[Snyk] Fix for 8 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-ISSVG-1085627	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-ISSVG-1243891	Yes	Proof of Concept
	509/1000 Why? Has a fix available, CVSS 5.9	Denial of Service (DoS) SNYK-JS-JSYAML-173999	Yes	No Known Exploit
	619/1000 Why? Has a fix available, CVSS 8.1	Arbitrary Code Execution SNYK-JS-JSYAML-174129	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
	469/1000 Why? Has a fix available, CVSS 5.1	Denial of Service (DoS) npm:mem:20180117	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: css-loader

The new version differs by 80 commits.

• 634ab49 chore(release): 2.0.0
• 6ade2d0 refactor: remove unused file ([MRG] rename variable and restructure API docs jupyterhub/binderhub#860)
• e7525c9 test: nested url ([MRG] Make the URL used to generate launch badges configurable jupyterhub/binderhub#859)
• 7259faa test: css hacks ([MRG] Tweak loading messages jupyterhub/binderhub#858)
• 5e6034c feat: allow to filter import at-rules (fix tolerations in dind daemonset and add tolerations to image-cleaner jupyterhub/binderhub#857)
• 5e702e7 feat: allow filtering urls (add user tolerations to dind daemonset jupyterhub/binderhub#856)
• 9642aa5 test: css stuff (Optimize the user-schedulers conf for image locality jupyterhub/binderhub#855)
• 3338656 fix: reduce number of require for url (Build pods and the use of the z2jh user-scheduler jupyterhub/binderhub#854)
• 533abbe test: issue 636 (add default toleration to build pods jupyterhub/binderhub#853)
• 08c551c refactor: better warning on invalid url resolution (Give users feedback on image transfer progress jupyterhub/binderhub#852)
• b0aa159 test: issue Feature: display repository status and history jupyterhub/binderhub#589 ([Feature proposal] Add toleration "hub.jupyter.org/dedicated=user:NoSchedule" to build pods jupyterhub/binderhub#851)
• f599c70 fix: broken unucode characters (Add anchors to filepath? jupyterhub/binderhub#850)
• 1e551f3 test: issue 286 (Problem with authorising with DockerHub registry jupyterhub/binderhub#849)
• 419d27b docs: improve readme (Document how to ban repositories in binderhub jupyterhub/binderhub#848)
• d94a698 refactor: webpack-default (Discuss indentation of configuration files in debugging docs jupyterhub/binderhub#847)
• b97d997 feat: schema options
• 453248f fix: support module resolution in composes (Most problems deploying/upgrading BinderHub can be solved by checking indentation jupyterhub/binderhub#845)
• 8a6ea10 refactor: postcss plugins (Awesome bar/landing page redesign jupyterhub/binderhub#844)
• fdcf687 fix: url resolving logic (Resolve remote git references using provider agnostic method jupyterhub/binderhub#843)
• 889dc7f feat: allow to disable css modules and disable their by default (Making the awesome bar happen jupyterhub/binderhub#842)
• ee2d253 test: importLoaders option (Revert "Update to Docs: Clarify where in secret.yaml GitHub Personal Access Token should be added" jupyterhub/binderhub#841)
• 1dad1fb feat: reuse postcss ast from other loaders (i.e `postcss-loader`) (ipywidgets don't seem to work on mybinder.org jupyterhub/binderhub#840)
• fe94ebc test: icss reserved keywords (Display "Time to cull" in notebook UI jupyterhub/binderhub#839)
• 9eaba66 refactor: migrate on message api for postcss-icss-plugin (DinD documentation jupyterhub/binderhub#838)

See the full diff

Package name: style-loader

The new version differs by 11 commits.

• 5d73db7 chore(release): 0.20.0
• 08ce425 chore(package): update dependencies
• 28f603f refactor: remove comments from bundle source code
• dda8b89 test: rename && update HMR tests
• 23c3567 fix(options): add `transform` option validation (`{String}`)
• e0c4b19 fix(options): support passing a `{Function}` (`options.insertInto`)
• ac8430c ci(travis): update `node` v4.3.0...4.8.0
• 0eb8fe7 feat: support passing a `{Function}` (`options.insertInto`) (Replace badge.svg to match badge from shields.io jupyterhub/binderhub#279)
• 3a4cb53 fix(index): enable HMR in case `locals` (`css-modules`) are unchanged (Escape characters in build slugs properly jupyterhub/binderhub#298)
• 9b46128 fix(addStyles): check if `HTMLIFrameElement` exist (Travis testing of docs jupyterhub/binderhub#296)
• a7734e6 chore(package): update repository url (How to handle long slug names jupyterhub/binderhub#290)

See the full diff

Package name: webpack

The new version differs by 250 commits.

• 213226e 4.0.0
• fde0183 Merge pull request #6081 from webpack/formating/prettier
• b6396e7 update stats
• f32bd41 fix linting
• 5238159 run prettier on existing code
• 518d1e0 replace js-beautify with prettier
• 4c25bfb 4.0.0-beta.3
• dd93716 Merge pull request #6296 from shellscape/fix/hmr-before-node-stuff
• 7a07901 Merge pull request #6563 from webpack/performance/assign-depth
• c7eb895 Merge pull request #6452 from webpack/update_acorn
• 9179980 Merge pull request #6551 from nveenjain/fix/templatemd
• e52f323 optimize performance of assignDepth
• 6bf5df5 Fixed template.md
• 90ab23a Merge branch 'master' into fix/hmr-before-node-stuff
• b0949cb add integration test for spread operator
• 39438c7 unittest now also walks the ast
• 15ab027 Merge pull request #6536 from jevan0307/sideEffects-selectors
• 1611ce1 Merge pull request #6561 from joshunger/patch-1
• 6e175bc Merge pull request #6549 from webpack/md4_hash
• 0637531 Add a hyperlink to create a new issue
• 0e1f9c6 Merge pull request #6554 from webpack/deps/end-of-beta
• 72477f4 upgrade versions to stable versions
• ed30285 Merge pull request #6546 from webpack/bot/review-permission
• 40ee8c7 Use MD4 for hashing

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic