search

pankajpatel / fontgen-loader

Forked from https://github.com/DragonsInn/fontgen-loader
5 stars 1 forks source link

Update dependency loader-utils to v3 [SECURITY] #9

Closed renovate[bot] closed 1 year ago

renovate[bot] commented 1 year ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
loader-utils ^0.2.10 -> ^3.0.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-37601

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.

Release Notes

webpack/loader-utils ### [`v3.2.1`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​321-httpsgithubcomwebpackloader-utilscomparev320v321-2022-11-11) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v3.2.0...v3.2.1) ### [`v3.2.0`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​320-httpsgithubcomwebpackloader-utilscomparev313v320-2021-11-11) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v3.1.3...v3.2.0) ##### Features - hash uniformity for base digests ([451858b](https://togithub.com/webpack/loader-utils/commit/451858b0bb33911d52d2f03a6470fd2b86493b84)) ##### [3.1.3](https://togithub.com/webpack/loader-utils/compare/v3.1.2...v3.1.3) (2021-11-04) ##### Bug Fixes - crash with md4 hash ([#​198](https://togithub.com/webpack/loader-utils/issues/198)) ([ef084d4](https://togithub.com/webpack/loader-utils/commit/ef084d43ba29ebf3c3c0ea0939a5c58adad0bba2)) ##### [3.1.2](https://togithub.com/webpack/loader-utils/compare/v3.1.1...v3.1.2) (2021-11-04) ##### Bug Fixes - bug with unicode characters ([#​196](https://togithub.com/webpack/loader-utils/issues/196)) ([0426405](https://togithub.com/webpack/loader-utils/commit/04264056f951514955af7302510631f942276eec)) ##### [3.1.1](https://togithub.com/webpack/loader-utils/compare/v3.1.0...v3.1.1) (2021-11-04) ##### Bug Fixes - base64 and unicode characters ([02b1f3f](https://togithub.com/webpack/loader-utils/commit/02b1f3fe6d718870b5ee7abc64519a1b2b5b8531)) ### [`v3.1.3`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​313-httpsgithubcomwebpackloader-utilscomparev312v313-2021-11-04) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v3.1.2...v3.1.3) ### [`v3.1.2`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​312-httpsgithubcomwebpackloader-utilscomparev311v312-2021-11-04) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v3.1.1...v3.1.2) ### [`v3.1.1`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​311-httpsgithubcomwebpackloader-utilscomparev310v311-2021-11-04) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v3.1.0...v3.1.1) ### [`v3.1.0`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​310-httpsgithubcomwebpackloader-utilscomparev300v310-2021-10-29) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v3.0.0...v3.1.0) ##### Features - added `md4` (wasm version) and `md4-native` (`crypto` module version) algorithms ([cbf9d1d](https://togithub.com/webpack/loader-utils/commit/cbf9d1dac866be50971d294c3baacda45527fb8e)) ### [`v3.0.0`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​300-httpsgithubcomwebpackloader-utilscomparev200v300-2021-10-20) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v2.0.4...v3.0.0) ##### ⚠ BREAKING CHANGES - minimum supported Node.js version is `12.13.0` ([93a87ce](https://togithub.com/webpack/loader-utils/commit/93a87cefd41cc69de0bc1f9099f7d753ed8cd557)) - use `xxhash64` by default for `[hash]`/`[contenthash]` and `getHashDigest` API - `[emoji]` was removed without replacements, please use custom function if you need this - removed `getOptions` in favor `loaderContext.getOptions` (`loaderContext` is `this` inside loader function), note - special query parameters like `?something=true` is not supported anymore, if you need this please do it on `loader` side, but we strongly recommend avoid it, as alternative you can use `?something=1` and handle `1` as `true` - removed `getRemainingRequest` in favor `loaderContext.remainingRequest` (`loaderContext` is `this` inside loader function) - removed `getCurrentRequest` in favor `loaderContext.currentRequest` (`loaderContext` is `this` inside loader function) - removed `parseString` in favor `JSON.parse` - removed `parseQuery` in favor `new URLSearchParams(loaderContext.resourceQuery.slice(1))` where `loaderContext` is `this` in loader function - removed `stringifyRequest` in favor `JSON.stringify(loaderContext.utils.contextify(loaderContext.context || loaderContext.rootContext, request))` (`loaderContext` is `this` inside loader function), also it will be cachable and faster - `isUrlRequest` ignores only absolute URLs and `#hash` requests, `data URI` and root relative request are handled as requestable due webpack v5 support them ##### Bug Fixes - allowed the `interpolateName` API works without options ([862ea7d](https://togithub.com/webpack/loader-utils/commit/862ea7d1d0226558f2750bec36da02492d1e516d)) ### [`v2.0.4`](https://togithub.com/webpack/loader-utils/releases/tag/v2.0.4) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v2.0.3...v2.0.4) ##### [2.0.4](https://togithub.com/webpack/loader-utils/compare/v2.0.3...v2.0.4) (2022-11-11) ##### Bug Fixes - ReDoS problem ([#​225](https://togithub.com/webpack/loader-utils/issues/225)) ([ac09944](https://togithub.