Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 1 vulnerabilities #62

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #62

wants to merge 1 commit into from

Conversation

luxiaojian
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 551/1000
Why? Recently disclosed, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LOADERUTILS-3105943		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: babel-loader The new version differs by 131 commits.
  • 1a76476 7.0.0
  • 7307226 Point changelog to releases
  • 174cb10 Merge branch '7.0'
  • 2204871 Add prettier (#409)
  • dbec80d Make sure .babelrc is a file, not a directory (#427)
  • aa485e4 Use bash codecov (#440)
  • 16522b6 yarn.lock
  • 660922b Update ava to the latest version 🚀 (#434)
  • 5d248b5 Update cross-env to the latest version 🚀 (#431)
  • 74ff2e6 Updated documentation to match webpack v2 changes. (#438)
  • ed8711d Add note about webpack versions
  • a7342de 7.0.0-beta.1
  • fb8c271 Merge branch 'fix-options' into 7.0
  • 1ed7ff5 Merge branch 'master' into 7.0
  • e20f6b6 Changelog for 6.4.1 (#424)
  • 48325ea 6.4.1
  • 87e4e85 target node 4 in preset env (#423)
  • f3241f8 Fixed reset of BABEL_ENV when options.forceEnv is used (#420)
  • 05a31c5 7.0.0-alpha.3
  • ad77367 Ensure options are always an object (#413)
  • e8aa302 Ensure options are always an object
  • b9209e7 7.0.0-alpha.2
  • 3f51915 Update yarn.lock
  • c18b16a Fix merge conflict

See the full diff

Package name: css-loader The new version differs by 39 commits.
  • d7317ca chore(release): css-loader v0.26.2
  • 7732614 Merge pull request #428 from helloyou2012/master
  • f8cdaca fix deprecation warning (loader-utils)
  • 7c45e94 docs(readme): udpates for JSF maintainers
  • 199897f Fix Maintainer section look (#409)
  • 793390a Merge pull request #408 from d3viant0ne/d3viant0ne-TravisValidations
  • 2fd0c78 ci(Travis): updates Travis validations
  • e54549e Merge pull request #407 from christianvuerings/readme-minimize
  • 4bd7130 README - fix default for minimize
  • 9508990 Merge pull request #380 from michael-ciniawsky/readme
  • 08e9d47 Add `files` to `package.json`. (#388)
  • 5735e5d Implement feedback from other loader readme's
  • 851a22b Bump source-map-list to 0.1.7 (#383)
  • a38e254 Add license file
  • 5b856b2 0.26.1
  • 85a2156 docs(README): refactor for webpack v2
  • 46ebca3 expose getLocalIdent (#357)
  • 564f521 add issue templates
  • 9df4467 Update README.md
  • 9497d74 0.26.0
  • 2cd0cf7 update deps
  • 8cd1069 Make -loader suffix consistent in README.md (#375)
  • 008e6fd Disable Autoprefixer in cssnano (#361)
  • 22f6621 0.25.0

See the full diff

Package name: eslint-loader The new version differs by 35 commits.

See the full diff

Package name: extract-text-webpack-plugin The new version differs by 126 commits.
  • 5268d14 chore(release): 2.0.0
  • 518e54d Merge pull request #429 from helloyou2012/master
  • 16e7601 fix deprecation warning (close #427)
  • a078c82 Merge pull request #419 from webpack-contrib/d3viant0ne-JSFMaintainers
  • facb563 docs(readme): updates for JSF maintainers
  • b755a1f Merge pull request #414 from ShinyChang/patch-1
  • 28dca8a Update README.md
  • 261df23 Merge pull request #402 from webpack-contrib/remove-remove-and-do-dependency
  • 6d42658 Merge pull request #400 from GeorgeTaveras1231/patch-1
  • ad44d20 Merge pull request #411 from BorodinDemid/patch-1
  • 78d0947 Merge pull request #413 from scottdj92/master
  • 3d9f857 fix typo in readme
  • 7097a1d make extracting Sass/LESS more clear
  • 91befda Merge pull request #394 from pndewit/master
  • c307def Merge pull request #395 from billgo/patch-1
  • 61c5672 Update README.md
  • 002c887 Merge pull request #409 from simon04/patch-1
  • 52950f3 README: add install instructions for webpack 2
  • a768464 inline removeAndDo dep to webpack internal lib
  • 15dbccb Adhere to module schema in README
  • ca96b7b Update README.md
  • 9311650 docs - adds array type for options.use and options.fallback
  • e831507 2.0.0-rc.3
  • d279b25 Merge pull request #391 from bebraw/ignore-fix

See the full diff

Package name: file-loader The new version differs by 28 commits.

See the full diff

Package name: html-loader The new version differs by 60 commits.

