptographic Algorithm SNYK-JS-JSONWEBTOKEN-3180026	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: css-loader

The new version differs by 235 commits.

7857d8f chore(release): 4.0.0
5604205 feat: support `file:` protocol
5303db2 chore(deps): update (#1131)
9aa0549 chore(deps): update
a54c955 test: imports
5b45d87 test: support in `@ import` at-rule
83515fa refactor: code
1c20b1e fix: parsing
7f49a0a feat: `@ value` supports importing `url()` (#1126)
791fff3 refactor: named export (#1125)
01e8c76 refactor: change function arguments of the `import` option (#1124)
c153fe6 refactor: improve schema options (#1123)
58b4b98 test: unresolved (#1122)
d2f6bd2 refactor: getLocalIdent function (#1121)
069dbb0 refactor: the `modules.localsConvention` option was renamed to the `modules.exportLocalsConvention` option (#1120)
fc04401 refactor: the `modules.context` option was renamed to the `modules.localIdentContext` option (#1119)
3a96a3d refactor: the `hashPrefix` option was renamed to the `localIdentHashPrefix` option (#1118)
0080f88 refactor: default values `modules` and `module.auto` are true (#1117)
e1c55e4 refactor: rename the `onlyLocals` option (#1116)
ac5f413 refactor: code
a5c1b5f test: code coverange (#1114)
908ecee refactor: `esModule` option is `true` by default (#1111)
7cca035 test: coverange (#1112)
bc19ddd feat: improve `url()` resolving algorithm

See the full diff

Package name: express-jwt

The new version differs by 97 commits.

c69a0e4 update changelog
2157954 8.0.0
d8ffa02 upgrade jsonwebtoken to v9
c555b48 Merge pull request #306 from auth0/SRE-57-Upload-opslevel-yaml
172d07c 7.7.7
f79b001 7.7.6
076b3dc remove types for express-unless and update it. closes #307
0c87c3a Upload OpsLevel YAML
f0e41d6 Fix misspelled word in readme
45ba2e0 7.7.5
139aa05 update express-unless
2f99e2d 7.7.4
2242f01 update express-unless
eb50853 update changelog
c30feb4 7.7.3
c583fdd Merge branch 'ItzRabbs-master'
9ccf0cf Remove esModuleInterop and fix assert import in tests
e1fe1d2 Fix tsc build error for express-unless
7c1fb33 7.7.2
6c87fe4 fix instaceof comparison for UnauthorizedError. closes #292
b1344fa update changelog
c5f00ea 7.7.1
7a02ca7 fix readme and package-lock
f3f5af5 build(deps): required runtime types

See the full diff

Package name: html-webpack-plugin

The new version differs by 250 commits.

74fae99 chore(release): 5.0.0
94a20df chore: update to webpack 5.20.0
c5c8212 feat: add meta attribute for html tags
d0ab774 feat: provide public path to the alterAssetTagGroups hook
5200ae6 feat: provide public path to the alterAssetTags hook
ccbe93a chore: update examples to latest webpack version
33cbd59 fix: generate html files even if no webpack entry exists
826739f feat: allow to use the latest loader-utils and tapable version
81d7b2c feat: add typings for options and version
8d34b81 fix: use correct casing for webpack type import
36f9aca chore: upgrade dev dependencies
1755962 chore: fix css-loader for unit testing
a79ab17 chore: drop support for appcache-webpack-plugin as it is not compatible to webpack 5
7c3146d feat: allow to set publicPath to empty string ’’
b109213 docs: update installation instructions for webpack 4
833b46b fix: inject javascripts in the <head> tag for inject:true and scriptLoading:'defer'
13af0fb feat: add full support for public paths inside templates
fd5fe58 refactor: move the publicPath generation into a seperate function
60a6ef8 test: add test for experiments: { outputModule: true }
a43ab72 feat: overrule module output
10a0c5e fix: adjust tests as webpack 5 will no longer emit files for builds with errors
2975a6a feat: process html during the processAssets stage PROCESS_ASSETS_STAGE_OPTIMIZE_INLINE
0f9c239 fix: add support for publicPath: 'auto' in combination with type: 'asset/resource'
ab8b195 fix: support loaders like raw-loader

See the full diff

Package name: jsonwebtoken

The new version differs by 55 commits.

e1fa9dc Merge pull request from GHSA-8cf7-32gw-wr33
5eaedbf chore(ci): remove github test actions job (#861)
cd4163e chore(ci): configure Github Actions jobs for Tests & Security Scanning (#856)
ecdf6cc fix!: Prevent accidental use of insecure key sizes & misconfiguration of secrets (#852)
8345030 fix(sign&verify)!: Remove default `none` support from `sign` and `verify` methods, and require it to be explicitly configured (#851)
7e6a86b Upload OpsLevel YAML (#849)
74d5719 docs: update references vercel/ms references (#770)
d71e383 docs: document "invalid token" error
3765003 docs: fix spelling in README.md: Peak -> Peek (#754)
a46097e docs: make decode impossible to discover before verify
15a1bc4 refactor: make decode non-enumerable
5f10bf9 docs: add jwtid to options of jwt.verify (#704)
88cb9df Replace tilde-indexOf with includes (#647)
a6235fa Adds not to README on decoded payload validation (#646)
5ed1f06 docs: fix tiny style change in readme (#622)
9fb90ca style: add missing semicolon (#641)
a9e38b8 ci: use circleci (#589)
7f1f8b4 8.5.1
e5874ae fix: ensure correct PS signing and verification (#585)
84e03ef README: fix markdown for algorithms table
1c0de55 8.5.0
eefb9d9 feat: add PS JWA support for applicable node versions (#573)
8737789 Add complete option in jwt.verify (#522)
7b60c12 Force use_strict during testing (#577)

See the full diff

Package name: mini-css-extract-plugin

The new version differs by 87 commits.

