This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
#### Changes included in this PR
- Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json
#### Vulnerabilities that will be fixed
##### With an upgrade:
Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity
:-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------
 | **661/1000** **Why?** Recently disclosed, Has a fix available, CVSS 7.5 | Prototype Pollution [SNYK-JS-LOADERUTILS-3043105](https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105) | Yes | No Known Exploit
(*) Note that the real score may have changed since the PR was raised.
Commit messagesPackage name: css-loader
The new version differs by 250 commits.
13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project.
------------
**Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.*
For more information:
🧐 [View latest project report](https://app.snyk.io/org/nesukun-github-marketplace/project/a10f0f6a-368a-4af8-8c3e-6d5ace279d23?utm_source=github&utm_medium=referral&page=fix-pr)
🛠 [Adjust project settings](https://app.snyk.io/org/nesukun-github-marketplace/project/a10f0f6a-368a-4af8-8c3e-6d5ace279d23?utm_source=github&utm_medium=referral&page=fix-pr/settings)
📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities)
[//]: # (snyk:metadata:{"prId":"59336c45-884f-4194-b33a-7efba1b1c75a","prPublicId":"59336c45-884f-4194-b33a-7efba1b1c75a","dependencies":[{"name":"babel-loader","from":"6.4.1","to":"8.2.4"},{"name":"css-loader","from":"0.26.4","to":"4.0.0"},{"name":"file-loader","from":"0.9.0","to":"6.0.0"},{"name":"html-loader","from":"0.4.5","to":"1.0.0"},{"name":"html-webpack-plugin","from":"2.29.0","to":"5.0.0"},{"name":"postcss-loader","from":"1.3.3","to":"4.0.0"},{"name":"sass-loader","from":"4.1.1","to":"9.0.0"},{"name":"string-replace-loader","from":"1.3.0","to":"3.0.0"},{"name":"style-loader","from":"0.13.2","to":"1.1.4"},{"name":"webpack","from":"2.6.1","to":"5.0.0"}],"packageManager":"npm","projectPublicId":"a10f0f6a-368a-4af8-8c3e-6d5ace279d23","projectUrl":"https://app.snyk.io/org/nesukun-github-marketplace/project/a10f0f6a-368a-4af8-8c3e-6d5ace279d23?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-LOADERUTILS-3043105"],"upgrade":["SNYK-JS-LOADERUTILS-3043105"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[661]})
---
**Learn how to fix vulnerabilities with free interactive lessons:**
🦉 [Prototype Pollution](https://learn.snyk.io/lessons/prototype-pollution/javascript//?loc=fix-pr)
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------  | **661/1000****Why?** Recently disclosed, Has a fix available, CVSS 7.5 | Prototype Pollution
[SNYK-JS-LOADERUTILS-3043105](https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105) | Yes | No Known Exploit (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: css-loader
The new version differs by 250 commits.- 7857d8f chore(release): 4.0.0
- 5604205 feat: support `file:` protocol
- 5303db2 chore(deps): update (#1131)
- 9aa0549 chore(deps): update
- a54c955 test: imports
- 5b45d87 test: support in `@ import` at-rule
- 83515fa refactor: code
- 1c20b1e fix: parsing
- 7f49a0a feat: `@ value` supports importing `url()` (#1126)
- 791fff3 refactor: named export (#1125)
- 01e8c76 refactor: change function arguments of the `import` option (#1124)
- c153fe6 refactor: improve schema options (#1123)
- 58b4b98 test: unresolved (#1122)
- d2f6bd2 refactor: getLocalIdent function (#1121)
- 069dbb0 refactor: the `modules.localsConvention` option was renamed to the `modules.exportLocalsConvention` option (#1120)
- fc04401 refactor: the `modules.context` option was renamed to the `modules.localIdentContext` option (#1119)
- 3a96a3d refactor: the `hashPrefix` option was renamed to the `localIdentHashPrefix` option (#1118)
- 0080f88 refactor: default values `modules` and `module.auto` are true (#1117)
- e1c55e4 refactor: rename the `onlyLocals` option (#1116)
- ac5f413 refactor: code
- a5c1b5f test: code coverange (#1114)
- 908ecee refactor: `esModule` option is `true` by default (#1111)
- 7cca035 test: coverange (#1112)
- bc19ddd feat: improve `url()` resolving algorithm
See the full diffPackage name: file-loader
The new version differs by 125 commits.- e44eb73 chore(release): 6.0.0
- ad39022 chore(deps): update (#369)
- e1fe27c docs: update README.md (#368)
- c2aded7 chore(release): 5.1.0
- cd8698b feat: support the `query` template for the `name` option (#366)
- 5703c58 chore(deps): update (#365)
- 521bff2 chore: remove duplicate prettier config file (#357)
- 5ffac2e refactor: added description on esModule (#358)
- 190829e docs: fix the description of the `esModule` option (#348)
