[Snyk] Security upgrade @americanexpress/one-app-bundler from 6.11.0 to 6.20.0

[nellyk]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	551/1000 Why? Recently disclosed, Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @americanexpress/one-app-bundler

The new version differs by 192 commits.

• 23a9925 chore(release): publish packages (chore(deps): bump tar from 6.1.0 to 6.1.5 in /prod-sample/sample-modules/frank-lloyd-root/0.0.1 americanexpress/one-app#547)
• bed5c3a chore(release): publish packages
• 4283fda chore(readme): fix up purgecss section (chore(deps): bump tar from 6.1.0 to 6.1.5 in /prod-sample/sample-modules/frank-lloyd-root/0.0.0 americanexpress/one-app#545)
• 548e954 fix(one-app-runner): one-app-runner print startup error messages (chore(deps): bump core-js from 3.10.0 to 3.16.0 americanexpress/one-app#538)
• 0d9b5b4 fix(one-app-dev-bundler): avoid default export of sass
• 5a8c415 chore(node): add node 18 to publish workflow (chore(deps): bump tar from 6.1.0 to 6.1.5 in /prod-sample/sample-modules/frank-the-parrot/0.0.0 americanexpress/one-app#542)
• fce315b chore(workflows): add Node.js 18.x to the matrix (chore(deps): bump tar from 6.1.0 to 6.1.5 in /prod-sample/sample-modules/franks-burgers/0.0.0 americanexpress/one-app#541)
• 3a32ff5 Chore/deprecate generator one app module (chore(deps): bump tar from 6.1.0 to 6.1.5 in /prod-sample/sample-modules/frank-lloyd-root/0.0.2 americanexpress/one-app#540)
• 3ab7d58 feat(purgecss): allow for backwards compatibility of purgecss 2 and 3 (#519)
• fd76f4b docs(RELEASE): move from README, pull tags (fix(helmet): fixes race condition with react-helmet americanexpress/one-app#534)
• ae9cb8e chore(release): publish packages
• 63a05a2 chore(deps): bump json5 from 1.0.1 to 1.0.2 (One App Prepare Release americanexpress/one-app#523)
• 900add5 fix(one-app-runner-test): improve console messaging (fix(requestLog): only log on close americanexpress/one-app#526)
• e1babee fix(dev-bundler): improve error when NODE_ENV not development (chore(workflow): only get subject of commit message americanexpress/one-app#528)
• 41bf268 chore(deps): upgrade peer dep html-webpack-plugin (Automerge dependabot PRs americanexpress/one-app#522)
• a92262c chore(release): publish packages (Approach to authorisation with One-App americanexpress/one-app#521)
• 5abc78b fix(devBundler): upgrade to cssnano@5 (One App Prepare Release americanexpress/one-app#518)
• 77cb796 feat(typeScript): allow bundlers to consume ts files (#520)
• b3d6961 fix(cyptoHash): patch crypto hash to support md4 hash (chore(deps-dev): bump rollup-plugin-terser from 6.1.0 to 7.0.2 americanexpress/one-app#516)
• 8c0493a chore(release): publish packages (chore(deps): bump redux from 4.0.5 to 4.1.0 americanexpress/one-app#515)
• 76b5566 fix(dev-bundler): skip plugins when no results metadata (One App Prepare Release americanexpress/one-app#513)
• f0fd6f8 fix(locale-bundler): do not exit on errors during watch (One App Prepare Release americanexpress/one-app#511)
• 490f74b fix(one-app-dev-bundler): match a period, rather than wildcard (fix(clientErrorLogger): add metaData to server side reported error americanexpress/one-app#508)
• a6b66e9 fix(one-app-dev-bundler): index loader filter for Windows paths (chore(deps): bump lodash from 4.17.15 to 4.17.21 in /prod-sample/api americanexpress/one-app#507)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Input Validation