This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
#### Changes included in this PR
- Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
#### Vulnerabilities that will be fixed
##### With an upgrade:
Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity
:-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------
 | **661/1000** **Why?** Recently disclosed, Has a fix available, CVSS 7.5 | Prototype Pollution [SNYK-JS-LOADERUTILS-3043105](https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105) | Yes | No Known Exploit
(*) Note that the real score may have changed since the PR was raised.
Commit messagesPackage name: css-loader
The new version differs by 231 commits.
f29a170 fix(init): fix the invalid package name (#1228)
8c3a66d chore(cli): updated changelog of v3 (#1224)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project.
------------
**Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.*
For more information:
🧐 [View latest project report](https://app.snyk.io/org/jontey/project/aa1a24e6-7394-4bcd-b524-dfe7686753ce?utm_source=github&utm_medium=referral&page=fix-pr)
🛠 [Adjust project settings](https://app.snyk.io/org/jontey/project/aa1a24e6-7394-4bcd-b524-dfe7686753ce?utm_source=github&utm_medium=referral&page=fix-pr/settings)
📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities)
[//]: # (snyk:metadata:{"prId":"7e2d5d57-0196-4e7b-8515-e5c41e790c2c","prPublicId":"7e2d5d57-0196-4e7b-8515-e5c41e790c2c","dependencies":[{"name":"babel-loader","from":"7.1.5","to":"8.2.4"},{"name":"css-loader","from":"1.0.1","to":"4.0.0"},{"name":"file-loader","from":"2.0.0","to":"6.0.0"},{"name":"html-loader","from":"0.5.5","to":"1.0.0"},{"name":"html-webpack-plugin","from":"4.5.2","to":"5.0.0"},{"name":"sass-loader","from":"7.3.1","to":"9.0.0"},{"name":"webpack","from":"4.46.0","to":"5.0.0"},{"name":"webpack-cli","from":"3.3.12","to":"4.0.0"}],"packageManager":"npm","projectPublicId":"aa1a24e6-7394-4bcd-b524-dfe7686753ce","projectUrl":"https://app.snyk.io/org/jontey/project/aa1a24e6-7394-4bcd-b524-dfe7686753ce?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-LOADERUTILS-3043105"],"upgrade":["SNYK-JS-LOADERUTILS-3043105"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[661]})
---
**Learn how to fix vulnerabilities with free interactive lessons:**
🦉 [Prototype Pollution](https://learn.snyk.io/lessons/prototype-pollution/javascript//?loc=fix-pr)
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------  | **661/1000****Why?** Recently disclosed, Has a fix available, CVSS 7.5 | Prototype Pollution
[SNYK-JS-LOADERUTILS-3043105](https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105) | Yes | No Known Exploit (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: css-loader
The new version differs by 231 commits.- 7857d8f chore(release): 4.0.0
- 5604205 feat: support `file:` protocol
- 5303db2 chore(deps): update (#1131)
- 9aa0549 chore(deps): update
- a54c955 test: imports
- 5b45d87 test: support in `@ import` at-rule
- 83515fa refactor: code
- 1c20b1e fix: parsing
- 7f49a0a feat: `@ value` supports importing `url()` (#1126)
- 791fff3 refactor: named export (#1125)
- 01e8c76 refactor: change function arguments of the `import` option (#1124)
- c153fe6 refactor: improve schema options (#1123)
- 58b4b98 test: unresolved (#1122)
- d2f6bd2 refactor: getLocalIdent function (#1121)
- 069dbb0 refactor: the `modules.localsConvention` option was renamed to the `modules.exportLocalsConvention` option (#1120)
- fc04401 refactor: the `modules.context` option was renamed to the `modules.localIdentContext` option (#1119)
- 3a96a3d refactor: the `hashPrefix` option was renamed to the `localIdentHashPrefix` option (#1118)
- 0080f88 refactor: default values `modules` and `module.auto` are true (#1117)
- e1c55e4 refactor: rename the `onlyLocals` option (#1116)
- ac5f413 refactor: code
- a5c1b5f test: code coverange (#1114)
- 908ecee refactor: `esModule` option is `true` by default (#1111)
- 7cca035 test: coverange (#1112)
- bc19ddd feat: improve `url()` resolving algorithm
See the full diffPackage name: file-loader
The new version differs by 42 commits.- e44eb73 chore(release): 6.0.0
- ad39022 chore(deps): update (#369)
- e1fe27c docs: update README.md (#368)
- c2aded7 chore(release): 5.1.0
- cd8698b feat: support the `query` template for the `name` option (#366)
- 5703c58 chore(deps): update (#365)
- 521bff2 chore: remove duplicate prettier config file (#357)
- 5ffac2e refactor: added description on esModule (#358)
- 190829e docs: fix the description of the `esModule` option (#348)
- f1b071c chore(release): 5.0.2
- 6431101 chore: add the `funding` field in `package.json` (#347)
- 90302cd chore(release): 5.0.1
- 31d6589 fix: name of `esModule` option in source code (#346)
- 2a18cba chore(release): 5.0.0
- 98a6c1d refactor: next (#345)
- 0df6c8d chore(release): 4.3.0
- a2f5faf refactor: code (#344)
- 9b9cd8d feat: new options flag to output ES2015 modules (#340)
- ba0fd4c chore(release): 4.2.0
- 642ee74 docs: improve readme (#341)
- c136f44 feat: `postTransformPublicPath` option (#334)
- d441daa chore(release): 4.1.0
- 705eed4 feat: improved validation error messages (#339)
- d016daa chore(release): 4.0.0
See the full diffPackage name: html-loader
The new version differs by 55 commits.- d7cccfa chore(release): 1.0.0
- 3c9a1d8 refactor: `attributes` option (#265)
- 8c73761 feat: `preprocessor` option (#263)
- f2ce5b1 feat: improve errors
- 9923244 chore(deps): update (#260)
- 9835bde feat: supports `link:href` attribute for css (#258)
- 7af2eff refactor: improve schema (#257)
- 98412f9 docs: `filter` sources (#256)
- ff0f44c feat: implement the `filter` option for filtering some of sources (#255)
- 1c24662 refactor: move the `root` option under the `attributes` option (#254)
- 888b8fe docs: add footnote for `-attributes` (#252)
- 3d2907e refactor: remove the `interpolate` option
- bd979e2 refactor: remove the `interpolate` option
- fcba4ec fix: handle only valid srcset tags (#253)
- 9e5ce56 perf: improve source parse (#251)
- c9c8dad refactor: improve source parse (#250)
- 079d623 fix: respect `#hash` in sources
- a17df49 fix: reduce `import`/`require` count
- d0b0150 fix: adding quotes when necessary for unquoted sources (#247)
- e3727ab test: minifier
- 0bbe29c feat: migrate on `htmlparse2`
- b7af031 fix: escape `\u2028` and `\u2029` characters (#244)
- 24b0427 fix: parser tags and attributes according spec (#243)
- 3df909d feat: support `script:src` attributes
See the full diffPackage name: html-webpack-plugin
The new version differs by 59 commits.- 74fae99 chore(release): 5.0.0
- 94a20df chore: update to webpack 5.20.0
- c5c8212 feat: add meta attribute for html tags
- d0ab774 feat: provide public path to the alterAssetTagGroups hook
- 5200ae6 feat: provide public path to the alterAssetTags hook
- ccbe93a chore: update examples to latest webpack version
- 33cbd59 fix: generate html files even if no webpack entry exists
- 826739f feat: allow to use the latest loader-utils and tapable version
- 81d7b2c feat: add typings for options and version
- 8d34b81 fix: use correct casing for webpack type import
- 36f9aca chore: upgrade dev dependencies
- 1755962 chore: fix css-loader for unit testing
- a79ab17 chore: drop support for appcache-webpack-plugin as it is not compatible to webpack 5
- 7c3146d feat: allow to set publicPath to empty string ’’
- b109213 docs: update installation instructions for webpack 4
- 833b46b fix: inject javascripts in the <head> tag for inject:true and scriptLoading:'defer'
- 13af0fb feat: add full support for public paths inside templates
- fd5fe58 refactor: move the publicPath generation into a seperate function
- 60a6ef8 test: add test for experiments: { outputModule: true }
- a43ab72 feat: overrule module output
- 10a0c5e fix: adjust tests as webpack 5 will no longer emit files for builds with errors
- 2975a6a feat: process html during the processAssets stage PROCESS_ASSETS_STAGE_OPTIMIZE_INLINE
- 0f9c239 fix: add support for publicPath: 'auto' in combination with type: 'asset/resource'
