[Snyk] Fix for 2 vulnerabilities

[gavinlove]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	Yes	No Known Exploit
	551/1000 Why? Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3105943	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: babel-loader

The new version differs by 214 commits.

• 1a76476 7.0.0
• 7307226 Point changelog to releases
• 174cb10 Merge branch '7.0'
• 2204871 Add prettier (#409)
• dbec80d Make sure .babelrc is a file, not a directory (#427)
• aa485e4 Use bash codecov (#440)
• 16522b6 yarn.lock
• 660922b Update ava to the latest version 🚀 (#434)
• 5d248b5 Update cross-env to the latest version 🚀 (#431)
• 74ff2e6 Updated documentation to match webpack v2 changes. (#438)
• ed8711d Add note about webpack versions
• a7342de 7.0.0-beta.1
• fb8c271 Merge branch 'fix-options' into 7.0
• 1ed7ff5 Merge branch 'master' into 7.0
• e20f6b6 Changelog for 6.4.1 (#424)
• 48325ea 6.4.1
• 87e4e85 target node 4 in preset env (#423)
• f3241f8 Fixed reset of BABEL_ENV when options.forceEnv is used (#420)
• 05a31c5 7.0.0-alpha.3
• ad77367 Ensure options are always an object (#413)
• e8aa302 Ensure options are always an object
• b9209e7 7.0.0-alpha.2
• 3f51915 Update yarn.lock
• c18b16a Fix merge conflict

See the full diff

Package name: imports-loader

The new version differs by 15 commits.

• 3c8b7f2 chore(release): imports-loader v0.7.1
• 2be21e4 ci(Travis): update to contrib standard build ([Snyk] Security upgrade karma-webpack from 1.8.1 to 5.0.0 #42)
• 7129a27 fix(getOptions): deprecation warn in loaderUtils ([Snyk] Fix for 16 vulnerabilities #41)
• 0e14835 Merge pull request [Snyk] Fix for 1 vulnerabilities #40 from webpack-contrib/d3viant0ne-JSFMaintainers
• cac3c87 docs(readme): updates for JSF maintainers
• 1867023 0.7.0
• 7c03b4d add license file
• 6f422ef only include index file in npm package
• 1eb9dbe update source-map dep
• 77fed5b add travis
• d43cecd Support dot notation in variable names ([Snyk] Fix for 2 vulnerabilities #30)
• 6cdd994 Add -suffix to README examples to reflect Webpack 2 change ([Snyk] Fix for 2 vulnerabilities #34)
• d73e591 Clarify introductory sentences ([Snyk] Security upgrade karma from 0.13.22 to 6.0.0 #31)
• f682af5 Merge pull request [Snyk] Security upgrade karma from 0.13.22 to 6.3.16 #27 from rgbkrk/patch-1
• 97b5305 Add missing brace

See the full diff

Package name: karma

The new version differs by 250 commits.

• 16010eb chore(release): 5.0.8 [skip ci]
• a409696 chore: remove unused `grunt lint` command (#3515)
• 47f1cb2 fix(dependencies): update to latest log4js major (#3514)
• b60391f fix(dependencies): update and unlock socket.io dependency (#3513)
• 4d49948 chore(release): 5.0.7 [skip ci]
• f399063 fix: detect type for URLs with query parameter or fragment identifier (#3509)
• 17b50bc chore(release): 5.0.6 [skip ci]
• 0cd696f fix(dependencies): update production dependencies (#3512)
• 7c24a03 chore: fix broken HTML markup in the changelog file (#3507)
• fdc4f9d refactor(test): remove no debug matching option (#3504)
• 35d57e9 chore(release): 5.0.5 [skip ci]
• e99da31 fix(cli): restore command line help contents (#3502)
• 4f2fe56 chore: add Node 14 to the build matrix (#3501)
• 100b227 refactor(test): move execKarma into the World (#3500)
• f375884 refactor(test): reduce execKarma to a reasonable size (#3496)
• a3d1f11 refactor(test): add common method to start server in background (#3495)
• e4a5126 refactor(test): write config file in its own steps (#3494)
• 0bd5c2b refactor(test): adjust sandbox folder location and simplify config logic (#3493)
• b788f94 refactor(test): extract proxy into a separate Given claim (#3492)
• 633f833 chore(release): 5.0.4 [skip ci]
• 810489d refactor(test): migrate Proxy to ES2015 (#3490)
• fa95fa3 fix(browser): make sure that empty results array is still recognized (#3486)
• 255bf67 refactor(test): migrate World to ES2015 (#3489)
• be5db67 chore(test): remove usage of deprecated defineSupportCode (#3488)

See the full diff

Package name: karma-webpack

The new version differs by 55 commits.

• db43093 chore(release): 2.0.10
• 5406a4c ci(.travis): update CI config (#302)
• 2bb71f5 style(src/): fix linting errors (#303)
• 0a5564d chore(package): update `dependencies`
• eca88a8 docs(RELEASE): outdated && removed
• 56e99b0 refactor(index): renamed to `src/index`
• 31862ff docs(README): standardize
• 77797a8 build(gulpfile): remove `gulp`
• 6d28c5c build(.babelrc): use `babel-preset-env`
• 99ddad8 fix(package): add `webpack >= v4.0.0` (`peerDependencies`) (#301)
• 94a2d73 build(package): don't generate source maps for release (`build:release`) (#294)
• 906ed52 fix: correctly escape `{Regex}` in custom file handler (#293)
• 5fa2409 fix(karma-webpack): correctly coalesce `idx` (`{Number}`) in filepaths (#287)
• 41d1912 fix: disable `webpack` rebuilds on karma `--single-run`
• b361ff4 chore(release): 2.0.9
• be2b0e8 fix: ensure webpack paths include a trailing slash (#285)
• c781f4e chore: Update changelog for publishing issue
• 1044b2d chore(release): 2.0.8
• 60c9616 chore(release): 2.0.7
• 0616dda fix: use `os.tmpdir()` to safely store `_karma_webpack_` (#279)
• 68506b4 chore(release): 2.0.6
• c952bcd fix: work with sourcemaps when mocha is wrapped (#237) (#238)
• 33d8eaa chore(package): Updates version of webpack-dev-middleware (#269)
• ec1badf docs(README): update link to latest docs (`webpack.js.org`) (#270)

See the full diff

Package name: webpack

The new version differs by 250 commits.

• bf4ec9c 3.0.0
• 9feda63 Merge pull request #5028 from webpack/feature/externalize_uglify_plugin
• 49d6e38 Merge pull request #5086 from webpack/ci/node-8
• 3dcb133 OSX test on node.js 8
• f4b8785 Merge pull request #5012 from webpack/TheLarkInn-patch-1
• d26c402 chore(deps): upgrade uglifyjs-webpack-plugin deps to get latest webpack-sources so tests pass
• 3da4f3e Merge pull request #5085 from jbellenger/jbellenger/rawmodule-hash
• 8c9dc14 fix RawModule hashing
• c2c5d73 Update README.md
• 316d4b9 Merge pull request #5084 from timse/remove-duplicate-code
• ae18552 update test case with changed hash due to less clutter in dependencies
• fc20348 unite iteration through modules into one loop
• 083843e remove code that pushes arrays of dependencies into dependencies
• ab636b0 Merge pull request #5075 from andreipfeiffer/master
• 3b3449c Refactor: use const for non reassignable identifier
• 2ba0499 3.0.0-rc.2
• 1769fa2 Merge pull request #5064 from webpack/feature/scope-hoisting-multi-entry
• a73646a Merge pull request #5060 from mikesherov/reason-chunks-as-set
• 28f826a consistent order
• 8a30188 use Set for ModuleReason chunk rewriting
• 5d4ba56 Allow scope hoisting to process modules in multiple chunks
• d6a7594 harmony modules without exports have no exports instead of unknown
• 3ae782d Merge pull request #5049 from KTruong888/ES6_refactoring_multicompiler
• 18cdba8 4099_ES6 refactor lib/MultiCompiler.js

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Regular Expression Denial of Service (ReDoS)