[Snyk] Fix for 1 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • app/react/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	551/1000 Why? Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: html-loader

The new version differs by 55 commits.

• d7cccfa chore(release): 1.0.0
• 3c9a1d8 refactor: `attributes` option ([Snyk] Security upgrade markdown-loader from 2.0.2 to 7.0.0 #265)
• 8c73761 feat: `preprocessor` option ([Snyk] Security upgrade markdown-loader from 2.0.2 to 7.0.0 #263)
• f2ce5b1 feat: improve errors
• 9923244 chore(deps): update ([Snyk] Fix for 1 vulnerabilities #260)
• 9835bde feat: supports `link:href` attribute for css ([Snyk] Security upgrade react-native from 0.51.1 to 0.64.0 #258)
• 7af2eff refactor: improve schema ([Snyk] Security upgrade graphiql from 0.11.11 to 0.14.0 #257)
• 98412f9 docs: `filter` sources ([Snyk] Security upgrade react-native from 0.51.1 to 0.64.0 #256)
• ff0f44c feat: implement the `filter` option for filtering some of sources ([Snyk] Security upgrade marked from 0.3.17 to 4.0.10 #255)
• 1c24662 refactor: move the `root` option under the `attributes` option ([Snyk] Security upgrade marked from 0.3.19 to 4.0.10 #254)
• 888b8fe docs: add footnote for `-attributes` ([Snyk] Security upgrade graphiql from 0.11.11 to 1.4.7 #252)
• 3d2907e refactor: remove the `interpolate` option
• bd979e2 refactor: remove the `interpolate` option
• fcba4ec fix: handle only valid srcset tags ([Snyk] Security upgrade @storybook/react from 3.3.15 to 3.4.0 #253)
• 9e5ce56 perf: improve source parse ([Snyk] Security upgrade gatsby from 1.9.232 to 2.1.1 #251)
• c9c8dad refactor: improve source parse ([Snyk] Security upgrade node-sass from 4.14.1 to 7.0.1 #250)
• 079d623 fix: respect `#hash` in sources
• a17df49 fix: reduce `import`/`require` count
• d0b0150 fix: adding quotes when necessary for unquoted sources ([Snyk] Security upgrade react-dev-utils from 5.0.3 to 12.0.0 #247)
• e3727ab test: minifier
• 0bbe29c feat: migrate on `htmlparse2`
• b7af031 fix: escape `\u2028` and `\u2029` characters ([Snyk] Security upgrade node-sass from 4.14.1 to 7.0.0 #244)
• 24b0427 fix: parser tags and attributes according spec ([Snyk] Fix for 1 vulnerabilities #243)
• 3df909d feat: support `script:src` attributes

See the full diff

Package name: html-webpack-plugin

The new version differs by 196 commits.

• eb73905 chore(release): 4.0.0
• 42a6d4a Add typing for getHooks
• a1a37cf Release html-webpack-plugin 4.0.0-beta.14
• 97f9fb9 fix: load script files before style files files in defer script loading mode
• e97ce17 Release html-webpack-plugin 4.0.0-beta.13
• e448b5d Release html-webpack-plugin 4.0.0-beta.12
• de315eb feat: Add defer script loading
• 7df269f feat: Provide a verbose error message if html minification failed
• 1d66e53 feat: merge templateParameters with default template parameters
• dfb98e7 Fix typo in template option docts
• 096a760 Fix broken links in examples
• a195c34 docs: Update template-option documentation
• 40b410e docs: Update example for template parameters
• bf017f3 chore: Release 4.0.0-beta.11
• 2549557 test: Don't use minification for speed measurement
• de22fc2 test: Adjust measurment for node 6 on travis
• 24bf1b5 fix: Update references to html-minifier
• f4eafdc chore: Release 4.0.0-beta.10
• a2ad30a refactor: Use getAssetPath instead of calling the hook directly
• 2595a79 chore: Release 4.0.0-beta.9
• c66766c feat: Add support for minifying inline ES6 inside html templates
• 655cbcd Fix README typo
• 6de319b update lodash dependency for prototype polution vulnerability
• 35a1541 Properly encode file names emitted as part of URLs.

See the full diff

Package name: webpack

The new version differs by 250 commits.

• 04f90c5 4.26.0
• e1df721 Merge pull request MDX ability to loop (map) <Preview> and <Story> storybookjs/storybook#8392 from vkrol/cherry-pick-terser-to-webpack-4
• a818def fix for changed API in terser plugin warningsFilter
• b39abf4 Rename test directories too
• 311a728 Switch from uglifyjs-webpack-plugin to terser-webpack-plugin
• a230148 Merge pull request [Security] Bump lodash from 4.17.11 to 4.17.15 storybookjs/storybook#8351 from DeTeam/chunk-jsdoc-typo
• 7a0af76 Fix a typo in Chunk#split jsdoc comment
• 2361995 4.25.1
• e2a2016 Merge pull request chore(deps-dev): bump expo-cli from 2.21.2 to 3.2.3 in /examples-native/crna-kitchen-sink storybookjs/storybook#8338 from webpack/bugfix/issue-8293
• babe736 replace prefix/postfix even when equal for wrapped context
• dcd0d59 test for Can't access React v3.3 of storybook storybookjs/storybook#8293
• af123a8 Merge pull request chore(deps): bump sitemap from 4.1.1 to 5.0.0 in /docs storybookjs/storybook#8334 from webpack/bugfix/lint
• 36eb0bb move azure specific commands to azure-pipelines.yml
• 290094e 4.25.0
• 355590e Merge pull request Bump react-dom from 16.9.0 to 16.10.1 in /docs storybookjs/storybook#8250 from Aladdin-ADD/patch-3
• 0293c3a Merge pull request [addon-docs] DocGen description are not displayed with StyledComponent storybookjs/storybook#8279 from smelukov/support-entry-progress
• 1ea411b Merge pull request @storybook/addon-docs React.CSSProperties storybookjs/storybook#8139 from NaviMarella/FormatManifest
• 4b72635 exclude watch test cases
• e35d084 increase test timeout
• 6be1411 move schema into definitions
• 3d74504 add missing hooks to progress
• 56d8a8f prevent writing the same message multiple times to stderr
• 64e3826 use flags to show different parts of the progress message
• 8c5e74f Merge branch 'master' into support-entry-progress

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic