Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)
v2.2.2
Fix: Properties with the name __proto__ are added to objects and arrays.
(#199) This also fixes a prototype pollution vulnerability reported by
Jonathan Gregson! (#295).
v2.2.1
Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)
v2.2.0
New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)
Fix: Properties with the name __proto__ are added to objects and arrays.
(#199) This also fixes a prototype pollution vulnerability reported by
Jonathan Gregson! (#295).
remove the --prefetch option in favor the PrefetchPlugin plugin
remove the --node-env option in favor --define-process-env-node-env
remove the --hot option in favor of directly using the HotModuleReplacement plugin (only for build command, for serve it will work)
the behavior logic of the --entry option has been changed - previously it replaced your entries, now the option adds a specified entry, if you want to return the previous behavior please use webpack --entry-reset --entry './src/my-entry.js'
remove the --prefetch option in favor the PrefetchPlugin plugin
remove the --node-env option in favor --define-process-env-node-env
remove the --hot option in favor of directly using the HotModuleReplacement plugin (only for build command, for serve it will work)
the behavior logic of the --entry option has been changed - previously it replaced your entries, now the option adds a specified entry, if you want to return the previous behavior please use webpack --entry-reset --entry './src/my-entry.js'
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/kulti/task-list/network/alerts).
Bumps json5 to 2.2.3 and updates ancestor dependencies json5, ts-loader and webpack-cli. These dependencies need to be updated together.
Updates
json5from 2.1.3 to 2.2.3Release notes
Sourced from json5's releases.
Changelog
Sourced from json5's changelog.
Commits
c3a75242.2.394fd06ddocs: update CHANGELOG for v2.2.33b8cebfdocs(security): use GitHub security advisoriesf0fd9e1docs: publish a security policy6a91a05docs(template): bug -> bug report14f8cb12.2.210cc7cadocs: update CHANGELOG for v2.2.27774c10fix: add proto to objects and arraysedde30aReadme: slight tweak to intro97286f8Improve example in readmeUpdates
ts-loaderfrom 7.0.5 to 9.4.2Release notes
Sourced from ts-loader's releases.
... (truncated)
Changelog
Sourced from ts-loader's changelog.
... (truncated)
Commits
5e7220bUse custom transformer when building solution references (#1550)87a9fffadd missing comma in README.md (#1551)620ee79Typescript 4 9 (#1547)3319b91chore(deps): bump minimatch in /examples/project-references-example (#1530)60e5784Fix anchor jumping in README.md (#1521)5c66d2bUpdate outdated LICENSE year (#1513)64a4136Bump terser from 4.8.0 to 4.8.1 in /examples/project-references-example (#1489)cf1d227Bump lodash in /test/execution-tests/babel-codeSplitting (#1435)e76abb0Add Tests and Remarks Concerning the New.ctsAnd.mtsFile Extensions (#...d9fcbfdHotfix: Disableenhanced-resolve(#1506)Updates
webpack-clifrom 3.3.12 to 5.0.1Release notes
Sourced from webpack-cli's releases.
... (truncated)
Changelog
Sourced from webpack-cli's changelog.
... (truncated)
Commits
4a0f893chore(release): publish new version9de982cchore: fix cspell32d26c8chore(deps-dev): bump cspell from 6.15.1 to 6.16.0 (#3517)2788bf9chore(deps-dev): bump eslint from 8.28.0 to 8.29.0 (#3516)ac88ee4chore(deps-dev): bump lint-staged from 13.0.4 to 13.1.0 (#3515)346a518fix: make define-process-env-node-env alias node-env (#3514)3ec7b16chore(deps): bump yeoman-environment from 3.12.1 to 3.13.0 (#3508)c8adfa6chore(deps-dev): bump@types/nodefrom 18.11.9 to 18.11.10 (#3513)0ad8cc2chore(deps-dev): bump cspell from 6.15.0 to 6.15.1 (#3512)d30f261chore(deps-dev): bump ts-loader from 9.4.1 to 9.4.2 (#3511)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/kulti/task-list/network/alerts).