[Snyk] Fix for 1 vulnerabilities

[adamlaska]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/app/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	551/1000 Why? Recently disclosed, Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: css-loader

The new version differs by 76 commits.

• 1351e3a chore(release): 5.0.0
• 747d62b feat: allow named exports to have underscores in names ([Snyk] Fix for 5 vulnerabilities #1209)
• 7bfe85d chore(deps): update ([Snyk] Security upgrade react-router-dom from 4.3.1 to 6.0.0 #1208)
• b5c9379 feat: postcss@8 ([Snyk] Fix for 90 vulnerabilities #1204)
• 92fe103 docs: context is localIdentContext in README ([Snyk] Fix for 108 vulnerabilities #1202)
• e5a9272 chore(deps): update ([Snyk] Fix for 16 vulnerabilities #1203)
• 63b41be refactor: emoji deprecate
• 9f974be feat: reduce runtime
• d779eb1 feat: escape getLocalIdent by default ([Snyk] Security upgrade jsdom from 16.3.0 to 24.1.1 #1196)
• dd52931 feat: hide warning on no plugins ([Snyk] Security upgrade react-dev-utils from 3.1.1 to 11.0.1 #1195)
• 52412f6 feat: improve error message
• 0f95841 feat: add fallback if custom getLocalIdent returns null ([Snyk] Security upgrade async from 2.6.2 to 3.0.0 #1193)
• 2f1573f feat: auto enable icss modules
• df111b8 test: import with file protocol
• cfe669f refactor: remove icss option ([Snyk] Fix for 76 vulnerabilities #1189)
• 57eb505 chore(release): 4.3.0
• 3ddcc7b chore(deps): update deps ([Snyk] Fix for 30 vulnerabilities #1186)
• 88b8ddc fix: line breaks in `url` function
• 8b865fe test: source map ([Snyk] Fix for 6 vulnerabilities #1180)
• ec58a7c feat: the `importLoaders` can be `string` ([Snyk] Fix for 18 vulnerabilities #1178)
• df490c7 test: sass-loader next ([Snyk] Security upgrade svelte-language-server from 0.7.1 to 0.17.0 #1177)
• 26a3062 chore(release): 4.2.2
• e42f046 refactor: improve sources handling in source maps ([Snyk] Security upgrade @astrojs/language-server from 0.13.2 to 0.20.0 #1176)
• 4ce556a docs: fix type ([Snyk] Security upgrade webpack from 4.47.0 to 5.94.0 #1174)

See the full diff

Package name: gulp-postcss

The new version differs by 38 commits.

• 94170d6 Release 9.0.0
• f3751c8 Merge pull request [Snyk] Security upgrade commitizen from 2.10.1 to 4.2.5 #162 from m4thieulavoie/chore/postcss-major-bump
• c0519ac fix: changing node versions
• 0a013d0 fix: added postcss in devDependencies for testing
• 00698a5 Merge pull request [Snyk] Security upgrade nginx from 1.16.1-alpine to 1-alpine #164 from alkorlos/refactor-readme-pcss-extension
• c27fd58 chore: bump postcss-load-config version
• dd4c4e9 (md) update: readmy using with .pcss extension
• 12281d3 docs: pr comments
• 1822c0f docs: updated docs
• 5c04694 fix: moved to peer deps
• 2ab04af chore: bump postcss version to 8
• 5f92ee0 Merge pull request [Snyk] Security upgrade typings from 1.5.0 to 2.1.1 #158 from fredrikpaues/patch-1
• 5edc4aa No `eachDecl` method
• 7e388ec Update README.md: Use SVG badges for readability
• b786700 Update dependencies
• 90a1206 Merge pull request [Snyk] Fix for 1 vulnerabilities #152 from ZeeCoder/small-updates
• 6adfc53 Fixed deprecations
• d1197f8 Release 8.0.0
• 5a70984 Bump the dependencies
• 71265a8 Merge pull request [Snyk] Security upgrade nginx from 1.16.1-alpine to 1.20-alpine #145 from gisu/master
• 31de6e9 Dropped Node 4 Support
• d4f2398 Updated Dependencies
• 3a87a1c Update README.md
• 9166fdb Release 7.0.1

See the full diff

Package name: postcss

The new version differs by 250 commits.

• 90208de Release 8.4.31 version
• 58cc860 Fix carrier return parsing
• 4fff8e4 Improve pnpm test output
• cd43ed1 Update dependencies
• caa916b Update dependencies
• 8972f76 Typo
• 11a5286 Typo
• 45c5501 Release 8.4.30 version
• bc3c341 Update linter
• b2be58a Merge pull request [Dashboard] fix sandboxses template filter codesandbox/codesandbox-client#1881 from romainmenke/improve-sourcemap-performance--philosophical-spiny-dogfish-3eb029c1c8
• 6a291d6 apply suggestions from code review
• efa442c Update lib/map-generator.js
• de33cf6 improve sourcemap performance
• 1c6ad25 Highlight banner with lines
• e10d5c0 More more detailed text below
• 3ff5f5f Rephrase into
• 272aae4 Remove old banner
• 632e876 Update CI actions
• cfa6cf4 Change EM banner
• fee5448 Release 8.4.29 version
• 3360c39 Update dependencies
• ade4145 Merge pull request Wrong console output codesandbox/codesandbox-client#1879 from idoros/ido/fix-location-offset
• 9a7077b fix: node end offset
• ce9f6b3 Merge pull request Angular Lazy Loading codesandbox/codesandbox-client#1875 from coliff/patch-1

See the full diff

Package name: postcss-flexbugs-fixes

The new version differs by 2 commits.

• ff3e5a2 Port to PostCSS 8 API. ([Snyk] Fix for 1 vulnerabilities #71)
• 5eb09c7 fix calc regex ([Snyk] Security upgrade react-dev-utils from 3.1.1 to 11.0.0 #69)

See the full diff

Package name: postcss-import

The new version differs by 18 commits.

• 7cdbb2b 13.0.0
• a189892 Update dependency sugarss to v3 ([Snyk] Security upgrade nginx from 1.16.1-alpine to 1.25.2-alpine #433)
• 64d57af Update dependency postcss-scss to v3 ([Snyk] Security upgrade nginx from 1.16.1-alpine to 1.25.1-alpine #431)
• 4fb6746 Update dependency postcss-value-parser to v4 ([Snyk] Security upgrade patch-package from 6.5.0 to 7.0.1 #423)
• 19632bc Update dependency prettier to v2 ([Snyk] Security upgrade babel-loader from 8.3.0 to 9.1.3 #419)
• c5679db Add support for postcss v8 ([Snyk] Security upgrade nginx from 1.16.1-alpine to 1.25.2-alpine #432)
• d288ea3 BREAKING: Require Node 10 or later; update CI config ([Snyk] Security upgrade nginx from 1.16.1-alpine to 1.25.2-alpine #429)
• 21ad9eb Configure Renovate ([Snyk] Security upgrade tsdx from 0.6.1 to 0.14.0 #411)
• 614fb64 Fix linting
• 3a7f728 Update prettier to version 1.19.1 ([Snyk] Fix for 1 vulnerabilities #408)
• 7680182 Update prettier to version 1.18.0 ([Snyk] Security upgrade webpack from 4.31.0 to 5.1.1 #398)
• 25013d6 chore(package): update prettier to version 1.17.0 ([Snyk] Fix for 1 vulnerabilities #393)
• 87f4320 Update eslint-plugin-import to version 2.17.1 ([Snyk] Security upgrade remap-istanbul from 0.6.4 to 0.10.0 #395)
• 56516e7 Actually fix sourcmap test
• 93b7af8 Fix sourcemap tests
• d68f50a Update ava to version 1.0.1 ([Snyk] Fix for 1 vulnerabilities #384)
• 00e2d03 Update LICENSE ([Snyk] Fix for 1 vulnerabilities #383)
• eb7ff85 Update prettier to version 1.15.0 ([Snyk] Fix for 1 vulnerabilities #382)

See the full diff

Package name: postcss-loader

The new version differs by 39 commits.