See the full diff

Package name: html-webpack-plugin The new version differs by 250 commits.
  • eb73905 chore(release): 4.0.0
  • 42a6d4a Add typing for getHooks
  • a1a37cf Release html-webpack-plugin 4.0.0-beta.14
  • 97f9fb9 fix: load script files before style files files in defer script loading mode
  • e97ce17 Release html-webpack-plugin 4.0.0-beta.13
  • e448b5d Release html-webpack-plugin 4.0.0-beta.12
  • de315eb feat: Add defer script loading
  • 7df269f feat: Provide a verbose error message if html minification failed
  • 1d66e53 feat: merge templateParameters with default template parameters
  • dfb98e7 Fix typo in template option docts
  • 096a760 Fix broken links in examples
  • a195c34 docs: Update template-option documentation
  • 40b410e docs: Update example for template parameters
  • bf017f3 chore: Release 4.0.0-beta.11
  • 2549557 test: Don't use minification for speed measurement
  • de22fc2 test: Adjust measurment for node 6 on travis
  • 24bf1b5 fix: Update references to html-minifier
  • f4eafdc chore: Release 4.0.0-beta.10
  • a2ad30a refactor: Use getAssetPath instead of calling the hook directly
  • 2595a79 chore: Release 4.0.0-beta.9
  • c66766c feat: Add support for minifying inline ES6 inside html templates
  • 655cbcd Fix README typo
  • 6de319b update lodash dependency for prototype polution vulnerability
  • 35a1541 Properly encode file names emitted as part of URLs.

See the full diff

Package name: ngtemplate-loader The new version differs by 13 commits.

See the full diff

Package name: postcss-loader The new version differs by 143 commits.

See the full diff

Package name: sass-loader The new version differs by 115 commits.
  • 0b401a6 6.0.2
  • b362a00 Update CHANGELOG
  • 770722b Merge pull request #383 from jtangelder/update/dependencies
  • 47cead4 Update loader-utils
  • a0d58e8 Update dependencies
  • 42bfebb Merge pull request #381 from jtangelder/release/6.0.1
  • 08c4acf 6.0.1
  • 945ad1e Update CHANGELOG
  • ad816d1 Merge pull request #377 from jtangelder/fix/source-map
  • e0a9b39 Fix incorrect source maps in certain cwds
  • f8cc068 Merge pull request #376 from jtangelder/fix/name-inconsistency
  • e939cac Fix folder name inconsistency
  • 5fe4030 Merge pull request #375 from jtangelder/release/6.0.0
  • e29ab1d 6.0.0
  • 9a4dbda Update CHANGELOG
  • e5c25af Merge pull request #374 from jtangelder/refactor/source-map
  • ce198d1 Improve source map support
  • ca7c4a1 Merge pull request #370 from jtangelder/release/5.0.1
  • fcb26a6 5.0.1
  • 6cbc975 Update CHANGELOG
  • bc3f23a Merge pull request #369 from jtangelder/fix/368-multi-compilation
  • 8d54166 Fix bug where multiple compilations interfered with each other
  • b387510 Merge pull request #367 from jtangelder/add/module-dot-name-test
  • d250cf0 Add test cases for #360

See the full diff

Package name: style-loader The new version differs by 20 commits.

See the full diff

Package name: url-loader The new version differs by 16 commits.

See the full diff

Package name: vue-html-loader The new version differs by 14 commits.

See the full diff

Package name: vue-loader The new version differs by 70 commits.
  • 134a353 8.7.1
  • ec06bc3 Fix for 'loader.charAt is not a function' in v8 (#1166)
  • ca1bc07 fix deprecated warning for 8.x (#672)
  • ef39568 Bugfix/8.x webpack2 (#668)
  • 22fc1e3 Small change (#631)
  • 797d8d4 silence bluebird warning (close #625)
  • 28c8871 8.7.0
  • 91abd72 support webpack2 and extract-text-webpack-plugin 2 (#626)
  • 72aa554 8.6.1
  • d746b2d fix deps
  • fd987a8 8.6.0
  • 39082d4 support chaining with other loaders
  • 0d769c1 fix dev deps
  • 1a9b048 使用10.x的named exports判断方式 (#588)
  • 4917d73 Read options in a way that works even for Webpack 2.2 (#538)
  • a5fa5e2 8.5.4
  • e4378e3 option support for webpack 2
  • 7a49829 Update documentation link anchor to deploying for production (#321)
  • 3fad1cf CSS modules (#331)
  • 8301d7c Update tutorial.md (#313)
  • 4c8376e `eslint-html-plugin` to `eslint-plugin-html` (#288)
  • 363be84 Translate all documents to Chinese. (#295)
  • f7ed5f5 Update postcss.md (#282)
  • 037e70b Update tutorial.md (#272)

See the full diff

Package name: vue-style-loader The new version differs by 38 commits.

<a href="https://snyk.io/redirect/github/vuejs/vue-style-loader/compare/8f34526373c5685e53656afc17da...

@snyk-bot
fix: package.json to reduce vulnerabilities
46541e6 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3105943
@snyk-bot snyk-bot mentioned this pull request Dec 2, 2022
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@luxiaojian @snyk-bot