Bump the loader-utils version to 2.0.3 #16446

akhilgkrishnan · 2022-11-07T09:39:33Z

What kind of change does this PR introduce?

Dependency CVE fix. Then current loader-utils version causing some security issue. This PR is for updating the loader-utils version to 2.0.3

Did you add tests for your changes?

Does this PR introduce a breaking change?

What needs to be documented once your changes are merged?

linux-foundation-easycla · 2022-11-07T09:39:38Z

The committers listed above are authorized under a signed CLA.

✅ login: akhilgkrishnan / name: Akhil G Krishnan (8d66aa7)

webpack-bot · 2022-11-07T09:39:39Z

For maintainers only:

This needs to be documented (issue in webpack/webpack.js.org will be filed when merged)
This needs to be backported to webpack 4 (issue will be created when merged)

alexander-akait · 2022-11-07T15:30:21Z

It is used in tests

ryanmunger · 2022-11-10T05:05:43Z

Any updates on when this will be merged in? Anything I can do to help?

akhilgkrishnan · 2022-11-10T09:59:24Z

It is used in tests

Ohh I see

akhilgkrishnan · 2022-11-10T18:32:59Z

@alexander-akait Can you review this PR once again

TheLarkInn · 2023-03-03T20:12:55Z

Thanks for this @akhilgkrishnan

Bumps [webpack](https://github.com/webpack/webpack) from 5.72.1 to 5.76.0. v5.76.0 Bugfixes Avoid cross-realm object access by @Jack-Works in webpack/webpack#16500 Improve hash performance via conditional initialization by @lvivski in webpack/webpack#16491 Serialize generatedCode info to fix bug in asset module cache restoration by @ryanwilsonperkin in webpack/webpack#16703 Improve performance of hashRegExp lookup by @ryanwilsonperkin in webpack/webpack#16759 Features add target to LoaderContext type by @askoufis in webpack/webpack#16781 Security CVE-2022-37603 fixed by @akhilgkrishnan in webpack/webpack#16446 Repo Changes Fix HTML5 logo in README by @jakebailey in webpack/webpack#16614 Replace TypeScript logo in README by @jakebailey in webpack/webpack#16613 Update actions/cache dependencies by @piwysocki in webpack/webpack#16493 New Contributors @Jack-Works made their first contribution in webpack/webpack#16500 @lvivski made their first contribution in webpack/webpack#16491 @jakebailey made their first contribution in webpack/webpack#16614 @akhilgkrishnan made their first contribution in webpack/webpack#16446 @ryanwilsonperkin made their first contribution in webpack/webpack#16703 @piwysocki made their first contribution in webpack/webpack#16493 @askoufis made their first contribution in webpack/webpack#16781 Full Changelog: webpack/webpack@v5.75.0...v5.76.0 v5.75.0 Bugfixes experiments.* normalize to false when opt-out avoid NaN% show the correct error when using a conflicting chunk name in code HMR code tests existance of window before trying to access it fix eval-nosources-* actually exclude sources fix race condition where no module is returned from processing module fix position of standalong semicolon in runtime code Features add support for @import to extenal CSS when using experimental CSS in node add i64 support to the deprecated WASM implementation Developer Experience expose EnableWasmLoadingPlugin add more typings generate getters instead of readonly properties in typings to allow overriding them ... (truncated) Commits 97b1718 Merge pull request #16781 from askoufis/loader-context-target-type b84efe6 Merge pull request #16759 from ryanwilsonperkin/real-content-hash-regex-perf c98e9e0 Merge pull request #16493 from piwysocki/patch-1 5f34acf feat: Add target to LoaderContext type b7fc4d8 Merge pull request #16703 from ryanwilsonperkin/ryanwilsonperkin/fix-16160 63ea82d Merge branch 'webpack:main' into patch-1 4ba2252 Merge pull request #16446 from akhilgkrishnan/patch-1 1acd635 Merge pull request #16613 from jakebailey/ts-logo 302eb37 Merge pull request #16614 from jakebailey/html5-logo cfdb1df Improve performance of hashRegExp lookup Additional commits viewable in compare view Maintainer changes This version was pushed to npm by evilebottnawi, a new releaser for webpack since your current version. Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Slade Watkins <srw@sladewatkins.net>

WofWca · 2023-03-15T09:21:38Z

It is used in tests

So the code generated by Webpack is not affected?

alexander-akait · 2023-03-15T20:04:03Z

@WofWca yes

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [webpack](https://togithub.com/webpack/webpack) | [`5.75.0` -> `5.76.0`](https://renovatebot.com/diffs/npm/webpack/5.75.0/5.76.0) | [![age](https://badges.renovateapi.com/packages/npm/webpack/5.76.0/age-slim)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://badges.renovateapi.com/packages/npm/webpack/5.76.0/adoption-slim)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://badges.renovateapi.com/packages/npm/webpack/5.76.0/compatibility-slim/5.75.0)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://badges.renovateapi.com/packages/npm/webpack/5.76.0/confidence-slim/5.75.0)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2023-28154](https://nvd.nist.gov/vuln/detail/CVE-2023-28154) Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object. --- ### Release Notes <details> <summary>webpack/webpack</summary> ### [`v5.76.0`](https://togithub.com/webpack/webpack/releases/tag/v5.76.0) [Compare Source](https://togithub.com/webpack/webpack/compare/v5.75.0...v5.76.0) #### Bugfixes - Avoid cross-realm object access by [@Jack-Works](https://togithub.com/Jack-Works) in [webpack/webpack#16500 - Improve hash performance via conditional initialization by [@lvivski](https://togithub.com/lvivski) in [webpack/webpack#16491 - Serialize `generatedCode` info to fix bug in asset module cache restoration by [@ryanwilsonperkin](https://togithub.com/ryanwilsonperkin) in [webpack/webpack#16703 - Improve performance of `hashRegExp` lookup by [@ryanwilsonperkin](https://togithub.com/ryanwilsonperkin) in [webpack/webpack#16759 #### Features - add `target` to `LoaderContext` type by [@askoufis](https://togithub.com/askoufis) in [webpack/webpack#16781 #### Security - [CVE-2022-37603](https://togithub.com/advisories/GHSA-3rfm-jhwj-7488) fixed by [@akhilgkrishnan](https://togithub.com/akhilgkrishnan) in [webpack/webpack#16446 #### Repo Changes - Fix HTML5 logo in README by [@jakebailey](https://togithub.com/jakebailey) in [webpack/webpack#16614 - Replace TypeScript logo in README by [@jakebailey](https://togithub.com/jakebailey) in [webpack/webpack#16613 - Update actions/cache dependencies by [@piwysocki](https://togithub.com/piwysocki) in [webpack/webpack#16493 #### New Contributors - [@Jack-Works](https://togithub.com/Jack-Works) made their first contribution in [webpack/webpack#16500 - [@lvivski](https://togithub.com/lvivski) made their first contribution in [webpack/webpack#16491 - [@jakebailey](https://togithub.com/jakebailey) made their first contribution in [webpack/webpack#16614 - [@akhilgkrishnan](https://togithub.com/akhilgkrishnan) made their first contribution in [webpack/webpack#16446 - [@ryanwilsonperkin](https://togithub.com/ryanwilsonperkin) made their first contribution in [webpack/webpack#16703 - [@piwysocki](https://togithub.com/piwysocki) made their first contribution in [webpack/webpack#16493 - [@askoufis](https://togithub.com/askoufis) made their first contribution in [webpack/webpack#16781 **Full Changelog**: webpack/webpack@v5.75.0...v5.76.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Australia/Sydney, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/google/osv.dev).

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [webpack](https://togithub.com/webpack/webpack) | [`5.75.0` -> `5.76.0`](https://renovatebot.com/diffs/npm/webpack/5.75.0/5.76.0) | [![age](https://badges.renovateapi.com/packages/npm/webpack/5.76.0/age-slim)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://badges.renovateapi.com/packages/npm/webpack/5.76.0/adoption-slim)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://badges.renovateapi.com/packages/npm/webpack/5.76.0/compatibility-slim/5.75.0)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://badges.renovateapi.com/packages/npm/webpack/5.76.0/confidence-slim/5.75.0)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2023-28154](https://nvd.nist.gov/vuln/detail/CVE-2023-28154) Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object. --- ### Release Notes <details> <summary>webpack/webpack</summary> ### [`v5.76.0`](https://togithub.com/webpack/webpack/releases/tag/v5.76.0) [Compare Source](https://togithub.com/webpack/webpack/compare/v5.75.0...v5.76.0) #### Bugfixes - Avoid cross-realm object access by [@Jack-Works](https://togithub.com/Jack-Works) in [webpack/webpack#16500 - Improve hash performance via conditional initialization by [@lvivski](https://togithub.com/lvivski) in [webpack/webpack#16491 - Serialize `generatedCode` info to fix bug in asset module cache restoration by [@ryanwilsonperkin](https://togithub.com/ryanwilsonperkin) in [webpack/webpack#16703 - Improve performance of `hashRegExp` lookup by [@ryanwilsonperkin](https://togithub.com/ryanwilsonperkin) in [webpack/webpack#16759 #### Features - add `target` to `LoaderContext` type by [@askoufis](https://togithub.com/askoufis) in [webpack/webpack#16781 #### Security - [CVE-2022-37603](https://togithub.com/advisories/GHSA-3rfm-jhwj-7488) fixed by [@akhilgkrishnan](https://togithub.com/akhilgkrishnan) in [webpack/webpack#16446 #### Repo Changes - Fix HTML5 logo in README by [@jakebailey](https://togithub.com/jakebailey) in [webpack/webpack#16614 - Replace TypeScript logo in README by [@jakebailey](https://togithub.com/jakebailey) in [webpack/webpack#16613 - Update actions/cache dependencies by [@piwysocki](https://togithub.com/piwysocki) in [webpack/webpack#16493 #### New Contributors - [@Jack-Works](https://togithub.com/Jack-Works) made their first contribution in [webpack/webpack#16500 - [@lvivski](https://togithub.com/lvivski) made their first contribution in [webpack/webpack#16491 - [@jakebailey](https://togithub.com/jakebailey) made their first contribution in [webpack/webpack#16614 - [@akhilgkrishnan](https://togithub.com/akhilgkrishnan) made their first contribution in [webpack/webpack#16446 - [@ryanwilsonperkin](https://togithub.com/ryanwilsonperkin) made their first contribution in [webpack/webpack#16703 - [@piwysocki](https://togithub.com/piwysocki) made their first contribution in [webpack/webpack#16493 - [@askoufis](https://togithub.com/askoufis) made their first contribution in [webpack/webpack#16781 **Full Changelog**: webpack/webpack@v5.75.0...v5.76.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Europe/London, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/guardian/csnx).

Bump webpack from 5.75.0 to 5.76.1 Bumps webpack from 5.75.0 to 5.76.1. Release notes Sourced from webpack's releases. v5.76.1 Fixed Added assert/strict built-in to NodeTargetPlugin Revert Improve performance of hashRegExp lookup by @ryanwilsonperkin in webpack/webpack#16759 v5.76.0 Bugfixes Avoid cross-realm object access by @Jack-Works in webpack/webpack#16500 Improve hash performance via conditional initialization by @lvivski in webpack/webpack#16491 Serialize generatedCode info to fix bug in asset module cache restoration by @ryanwilsonperkin in webpack/webpack#16703 Improve performance of hashRegExp lookup by @ryanwilsonperkin in webpack/webpack#16759 Features add target to LoaderContext type by @askoufis in webpack/webpack#16781 Security CVE-2022-37603 fixed by @akhilgkrishnan in webpack/webpack#16446 Repo Changes Fix HTML5 logo in README by @jakebailey in webpack/webpack#16614 Replace TypeScript logo in README by @jakebailey in webpack/webpack#16613 Update actions/cache dependencies by @piwysocki in webpack/webpack#16493 New Contributors @Jack-Works made their first contribution in webpack/webpack#16500 @lvivski made their first contribution in webpack/webpack#16491 @jakebailey made their first contribution in webpack/webpack#16614 @akhilgkrishnan made their first contribution in webpack/webpack#16446 @ryanwilsonperkin made their first contribution in webpack/webpack#16703 @piwysocki made their first contribution in webpack/webpack#16493 @askoufis made their first contribution in webpack/webpack#16781 Full Changelog: webpack/webpack@v5.75.0...v5.76.0 Commits 21be52b Merge pull request #16804 from webpack/chore-patch-release 1cce945 chore(release): 5.76.1 e76ad9e Merge pull request #16803 from ryanwilsonperkin/revert-16759-real-content-has... 52b1b0e Revert "Improve performance of hashRegExp lookup" c989143 Merge pull request #16766 from piranna/patch-1 710eaf4 Merge pull request #16789 from dmichon-msft/contenthash-hashsalt 5d64468 Merge pull request #16792 from webpack/update-version 67af5ec chore(release): 5.76.0 97b1718 Merge pull request #16781 from askoufis/loader-context-target-type b84efe6 Merge pull request #16759 from ryanwilsonperkin/real-content-hash-regex-perf Additional commits viewable in compare view Maintainer changes This version was pushed to npm by evilebottnawi, a new releaser for webpack since your current version. Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase. Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: @dependabot rebase will rebase this PR @dependabot recreate will recreate this PR, overwriting any edits that have been made to it @dependabot merge will merge this PR after your CI passes on it @dependabot squash and merge will squash and merge this PR after your CI passes on it @dependabot cancel merge will cancel a previously requested merge and block automerging @dependabot reopen will reopen this PR if it is closed @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) @dependabot use these labels will set the current labels as the default for future PRs for this repo and language @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the Security Alerts page. Reviewed-by: Artem Goncharov

