search

tcoopman / image-webpack-loader

Image loader module for webpack
MIT License
2.03k stars 132 forks source link

Bump imagemin-webp from 6.0.0 to 7.0.0 #412

Closed dependabot[bot] closed 2 years ago

dependabot[bot] commented 2 years ago

Bumps imagemin-webp from 6.0.0 to 7.0.0.

Release notes

Sourced from imagemin-webp's releases.

v7.0.0

  • Use native ESM bcdf27d
  • Use GitHub Actions instead (#34) 3835836
  • Update code example (#28) 59dce34
  • Bump cwebp-bin 90977fe

https://github.com/imagemin/imagemin-webp/compare/v6.0.0...v7.0.0

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
yob commented 2 years ago

This would be a great bump to land in a release.

I know it's not a significant issue in practice, but imagemin-webp v6.x (via cwebp-bin) is responsible for pulling a whole tree of unmaintained 7+ year old packages into our dependency tree. Like https://www.npmjs.com/package/logalot, https://www.npmjs.com/package/squeak (v1.0.0), https://www.npmjs.com/package/meow (v3.3.0) and https://www.npmjs.com/package/trim-newlines (v1.0.0)

dianekaplan commented 2 years ago

Yes we've been hitting this same issue too! This change will clear a High vulnerability and would be a huge help.

adamstankiewicz commented 2 years ago

@yob @dianekaplan I opened #413 which also bumps imagemin-webp from v6 to v7, as does this PR, but it also begins using import instead of require since the package's output is now using ESM.

CI hasn't been approved to run on my PR, but it does pass locally where it was failing in the CI 🤞

dependabot[bot] commented 2 years ago

Looks like imagemin-webp is up-to-date now, so this is no longer needed.