• 792e217 chore(release): 4.0.0
• 598f36d docs: improve readme
• cad6f07 fix: avoid mutations of options and config ([Snyk] Fix for 4 vulnerabilities #470)
• 77449e1 test: union ([Snyk] Fix for 7 vulnerabilities #469)
• 9b75888 feat: reuse AST from other loaders ([Snyk] Security upgrade nodemon from 1.19.4 to 2.0.0 #468)
• 5e4a77b fix: resolve `from` and `to` from config and options ([Snyk] Fix for 15 vulnerabilities #467)
• 225b2e5 refactor: do not validate `postcss` options ([Snyk] Security upgrade nodemon from 1.19.4 to 2.0.0 #466)
• 3d32c35 fix: `default` export for plugins ([Snyk] Fix for 29 vulnerabilities #465)
• 38ebe08 refactor: `execute` option ([Snyk] Fix for 11 vulnerabilities #464)
• d0ea725 refactor: config loading
• 108d871 test: more
• b4d3bcc chore: remove unnecessary dev deps ([Snyk] Fix for 2 vulnerabilities #460)
• 475278c chore: move `postcss` to `peerDependencies` ([Snyk] Fix for 16 vulnerabilities #459)
• 98441ff fix: respect the `map` option and source maps ([Snyk] Fix for 14 vulnerabilities #458)
• ba88040 refactor: do not pass meta from other loaders ([Snyk] Security upgrade vscode from 1.0.3 to 1.1.31 #457)
• 25a16a0 refactor: source map code
• 677c2fe refactor: removed `inline` value for the `sourceMap` option ([Snyk] Fix for 7 vulnerabilities #454)
• d8d84f7 refactor: code ([Snyk] Security upgrade parcel-bundler from 1.9.7 to 1.12.4 #453)
• 3cd85df refactor: code
• 6eb44ed refactor: code
• 53da71a refactor: sourcemap paths
• d7bc470 feat: array syntax for plugins
• 2cd7614 refactor: code ([Snyk] Security upgrade gatsby from 2.13.72 to 2.18.10 #451)
• 60e4f12 docs: addDependency ([Snyk] Security upgrade axios from 0.19.2 to 1.6.0 #448)

See the full diff

Package name: postcss-normalize

The new version differs by 5 commits.

• 47eaf28 10.0.0
• 80668b6 feat: update project
• f690d6a Feature/postcss 8 ([Snyk] Security upgrade overmind-devtools from 19.0.1 to 29.0.0 #53)
• fd294fd Add browserslist to peerDependencies ([Snyk] Security upgrade gatsby from 2.32.13 to 3.0.0 #45)
• 9f094c7 9.0.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Input Validation

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[socket-security]

New and updated dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
postcss-flexbugs-fixes	5.0.2	None	+0	8.43 kB	luisrudge
css-loader	5.2.7	None	+5	170 kB	evilebottnawi
postcss-loader	4.0.0	None	+1	78.1 kB	evilebottnawi
postcss-normalize	8.0.1...10.0.1	None	+3/-3	121 kB	jonathantneal
resolve-url-loader	3.1.5...5.0.0	None	+1/-7	153 kB	bholloway
gulp-postcss	6.4.0...9.0.1	None	+3/-6	65.6 kB	unsoundscapes
postcss-import	12.0.1...13.0.0	None	+0/-0	36 kB	ryanzim
postcss-preset-env	6.7.1...9.1.4	None	+62/-37	2.06 MB	alaguna