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb)) ### [`v2.0.3`](https://togithub.com/webpack/loader-utils/releases/tag/v2.0.3) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v2.0.2...v2.0.3) ##### [2.0.3](https://togithub.com/webpack/loader-utils/compare/v2.0.1...v2.0.3) (2022-10-20) ##### Bug Fixes - **security:** prototype pollution exploit ([#​217](https://togithub.com/webpack/loader-utils/issues/217)) ([a93cf6f](https://togithub.com/webpack/loader-utils/commit/a93cf6f4702012030f6b5ee8340d5c95ec1c7d4c)) ### [`v2.0.2`](https://togithub.com/webpack/loader-utils/releases/tag/v2.0.2) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v2.0.1...v2.0.2) ##### [2.0.2](https://togithub.com/webpack/loader-utils/compare/v2.0.1...v2.0.2) (2021-11-04) ##### Bug Fixes - base64 generation and unicode characters ([#​197](https://togithub.com/webpack/loader-utils/issues/197)) ([8c2d24e](https://togithub.com/webpack/loader-utils/commit/8c2d24ee400bc4567335e97ee6004c3baa6ef66f)) ### [`v2.0.1`](https://togithub.com/webpack/loader-utils/releases/tag/v2.0.1) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v2.0.0...v2.0.1) ##### [2.0.1](https://togithub.com/webpack/loader-utils/compare/v2.0.0...v2.0.1) (2021-10-29) ##### Bug Fixes - md4 support on Node.js v17 ([#​193](https://togithub.com/webpack/loader-utils/issues/193)) ([1069f61](https://togithub.com/webpack/loader-utils/commit/1069f61284a571614ee4acdde6e6087174be118a)) ### [`v2.0.0`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​200-httpsgithubcomwebpackloader-utilscomparev140v200-2020-03-17) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.4.2...v2.0.0) ##### ⚠ BREAKING CHANGES - minimum required `Node.js` version is `8.9.0` ([#​166](https://togithub.com/webpack/loader-utils/issues/166)) ([c937e8c](https://togithub.com/webpack/loader-utils/commit/c937e8c77231b42018be616b784a6b45eac86f8a)) - the `getOptions` method returns empty object on empty query ([#​167](https://togithub.com/webpack/loader-utils/issues/167)) ([b595cfb](https://togithub.com/webpack/loader-utils/commit/b595cfba022d3f04f3d310dd570b0253e461605b)) - Use `md4` by default ### [`v1.4.2`](https://togithub.com/webpack/loader-utils/releases/tag/v1.4.2) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.4.1...v1.4.2) ##### [1.4.2](https://togithub.com/webpack/loader-utils/compare/v1.4.1...v1.4.2) (2022-11-11) ##### Bug Fixes - ReDoS problem ([#​226](https://togithub.com/webpack/loader-utils/issues/226)) ([17cbf8f](https://togithub.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa)) ### [`v1.4.1`](https://togithub.com/webpack/loader-utils/releases/tag/v1.4.1) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.4.0...v1.4.1) ##### [1.4.1](https://togithub.com/webpack/loader-utils/compare/v1.4.0...v1.4.1) (2022-11-07) ##### Bug Fixes - security problem ([#​220](https://togithub.com/webpack/loader-utils/issues/220)) ([4504e34](https://togithub.com/webpack/loader-utils/commit/4504e34c4796a5836ef70458327351675aed48a5)) ### [`v1.4.0`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​140-httpsgithubcomwebpackloader-utilscomparev130v140-2020-02-19) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.3.0...v1.4.0) ##### Features - the `resourceQuery` is passed to the `interpolateName` method ([#​163](https://togithub.com/webpack/loader-utils/issues/163)) ([cd0e428](https://togithub.com/webpack/loader-utils/commit/cd0e428)) ### [`v1.3.0`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​130-httpsgithubcomwebpackloader-utilscomparev123v130-2020-02-19) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.2.3...v1.3.0) ##### Features - support the `[query]` template for the `interpolatedName` method ([#​162](https://togithub.com/webpack/loader-utils/issues/162)) ([469eeba](https://togithub.com/webpack/loader-utils/commit/469eeba)) #### [1.2.3](https://togithub.com/webpack/loader-utils/compare/v1.2.2...v1.2.3) (2018-12-27) ##### Bug Fixes - **interpolateName:** don't interpolated `hashType` without `hash` or `contenthash` ([#​140](https://togithub.com/webpack/loader-utils/issues/140)) ([3528fd9](https://togithub.com/webpack/loader-utils/commit/3528fd9)) #### [1.2.2](https://togithub.com/webpack/loader-utils/compare/v1.2.1...v1.2.2) (2018-12-27) ##### Bug Fixes - fixed a hash type extracting in interpolateName ([#​137](https://togithub.com/webpack/loader-utils/issues/137)) ([f8a71f4](https://togithub.com/webpack/loader-utils/commit/f8a71f4)) #### [1.2.1](https://togithub.com/webpack/loader-utils/compare/v1.2.0...v1.2.1) (2018-12-25) ##### Bug