- f1b071c chore(release): 5.0.2
- 6431101 chore: add the `funding` field in `package.json` (#347)
- 90302cd chore(release): 5.0.1
- 31d6589 fix: name of `esModule` option in source code (#346)
- 2a18cba chore(release): 5.0.0
- 98a6c1d refactor: next (#345)
- 0df6c8d chore(release): 4.3.0
- a2f5faf refactor: code (#344)
- 9b9cd8d feat: new options flag to output ES2015 modules (#340)
- ba0fd4c chore(release): 4.2.0
- 642ee74 docs: improve readme (#341)
- c136f44 feat: `postTransformPublicPath` option (#334)
- d441daa chore(release): 4.1.0
- 705eed4 feat: improved validation error messages (#339)
- d016daa chore(release): 4.0.0
See the full diffPackage name: html-loader
The new version differs by 93 commits.- d7cccfa chore(release): 1.0.0
- 3c9a1d8 refactor: `attributes` option (#265)
- 8c73761 feat: `preprocessor` option (#263)
- f2ce5b1 feat: improve errors
- 9923244 chore(deps): update (#260)
- 9835bde feat: supports `link:href` attribute for css (#258)
- 7af2eff refactor: improve schema (#257)
- 98412f9 docs: `filter` sources (#256)
- ff0f44c feat: implement the `filter` option for filtering some of sources (#255)
- 1c24662 refactor: move the `root` option under the `attributes` option (#254)
- 888b8fe docs: add footnote for `-attributes` (#252)
- 3d2907e refactor: remove the `interpolate` option
- bd979e2 refactor: remove the `interpolate` option
- fcba4ec fix: handle only valid srcset tags (#253)
- 9e5ce56 perf: improve source parse (#251)
- c9c8dad refactor: improve source parse (#250)
- 079d623 fix: respect `#hash` in sources
- a17df49 fix: reduce `import`/`require` count
- d0b0150 fix: adding quotes when necessary for unquoted sources (#247)
- e3727ab test: minifier
- 0bbe29c feat: migrate on `htmlparse2`
- b7af031 fix: escape `\u2028` and `\u2029` characters (#244)
- 24b0427 fix: parser tags and attributes according spec (#243)
- 3df909d feat: support `script:src` attributes
See the full diffPackage name: html-webpack-plugin
The new version differs by 250 commits.- 74fae99 chore(release): 5.0.0
- 94a20df chore: update to webpack 5.20.0
- c5c8212 feat: add meta attribute for html tags
- d0ab774 feat: provide public path to the alterAssetTagGroups hook
- 5200ae6 feat: provide public path to the alterAssetTags hook
- ccbe93a chore: update examples to latest webpack version
- 33cbd59 fix: generate html files even if no webpack entry exists
- 826739f feat: allow to use the latest loader-utils and tapable version
- 81d7b2c feat: add typings for options and version
- 8d34b81 fix: use correct casing for webpack type import
- 36f9aca chore: upgrade dev dependencies
- 1755962 chore: fix css-loader for unit testing
- a79ab17 chore: drop support for appcache-webpack-plugin as it is not compatible to webpack 5
- 7c3146d feat: allow to set publicPath to empty string ’’
- b109213 docs: update installation instructions for webpack 4
- 833b46b fix: inject javascripts in the <head> tag for inject:true and scriptLoading:'defer'
- 13af0fb feat: add full support for public paths inside templates
- fd5fe58 refactor: move the publicPath generation into a seperate function
- 60a6ef8 test: add test for experiments: { outputModule: true }
- a43ab72 feat: overrule module output
- 10a0c5e fix: adjust tests as webpack 5 will no longer emit files for builds with errors
- 2975a6a feat: process html during the processAssets stage PROCESS_ASSETS_STAGE_OPTIMIZE_INLINE
- 0f9c239 fix: add support for publicPath: 'auto' in combination with type: 'asset/resource'
- ab8b195 fix: support loaders like raw-loader
See the full diffPackage name: postcss-loader
The new version differs by 143 commits.- 792e217 chore(release): 4.0.0
- 598f36d docs: improve readme
- cad6f07 fix: avoid mutations of options and config (#470)
- 77449e1 test: union (#469)
- 9b75888 feat: reuse AST from other loaders (#468)
- 5e4a77b fix: resolve `from` and `to` from config and options (#467)
- 225b2e5 refactor: do not validate `postcss` options (#466)
- 3d32c35 fix: `default` export for plugins (#465)
- 38ebe08 refactor: `execute` option (#464)
- d0ea725 refactor: config loading
- 108d871 test: more
- b4d3bcc chore: remove unnecessary dev deps (#460)
- 475278c chore: move `postcss` to `peerDependencies` (#459)
- 98441ff fix: respect the `map` option and source maps (#458)
- ba88040 refactor: do not pass meta from other loaders (#457)
- 25a16a0 refactor: source map code
- 677c2fe refactor: removed `inline` value for the `sourceMap` option (#454)
- d8d84f7 refactor: code (#453)
- 3cd85df refactor: code
- 6eb44ed refactor: code
- 53da71a refactor: sourcemap paths
- d7bc470 feat: array syntax for plugins
- 2cd7614 refactor: code (#451)