Bump the loader-utils version to 2.0.3

8d66aa7

webpack-bot added the PR: unreviewed label Nov 7, 2022

akhilgkrishnan added 2 commits November 10, 2022 15:20

Merge branch 'webpack:main' into patch-1

368412f

Yarn lock updated

139d1b4

Yarn lint issue fix

960a025

alexander-akait approved these changes Nov 10, 2022

View reviewed changes

webpack-bot added PR: reviewed-approved and removed PR: unreviewed labels Nov 10, 2022

TheLarkInn merged commit 4ba2252 into webpack:main Mar 3, 2023
47 checks passed

lasar mentioned this pull request Mar 9, 2023

Bump webpack from 5.75.0 to 5.76.0 lasar/dynalist-date-parser#46

Merged

ajfisher mentioned this pull request Mar 14, 2023

chore(deps): bump webpack from 5.59.1 to 5.76.1 in /site ajfisher/ajfisher.me#120

Merged

kockas mentioned this pull request Mar 15, 2023

Bump webpack from 5.73.0 to 5.76.1 vacuumlabs/report-bot#94

Open

msimmer mentioned this pull request Mar 15, 2023

chore(deps-dev): bump webpack from 5.74.0 to 5.76.0 triplecanopy/b-ber#449

Merged

louiechristie mentioned this pull request Mar 15, 2023

build(deps): bump webpack from 5.75.0 to 5.76.1 louiechristie/weather-winton#61

Merged

louiechristie mentioned this pull request Mar 15, 2023

chore(deps): bump webpack from 5.75.0 to 5.76.1 louiechristie/newcrossities#28

Merged

kevin-s mentioned this pull request Mar 15, 2023

Bump webpack from 5.75.0 to 5.76.1 kevin-s/personal-portfolio#23

Merged

MilkaChucky mentioned this pull request Mar 18, 2023

Bump webpack and @angular-devkit/build-angular in /BookingWebApp MilkaChucky/BookingWebApp#74

Merged

Bump the loader-utils version to 2.0.3 #16446

Bump the loader-utils version to 2.0.3 #16446

akhilgkrishnan commented Nov 7, 2022 •

edited

linux-foundation-easycla bot commented Nov 7, 2022 •

edited

webpack-bot commented Nov 7, 2022

alexander-akait commented Nov 7, 2022

ryanmunger commented Nov 10, 2022 •

edited

akhilgkrishnan commented Nov 10, 2022

akhilgkrishnan commented Nov 10, 2022

TheLarkInn commented Mar 3, 2023

WofWca commented Mar 15, 2023

alexander-akait commented Mar 15, 2023

Bump the loader-utils version to 2.0.3 #16446

Bump the loader-utils version to 2.0.3 #16446

Conversation

akhilgkrishnan commented Nov 7, 2022 • edited

linux-foundation-easycla bot commented Nov 7, 2022 • edited

webpack-bot commented Nov 7, 2022

alexander-akait commented Nov 7, 2022

ryanmunger commented Nov 10, 2022 • edited

akhilgkrishnan commented Nov 10, 2022

akhilgkrishnan commented Nov 10, 2022

TheLarkInn commented Mar 3, 2023

WofWca commented Mar 15, 2023

alexander-akait commented Mar 15, 2023

akhilgkrishnan commented Nov 7, 2022 •

edited

linux-foundation-easycla bot commented Nov 7, 2022 •

edited

ryanmunger commented Nov 10, 2022 •

edited