315bbac chore(release): 1.0.0
2a3b4a8 refactor: next
b935f26 chore(release): 0.12.0
bc0ca2c test: improve (#601)
5fafdf8 feat opt-in to transitive only side effects (webpack@5) (#599)
ef4bd79 test: empty chunk
0494230 chore(release): 0.11.3
6e09a51 fix: better support for webpack 5 (#595)
bb09d75 chore(release): 0.11.2
e4ddf29 test: cache (#588)
6a27b30 fix: cache for webpack@5
1565706 chore(release): 0.11.1
3a61586 test: cache (#583)
d09693e feat: added cache serializer for webpack@5 (#581)
84933cc refactor: code
265fc59 fix: broken release
4220c4f chore(release): 0.11.0
41e9eb7 refactor: code (#576)
1ea4b7f feat: named export
ff4bfbe fix: compatibility with webpack@5
ca8c327 chore: update deps
21832c7 fix: compatibility with webpack@5 (#571)
25b0ecd test: add some es-modules concatenation cases (#566)
e6e07bb build(deps-dev): bump standard-version from 7.1.0 to 8.0.1 (#547)

See the full diff

Package name: postcss-loader

The new version differs by 39 commits.

792e217 chore(release): 4.0.0
598f36d docs: improve readme
cad6f07 fix: avoid mutations of options and config (#470)
77449e1 test: union (#469)
9b75888 feat: reuse AST from other loaders (#468)
5e4a77b fix: resolve `from` and `to` from config and options (#467)
225b2e5 refactor: do not validate `postcss` options (#466)
3d32c35 fix: `default` export for plugins (#465)
38ebe08 refactor: `execute` option (#464)
d0ea725 refactor: config loading
108d871 test: more
b4d3bcc chore: remove unnecessary dev deps (#460)
475278c chore: move `postcss` to `peerDependencies` (#459)
98441ff fix: respect the `map` option and source maps (#458)
ba88040 refactor: do not pass meta from other loaders (#457)
25a16a0 refactor: source map code
677c2fe refactor: removed `inline` value for the `sourceMap` option (#454)
d8d84f7 refactor: code (#453)
3cd85df refactor: code
6eb44ed refactor: code
53da71a refactor: sourcemap paths
d7bc470 feat: array syntax for plugins
2cd7614 refactor: code (#451)
60e4f12 docs: addDependency (#448)

See the full diff

Package name: sass-loader

The new version differs by 98 commits.

45bd865 chore(release): 9.0.0
0629915 refactor: code before release
c11478d test: ambiguous imports (#855)
73009fd docs: yarn pnp + using `dart-sass` by default (#854)
d487683 feat: pass the loader context to custom importers under `this.webpackLoaderContext` property (#853)
b3ffd5b test: resolution logic (#852)
3abe3f5 fix: resolution logic
20b7a11 docs: fix link for prependData (#847)
006c02e refactor: code
2a18d5b ci: node@14 (#842)
17832fd fix: resolution for `file` scheme
744112d fix: perf (#840)
aeb86f0 fix: resolution logic (#839)
7380b7b fix: resolution logic (#838)
0c8d3b3 feat: support `process.cwd()` resolution (#837)
8376179 feat: support SASS-PATH env variable (#836)
ddeff88 test: refactor (#835)
24c852a docs: options table (#834)
f892eba refactor: code (#833)
68dd278 fix: avoid different content on different os (#832)
1655baf fix: resolution logic (#831)
fe3b33b fix: resolution logic (#830)
41e0e45 test: foundation-sites (#829)
a3dec34 chore: minimum supported Nodejs version is `10.13` (#828)

See the full diff

Package name: webpack

The new version differs by 250 commits.

610f368 5.0.0
5ce65c1 update examples
bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
75ecff2 5.0.0-rc.6
bfc35d6 Merge pull request #11603 from MayaWolf/master
76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
36bcfaa Merge pull request #11621 from webpack/bugfix/11619
9130d10 fix called variables with ProvidePlugin
3e42105 Merge pull request #11620 from webpack/bugfix/11617
4709719 skip connections copied to concatenated module
57b493f 5.0.0-rc.5
1658e2f Merge pull request #11618 from webpack/bugfix/11615
a8fb45d fixes crash in SideEffectsFlagPlugin
84b196d emit error instead of crashing when unexpected problem occurs
5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
9b5cce9 Merge pull request #11609 from snitin315/export-types
37c495c export type RuleSetUseItem
39faf34 export type RuleSetUse
e5fd246 export type RuleSetConditionAbsolute
660baad export RuleSetCondition types
13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4