- 60e4f12 docs: addDependency (#448)
See the full diffPackage name: sass-loader
The new version differs by 228 commits.- 45bd865 chore(release): 9.0.0
- 0629915 refactor: code before release
- c11478d test: ambiguous imports (#855)
- 73009fd docs: yarn pnp + using `dart-sass` by default (#854)
- d487683 feat: pass the loader context to custom importers under `this.webpackLoaderContext` property (#853)
- b3ffd5b test: resolution logic (#852)
- 3abe3f5 fix: resolution logic
- 20b7a11 docs: fix link for prependData (#847)
- 006c02e refactor: code
- 2a18d5b ci: node@14 (#842)
- 17832fd fix: resolution for `file` scheme
- 744112d fix: perf (#840)
- aeb86f0 fix: resolution logic (#839)
- 7380b7b fix: resolution logic (#838)
- 0c8d3b3 feat: support `process.cwd()` resolution (#837)
- 8376179 feat: support SASS-PATH env variable (#836)
- ddeff88 test: refactor (#835)
- 24c852a docs: options table (#834)
- f892eba refactor: code (#833)
- 68dd278 fix: avoid different content on different os (#832)
- 1655baf fix: resolution logic (#831)
- fe3b33b fix: resolution logic (#830)
- 41e0e45 test: foundation-sites (#829)
- a3dec34 chore: minimum supported Nodejs version is `10.13` (#828)
See the full diffPackage name: string-replace-loader
The new version differs by 22 commits.- a028ea6 release 3.0.0; fixes for webpack v5 & deps upgrade
- d3a799d Merge pull request #62 from martinoppitz/feature/update-deps
- 760b747 Merge branch 'master' into feature/update-deps
- 339a96e Merge pull request #61 from martinoppitz/feature/webpack-v5
- 167388a chore: update deps without webpack v5 / prevent conflict
- 8b9cc36 chore: add webpack v5 support
- 4d79a1b package-lock.json ignored
- 33f683f version 2.3.0; support for RegExp search option
- 002a0ae Merge pull request #52 from Va1/develop
- 6f2dcef v2.0.0
- b014594 support for function replacement w/ tests
- c200a9f Merge pull request #41 from balping/master
- 37b60c9 deps versions updated
- 1d52c82 npm audit fix
- cf6772d replacement callbacks
- bb1fd01 version 2.1.1; readme updated
- a6555e1 version 2.1.0; webpack 4 support; webpack 4 only enforced for testing
- 9a9dc4e version 2.0.0; readme update
- a5321d0 node v4+ rewrite; options validation
- 4783923 Merge pull request #39 from hydra1983/master
- af0e3bb Fixes #38: Unexpected output with webpack2
- 17244d8 version 1.3.0
See the full diffPackage name: style-loader
The new version differs by 165 commits.- 171a747 chore(release): 1.1.4
- af1b4a9 chore(deps): update
- a003f05 docs: add links for the options table (#460)
- 2756e03 chore(release): 1.1.3
- 236b243 fix: injection algorithm (#456)
- 36bd8f1 docs: fix typos (#453)
- de38c39 chore(release): 1.1.2
- 91ceaf2 fix: algorithm for importing modules (#449)
- 1138ed7 fix: checking that the list of modules is an array (#448)
- aa418dd chore(release): 1.1.1
- 7ee8b04 fix: add empty default export for `linkTag` value
- c69ea6c chore(release): 1.1.0
- c7d6e3a fix: order of imported styles (#443)
- a283b30 test: more manual test (#442)
- 3415266 feat: `esModule` option (#441)
- 907aed8 test: refactor (#440)
- 28e1628 refactor: code (#438)
- 5c51b90 refactor: cjs (#437)
- 609263a test: refactor
- 7768fce chore(release): 1.0.2
- dcbfadb fix: support ES module syntax (#435)
- d515edc chore(deps): update (#434)
- 4c1e3f3 docs: fixed typo 'doom' to 'DOM' in README.md (#432)
- c6164d5 chore(release): 1.0.1
See the full diffPackage name: webpack
The new version differs by 250 commits.- 610f368 5.0.0
- 5ce65c1 update examples
- bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
- 75ecff2 5.0.0-rc.6
- bfc35d6 Merge pull request #11603 from MayaWolf/master
- 76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
- 9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
- 36bcfaa Merge pull request #11621 from webpack/bugfix/11619
- 9130d10 fix called variables with ProvidePlugin
- 3e42105 Merge pull request #11620 from webpack/bugfix/11617
- 4709719 skip connections copied to concatenated module
- 57b493f 5.0.0-rc.5
- 1658e2f Merge pull request #11618 from webpack/bugfix/11615
- a8fb45d fixes crash in SideEffectsFlagPlugin
- 84b196d emit error instead of crashing when unexpected problem occurs
- 5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
- 9b5cce9 Merge pull request #11609 from snitin315/export-types
- 37c495c export type RuleSetUseItem
- 39faf34 export type RuleSetUse
- e5fd246 export type RuleSetConditionAbsolute
- 660baad export RuleSetCondition types
- 13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
- 9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
- 502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4
See the full diff