- ab8b195 fix: support loaders like raw-loader
See the full diffPackage name: sass-loader
The new version differs by 49 commits.- 45bd865 chore(release): 9.0.0
- 0629915 refactor: code before release
- c11478d test: ambiguous imports (#855)
- 73009fd docs: yarn pnp + using `dart-sass` by default (#854)
- d487683 feat: pass the loader context to custom importers under `this.webpackLoaderContext` property (#853)
- b3ffd5b test: resolution logic (#852)
- 3abe3f5 fix: resolution logic
- 20b7a11 docs: fix link for prependData (#847)
- 006c02e refactor: code
- 2a18d5b ci: node@14 (#842)
- 17832fd fix: resolution for `file` scheme
- 744112d fix: perf (#840)
- aeb86f0 fix: resolution logic (#839)
- 7380b7b fix: resolution logic (#838)
- 0c8d3b3 feat: support `process.cwd()` resolution (#837)
- 8376179 feat: support SASS-PATH env variable (#836)
- ddeff88 test: refactor (#835)
- 24c852a docs: options table (#834)
- f892eba refactor: code (#833)
- 68dd278 fix: avoid different content on different os (#832)
- 1655baf fix: resolution logic (#831)
- fe3b33b fix: resolution logic (#830)
- 41e0e45 test: foundation-sites (#829)
- a3dec34 chore: minimum supported Nodejs version is `10.13` (#828)
See the full diffPackage name: webpack
The new version differs by 250 commits.- 610f368 5.0.0
- 5ce65c1 update examples
- bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
- 75ecff2 5.0.0-rc.6
- bfc35d6 Merge pull request #11603 from MayaWolf/master
- 76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
- 9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
- 36bcfaa Merge pull request #11621 from webpack/bugfix/11619
- 9130d10 fix called variables with ProvidePlugin
- 3e42105 Merge pull request #11620 from webpack/bugfix/11617
- 4709719 skip connections copied to concatenated module
- 57b493f 5.0.0-rc.5
- 1658e2f Merge pull request #11618 from webpack/bugfix/11615
- a8fb45d fixes crash in SideEffectsFlagPlugin
- 84b196d emit error instead of crashing when unexpected problem occurs
- 5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
- 9b5cce9 Merge pull request #11609 from snitin315/export-types
- 37c495c export type RuleSetUseItem
- 39faf34 export type RuleSetUse
- e5fd246 export type RuleSetConditionAbsolute
- 660baad export RuleSetCondition types
- 13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
- 9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
- 502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4
See the full diffPackage name: webpack-cli
The new version differs by 250 commits.- fb50f76 chore(release): publish new version
- 2c75aeb chore: new version of the packages
- 0d05c30 chore(release): publish %s
- 3f9e151 chore: fix lerna config
- 2c1e34c tests(generator): enhance init generator tests (#1236)
- 6ee61b9 Fix loader-generator and plugin-generator tests (#1250)
- 52956a2 Fixing the typos and grammatical errors in Readme files (#1246)
- 7faaed2 chore: update Bug_report & Feature_request Templates (#1256)
- 7a5b33d feat(webpack-cli): added mode argument (#1253)
- 3715756 tests(webpack-cli): add test case for defaults flag (#1254)
- a7cba2f chore: project maintanance and typescript fix (#1247)
- 7748472 chore: ignore package-lock.json and remove its references (#1252)
- a014aa7 docs: fix supported arguments & commands link in README (#1244)
- 06129a1 feat(webpack-cli): add progress bar for progress flag (#1238)
- 6cc6a49 chore: post refactor CLI (#1237)
- 358651e chore: move cli under lerna package (#1225)
- 2dc495a fix(init): fix webpack config scaffold (#1231)
- 1ab62d2 tests(generator): add tests for plugin generator (#1235)
- d2dd0c1 tests(sourcemap): fix flaky stats statement (#1232)
- f6dc680 tests(loader-generator): add tests for loader generator (#1234)
- 35d1381 tests(generator): enable init generator test (#1233)
- 66cdcb6 chore(generator): remove transpiled tests (#1229)
- f29a170 fix(init): fix the invalid package name (#1228)
- 8c3a66d chore(cli): updated changelog of v3 (#1224)
See the full diff