Bump the npm_and_yarn group across 8 directories with 26 updates

[dependabot]

Bumps the npm_and_yarn group with 8 updates in the /angular/angular directory:

Package	From	To
@angular-devkit/build-angular	13.2.6	18.2.8
@angular/cli	13.0.1	18.2.8
@babel/traverse	7.16.0	7.25.7
braces	3.0.2	3.0.3
ws	8.2.3	8.18.0
socket.io	4.4.1	4.8.0
follow-redirects	1.14.9	1.15.9
minimatch	3.0.4	3.1.2

Bumps the npm_and_yarn group with 7 updates in the /my-app directory:

Package	From	To
@babel/traverse	7.24.8	7.25.7
core-js-compat	3.37.1	3.38.1
express	4.19.2	4.21.1
follow-redirects	1.15.6	1.15.9
micromatch	4.0.7	4.0.8
terser	5.31.3	5.34.1
webpack	5.93.0	5.95.0

Bumps the npm_and_yarn group with 17 updates in the /react-express-mongodb/frontend directory:

Package	From	To
semver	6.3.0	7.6.3
semver	7.3.5	7.6.3
core-js-compat	3.21.1	3.38.1
@babel/traverse	7.17.3	7.25.7
json5	2.2.0	2.2.3
json5	1.0.1	2.2.3
braces	3.0.2	3.0.3
decode-uri-component	0.2.0	0.2.2
express	4.17.3	4.21.1
follow-redirects	1.14.9	1.15.9
micromatch	4.0.4	4.0.8
minimatch	3.0.4	3.1.2
recursive-readdir	2.2.2	2.2.3
terser	5.12.0	5.34.1
webpack	5.70.0	5.95.0
webpack-dev-middleware	5.3.1	5.3.4
ejs	3.1.8	3.1.10
tough-cookie	4.0.0	4.1.4
word-wrap	1.2.3	1.2.5

Bumps the npm_and_yarn group with 17 updates in the /react-express-mysql/frontend directory:

Package	From	To
semver	6.3.0	7.6.3
semver	7.3.5	7.6.3
core-js-compat	3.21.1	3.38.1
@babel/traverse	7.17.3	7.25.7
json5	2.2.0	2.2.3
json5	1.0.1	2.2.3
braces	3.0.2	3.0.3
decode-uri-component	0.2.0	0.2.2
express	4.17.3	4.21.1
follow-redirects	1.14.9	1.15.9
micromatch	4.0.4	4.0.8
minimatch	3.0.4	3.1.2
recursive-readdir	2.2.2	2.2.3
terser	5.12.0	5.34.1
webpack	5.70.0	5.95.0
webpack-dev-middleware	5.3.1	5.3.4
ejs	3.1.8	3.1.10
tough-cookie	4.0.0	4.1.4
word-wrap	1.2.3	1.2.5

Bumps the npm_and_yarn group with 17 updates in the /react-java-mysql/frontend directory:

Package	From	To
semver	6.3.0	7.6.3
semver	7.3.5	7.6.3
core-js-compat	3.21.1	3.38.1
@babel/traverse	7.17.3	7.25.7
json5	2.2.0	2.2.3
json5	1.0.1	2.2.3
braces	3.0.2	3.0.3
decode-uri-component	0.2.0	0.2.2
express	4.17.3	4.21.1
follow-redirects	1.14.9	1.15.9
micromatch	4.0.4	4.0.8
minimatch	3.0.4	3.1.2
recursive-readdir	2.2.2	2.2.3
terser	5.12.0	5.34.1
webpack	5.70.0	5.95.0
webpack-dev-middleware	5.3.1	5.3.4
ejs	3.1.8	3.1.10
tough-cookie	4.0.0	4.1.4
word-wrap	1.2.3	1.2.5

Bumps the npm_and_yarn group with 15 updates in the /react-nginx directory:

Package	From	To
semver	6.3.0	7.6.3
semver	7.3.5	7.6.3
@babel/traverse	7.25.6	7.25.7
loader-utils	2.0.2	2.0.4
loader-utils	1.4.0	2.0.4
json5	2.2.0	2.2.3
json5	1.0.1	2.2.3
braces	3.0.2	3.0.3
decode-uri-component	0.2.0	0.2.2
express	4.17.3	4.21.1
follow-redirects	1.14.9	1.15.9
micromatch	4.0.4	4.0.8
terser	5.12.0	5.34.1
webpack	5.70.0	5.95.0
webpack-dev-middleware	5.3.1	5.3.4
ejs	3.1.8	3.1.10
tough-cookie	4.0.0	4.1.4
word-wrap	1.2.3	1.2.5

Bumps the npm_and_yarn group with 17 updates in the /react-rust-postgres/frontend directory:

Package	From	To
semver	6.3.0	7.6.3
semver	7.3.5	7.6.3
core-js-compat	3.21.1	3.38.1
@babel/traverse	7.17.3	7.25.7
json5	2.2.0	2.2.3
json5	1.0.1	2.2.3
braces	3.0.2	3.0.3
decode-uri-component	0.2.0	0.2.2
express	4.17.3	4.21.1
follow-redirects	1.14.9	1.15.9
micromatch	4.0.4	4.0.8
micromatch	4.0.2	4.0.8
minimatch	3.0.4	3.1.2
recursive-readdir	2.2.2	2.2.3
terser	5.12.0	5.34.1
webpack	5.70.0	5.95.0
webpack-dev-middleware	5.3.1	5.3.4
ejs	3.1.8	3.1.10
tough-cookie	4.0.0	4.1.4
word-wrap	1.2.3	1.2.5

Bumps the npm_and_yarn group with 12 updates in the /vuejs/vuejs directory:

Package	From	To
@babel/traverse	7.17.10	7.25.7
braces	3.0.2	3.0.3
core-js-compat	3.22.5	3.38.1
express	4.18.1	4.21.1
follow-redirects	1.15.0	1.15.9
micromatch	4.0.5	4.0.8
terser	5.13.1	5.34.1
webpack	5.72.1	5.95.0
webpack-dev-middleware	5.3.1	5.3.4
word-wrap	1.2.3	1.2.5
vue-template-compiler	2.6.14	2.7.16
@sideway/formula	3.0.0	3.0.1

Updates @angular-devkit/build-angular from 13.2.6 to 18.2.8

Release notes

Sourced from @​angular-devkit/build-angular's releases.

v18.2.8

18.2.8 (2024-10-09)

@​schematics/angular

Commit	Description
	add validation for component and directive class name
	include index.csr.html in resources asset group

@​angular/build

Commit	Description
	Ctrl + C not terminating dev-server with SSR
	always generate a new hash for optimized chunk

v18.2.7

18.2.7 (2024-10-02)

@​schematics/angular

Commit	Description
	support single quote setting in JetBrains IDEs

@​angular/build

Commit	Description
	add animate to valid self-closing elements
	add few more SVG elements animateMotion, animateTransform, and feBlend etc. to valid self-closing elements
	separate Vite cache by project

v18.2.6

18.2.6 (2024-09-25)

@​angular/build

Commit	Description
	allow missing HTML file request to fallback to index
	update rollup to 4.22.4

v18.2.5

18.2.5 (2024-09-18)

@​angular/build

Commit	Description
	support HTTP HEAD requests for virtual output files
	update vite to 5.4.6

v18.2.4

18.2.4 (2024-09-11)

@​angular/build

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

18.2.8 (2024-10-09)

@​schematics/angular

Commit	Type	Description
b522002ff	fix	add validation for component and directive class name
dfd2d5c05	fix	include index.csr.html in resources asset group

@​angular/build

Commit	Type	Description
9445916f9	fix	Ctrl + C not terminating dev-server with SSR
9b5cfaa8c	fix	always generate a new hash for optimized chunk

19.0.0-next.9 (2024-10-02)

@​angular-devkit/build-angular

Commit	Type	Description
0a4ef3026	feat	karma-coverage w/ app builder
dcbdca85c	feat	karma+esbuild+watch
9d7613db9	fix	zone.js/testing + karma + esbuild

@​angular/build

Commit	Type	Description
f63072668	feat	utilize ssr.entry during prerendering to enable access to local API routes
ecfb2b261	fix	add few more SVG elements animateMotion, animateTransform, and feBlend etc. to valid self-closing elements
87a90afd4	fix	incomplete string escaping or encoding
c0b76e337	fix	separate Vite cache by project

@​angular/ssr

Commit	Type	Description
50df63196	fix	improve handling of route mismatches between Angular server routes and Angular router
64c52521d	fix	show error when multiple routes are set with RenderMode.AppShell
12ff37adb	perf	cache generated inline CSS for HTML

... (truncated)

Commits

• 1e578df release: cut the v18.2.8 release
• 9445916 fix(@​angular/build): Ctrl + C not terminating dev-server with SSR
• 9b5cfaa fix(@​angular/build): always generate a new hash for optimized chunk
• dfd2d5c fix(@​schematics/angular): include index.csr.html in resources asset group
• af7e775 test: fix typo in directory name
• b522002 fix(@​schematics/angular): add validation for component and directive class name
• d21d1e6 release: cut the v18.2.7 release
• e45983a docs: update license file match that of angular/angular
• 736e126 fix(@​angular/build): separate Vite cache by project
• 2648e81 fix(@​angular/build): add few more SVG elements animateMotion, animateTransfor...
• Additional commits viewable in compare view

Updates @angular/cli from 13.0.1 to 18.2.8

Release notes

Sourced from @​angular/cli's releases.

v18.2.8

18.2.8 (2024-10-09)

@​schematics/angular

Commit	Description
	add validation for component and directive class name
	include index.csr.html in resources asset group

@​angular/build

Commit	Description
	Ctrl + C not terminating dev-server with SSR
	always generate a new hash for optimized chunk

v18.2.7

18.2.7 (2024-10-02)

@​schematics/angular

Commit	Description
	support single quote setting in JetBrains IDEs

@​angular/build

Commit	Description
	add animate to valid self-closing elements
	add few more SVG elements animateMotion, animateTransform, and feBlend etc. to valid self-closing elements
	separate Vite cache by project

v18.2.6

18.2.6 (2024-09-25)

@​angular/build

Commit	Description
	allow missing HTML file request to fallback to index
	update rollup to 4.22.4

v18.2.5

18.2.5 (2024-09-18)

@​angular/build

Commit	Description
	support HTTP HEAD requests for virtual output files
	update vite to 5.4.6

v18.2.4

18.2.4 (2024-09-11)

@​angular/build

... (truncated)

Changelog

Sourced from @​angular/cli's changelog.

18.2.8 (2024-10-09)

@​schematics/angular

Commit	Type	Description
b522002ff	fix	add validation for component and directive class name
dfd2d5c05	fix	include index.csr.html in resources asset group

@​angular/build

Commit	Type	Description
9445916f9	fix	Ctrl + C not terminating dev-server with SSR
9b5cfaa8c	fix	always generate a new hash for optimized chunk

19.0.0-next.9 (2024-10-02)

@​angular-devkit/build-angular

Commit	Type	Description
0a4ef3026	feat	karma-coverage w/ app builder
dcbdca85c	feat	karma+esbuild+watch
9d7613db9	fix	zone.js/testing + karma + esbuild

@​angular/build

Commit	Type	Description
f63072668	feat	utilize ssr.entry during prerendering to enable access to local API routes
ecfb2b261	fix	add few more SVG elements animateMotion, animateTransform, and feBlend etc. to valid self-closing elements
87a90afd4	fix	incomplete string escaping or encoding
c0b76e337	fix	separate Vite cache by project

@​angular/ssr

Commit	Type	Description
50df63196	fix	improve handling of route mismatches between Angular server routes and Angular router
64c52521d	fix	show error when multiple routes are set with RenderMode.AppShell
12ff37adb	perf	cache generated inline CSS for HTML

... (truncated)

Commits

• 1e578df release: cut the v18.2.8 release
• 9445916 fix(@​angular/build): Ctrl + C not terminating dev-server with SSR
• 9b5cfaa fix(@​angular/build): always generate a new hash for optimized chunk
• dfd2d5c fix(@​schematics/angular): include index.csr.html in resources asset group
• af7e775 test: fix typo in directory name
• b522002 fix(@​schematics/angular): add validation for component and directive class name
• d21d1e6 release: cut the v18.2.7 release
• e45983a docs: update license file match that of angular/angular
• 736e126 fix(@​angular/build): separate Vite cache by project
• 2648e81 fix(@​angular/build): add few more SVG elements animateMotion, animateTransfor...
• Additional commits viewable in compare view

Updates semver from 5.7.1 to 5.7.2

Release notes

Sourced from semver's releases.

v7.6.3

7.6.3 (2024-07-16)

Bug Fixes

• 73a3d79 #726 optimize Range parsing and formatting (#726) (@​jviide)

Documentation

• 2975ece #719 fix extra backtick typo (#719) (@​stdavis)

v7.6.2

7.6.2 (2024-05-09)

Bug Fixes

• 6466ba9 #713 lru: use map.delete() directly (#713) (@​negezor, @​lukekarrys)

v7.6.1

7.6.1 (2024-05-04)

Bug Fixes

• c570a34 #704 linting: no-unused-vars (@​wraithgar)
• ad8ff11 #704 use internal cache implementation (@​mbtools)
• ac9b357 #682 typo in compareBuild debug message (#682) (@​mbtools)

Dependencies

• 988a8de #709 uninstall lru-cache (#709)
• 3fabe4d #704 remove lru-cache

Chores

• dd09b60 #705 bump @​npmcli/template-oss to 4.22.0 (@​lukekarrys)
• ec49cdc #701 chore: chore: postinstall for dependabot template-oss PR (@​lukekarrys)
• b236c3d #696 add benchmarks (#696) (@​H4ad)
• 692451b #688 various improvements to README (#688) (@​mbtools)
• 5feeb7f #705 postinstall for dependabot template-oss PR (@​lukekarrys)
• 074156f #701 bump @​npmcli/template-oss from 4.21.3 to 4.21.4 (@​dependabot[bot])

v7.6.0

7.6.0 (2024-01-31)

Features

• a7ab13a #671 preserve pre-release and build parts of a version on coerce (#671) (@​madtisa, madtisa, @​wraithgar)

Chores

... (truncated)

Changelog

Sourced from semver's changelog.

7.6.3 (2024-07-16)

Bug Fixes

• 73a3d79 #726 optimize Range parsing and formatting (#726) (@​jviide)

Documentation

• 2975ece #719 fix extra backtick typo (#719) (@​stdavis)

7.6.2 (2024-05-09)

Bug Fixes

• 6466ba9 #713 lru: use map.delete() directly (#713) (@​negezor, @​lukekarrys)

7.6.1 (2024-05-04)

Bug Fixes

• c570a34 #704 linting: no-unused-vars (@​wraithgar)
• ad8ff11 #704 use internal cache implementation (@​mbtools)
• ac9b357 #682 typo in compareBuild debug message (#682) (@​mbtools)

Dependencies

• 988a8de #709 uninstall lru-cache (#709)
• 3fabe4d #704 remove lru-cache

Chores

• dd09b60 #705 bump @​npmcli/template-oss to 4.22.0 (@​lukekarrys)
• ec49cdc #701 chore: chore: postinstall for dependabot template-oss PR (@​lukekarrys)
• b236c3d #696 add benchmarks (#696) (@​H4ad)
• 692451b #688 various improvements to README (#688) (@​mbtools)
• 5feeb7f #705 postinstall for dependabot template-oss PR (@​lukekarrys)
• 074156f #701 bump @​npmcli/template-oss from 4.21.3 to 4.21.4 (@​dependabot[bot])

7.6.0 (2024-01-31)

Features

• a7ab13a #671 preserve pre-release and build parts of a version on coerce (#671) (@​madtisa, madtisa, @​wraithgar)

Chores

• 816c7b2 #667 postinstall for dependabot template-oss PR (@​lukekarrys)
• 0bd24d9 #667 bump @​npmcli/template-oss from 4.21.1 to 4.21.3 (@​dependabot[bot])
• e521932 #652 postinstall for dependabot template-oss PR (@​lukekarrys)
• 8873991 #652 chore: chore: postinstall for dependabot template-oss PR (@​lukekarrys)

... (truncated)

Commits

• 0a12d6c chore: release 7.6.3 (#720)
• 73a3d79 fix: optimize Range parsing and formatting (#726)
• 2975ece docs: fix extra backtick typo (#719)
• eb1380b chore: release 7.6.2 (#714)
• 6466ba9 fix(lru): use map.delete() directly (#713)
• d777418 chore: release 7.6.1 (#706)
• 988a8de deps: uninstall lru-cache (#709)
• 5feeb7f chore: postinstall for dependabot template-oss PR
• dd09b60 chore: bump @​npmcli/template-oss to 4.22.0
• c570a34 fix(linting): no-unused-vars
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by npm-cli-ops, a new releaser for semver since your current version.