Fixes - **isUrlRequest:** better handle absolute urls and non standards ([#​134](https://togithub.com/webpack/loader-utils/issues/134)) ([aca43da](https://togithub.com/webpack/loader-utils/commit/aca43da)) ##### Reverts - PR [#​79](https://togithub.com/webpack/loader-utils/issues/79) ([#​135](https://togithub.com/webpack/loader-utils/issues/135)) ([73d350a](https://togithub.com/webpack/loader-utils/commit/73d350a)) ### [`v1.2.3`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​123-httpsgithubcomwebpackloader-utilscomparev122v123-2018-12-27) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.2.2...v1.2.3) ##### Bug Fixes - **interpolateName:** don't interpolated `hashType` without `hash` or `contenthash` ([#​140](https://togithub.com/webpack/loader-utils/issues/140)) ([3528fd9](https://togithub.com/webpack/loader-utils/commit/3528fd9)) ### [`v1.2.2`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​122-httpsgithubcomwebpackloader-utilscomparev121v122-2018-12-27) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.2.1...v1.2.2) ##### Bug Fixes - fixed a hash type extracting in interpolateName ([#​137](https://togithub.com/webpack/loader-utils/issues/137)) ([f8a71f4](https://togithub.com/webpack/loader-utils/commit/f8a71f4)) ### [`v1.2.1`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​121-httpsgithubcomwebpackloader-utilscomparev120v121-2018-12-25) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.2.0...v1.2.1) ##### Bug Fixes - **isUrlRequest:** better handle absolute urls and non standards ([#​134](https://togithub.com/webpack/loader-utils/issues/134)) ([aca43da](https://togithub.com/webpack/loader-utils/commit/aca43da)) ##### Reverts - PR [#​79](https://togithub.com/webpack/loader-utils/issues/79) ([#​135](https://togithub.com/webpack/loader-utils/issues/135)) ([73d350a](https://togithub.com/webpack/loader-utils/commit/73d350a)) ### [`v1.2.0`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​120-httpsgithubcomwebpackloader-utilscomparev110v120-2018-12-24) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.1.0...v1.2.0) ##### Features - **interpolateName:** support `[contenthash]` ##### Fixes - **urlToRequest:** empty urls are not rewritten to relative requests - **urlToRequest:** don't rewrite absolute urls - **isUrlRequest:** ignore all url with `extension` (like `moz-extension:`, `ms-browser-extension:` and etc) - **isUrlRequest:** ignore `about:blank` - **interpolateName:** failing explicitly when ran out of emoji - **interpolateName:** `[hash]` token regex in interpolate string to capture any hash algorithm name - **interpolateName:** parse string for emoji count before use ### [`v1.1.0`](https://togithub.com/webpack/loader-utils/blob/HEAD/CHANGELOG.md#​110-httpsgithubcomwebpackloader-utilscomparev104v110-2017-03-16) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.0.4...v1.1.0) ##### Features - **automatic-release:** Generation of automatic release ([7484d13](https://togithub.com/webpack/loader-utils/commit/7484d13)) - **parseQuery:** export parseQuery ([ddf64e4](https://togithub.com/webpack/loader-utils/commit/ddf64e4)) ### [`v1.0.4`](https://togithub.com/webpack/loader-utils/releases/tag/v1.0.4) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.0.3...v1.0.4) - Change license back to "MIT" in `package.json` [https://github.com/webpack/loader-utils/pull/66#issuecomment-285430606](https://togithub.com/webpack/loader-utils/pull/66#issuecomment-285430606) ### [`v1.0.3`](https://togithub.com/webpack/loader-utils/releases/tag/v1.0.3) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.0.2...v1.0.3) - Fix issue in `interpolateName` with periods in folder names [#​71](https://togithub.com/webpack/loader-utils/pull/71) ### [`v1.0.2`](https://togithub.com/webpack/loader-utils/releases/tag/v1.0.2) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.0.1...v1.0.2) - Fix yarn install error [#​67](https://togithub.com/webpack/loader-utils/issues/67) ### [`v1.0.1`](https://togithub.com/webpack/loader-utils/releases/tag/v1.0.1) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v1.0.0...v1.0.1) - Fix `getOptions()` with unexpected queries [#​68](https://togithub.com/webpack/loader-utils/issues/68) ### [`v1.0.0`](https://togithub.com/webpack/loader-utils/releases/tag/v1.0.0) [Compare Source](https://togithub.com/webpack/loader-utils/compare/v0.2.17...v1.0.0) - **Breaking:** Replaced `parseQuery` with `getOptions` [https://github.com/webpack/loader-utils/pull/65](https://togithub.com/webpack/loader-utils/pull/65) - **Breaking:** Removed node 0.10 and 0.12 support [https://github.com/webpack/loader-utils/pull/63](https://togithub.com/webpack/loader-utils/pull/63)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.