Updates @babel/traverse from 7.16.0 to 7.25.7

Release notes

Sourced from @​babel/traverse's releases.

v7.25.7 (2024-10-02)

Thanks @​DylanPiercey and @​YuHyeonWook for your first PRs!

🐛 Bug Fix

• babel-helper-validator-identifier
  • #16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • #16809 Archive syntax-import-reflection and syntax-decimal (@​nicolo-ribaudo)
• babel-generator
  • #16779 Simplify logic for [no LineTerminator here] before nodes (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-typescript
  • #16875 perf: Avoid extra cloning of namespaces (@​liuxingbaoyu)
• babel-types
  • #16842 perf: Improve @​babel/types builders (@​liuxingbaoyu)
  • #16828 Only access BABEL_TYPES_8_BREAKING at startup (@​nicolo-ribaudo)

Committers: 8

• Babel Bot (@​babel-bot)
• Dylan Piercey (@​DylanPiercey)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu
• coderaiser (@​coderaiser)
• fisker Cheung (@​fisker)
• hwook (@​YuHyeonWook)

v7.25.6 (2024-08-29)

Thanks @​j4k0xb for your first PR!

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

v7.25.7 (2024-10-02)

🐛 Bug Fix

• babel-helper-validator-identifier
  • #16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone
  • #16809 Archive syntax-import-reflection and syntax-decimal (@​nicolo-ribaudo)
• babel-generator
  • #16779 Simplify logic for [no LineTerminator here] before nodes (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-plugin-transform-typescript
  • #16875 perf: Avoid extra cloning of namespaces (@​liuxingbaoyu)
• babel-types
  • #16842 perf: Improve @​babel/types builders (@​liuxingbaoyu)
  • #16828 Only access BABEL_TYPES_8_BREAKING at startup (@​nicolo-ribaudo)

v7.25.6 (2024-08-29)

🐛 Bug Fix

• babel-generator
  • #16783 Properly print inner comments in TS array types (@​nicolo-ribaudo)
  • #16775 fix: jsx whitespace is not properly preserved when retainLines (@​liuxingbaoyu)
• babel-traverse
  • #16727 fix: path.getAssignmentIdentifiers may be undefined (@​liuxingbaoyu)
• babel-parser
  • #16761 fix: improve static canFollowModifier checks (@​JLHwung)
• babel-helpers, babel-plugin-transform-optional-chaining, babel-runtime-corejs3
  • #16769 Only wrap functions in superPropertyGet helper (@​nicolo-ribaudo)

💅 Polish

• babel-generator, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-named-capturing-groups-regex, babel-plugin-transform-react-jsx-development, babel-plugin-transform-react-jsx, babel-plugin-transform-react-pure-annotations, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env
  • #16780 Do not enforce printing space between ( and comments (@​nicolo-ribaudo)

... (truncated)

Commits

• 2533cfb v7.25.7
• 611d958 [babel 8] Create TSClassImplements|TSInterfaceHeritage nodes (#16731)
• 506bf91 Remove BABEL_TYPES_8_BREAKING flag and enable it by default (#16817)
• 9e14f7d chore: Enable more lint rules (#16827)
• e69a7e5 fix: issue with node path keys updated on unrelated paths (#16814)
• 7467c9d [Babel 8] Remove some Scope methods (#16705)
• 0a55713 [Babel 8] Remove DecimalLiteral AST (#16807)
• 69d65f1 [babel 8] Require Node.js ^18.20.0 || ^20.17.0 || >=22.8.0 (#16800)
• 2f72b97 v7.25.6
• faceae9 fix: path.getAssignmentIdentifiers may be undefined (#16727)
• Additional commits viewable in compare view

Updates loader-utils from 1.4.0 to 2.0.4

Release notes

Sourced from loader-utils's releases.

v2.0.4

2.0.4 (2022-11-11)

Bug Fixes

• ReDoS problem (#225) (ac09944)

v2.0.3

2.0.3 (2022-10-20)

Bug Fixes

• security: prototype pollution exploit (#217) (a93cf6f)

<...

Description has been truncated

[socket-security]

Report too large to display inline

View full report↗︎

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
Critical CVE	npm/loader-utils@1.4.0	CVE: GHSA-76p3-8jx3-jpfq Prototype pollution in webpack loader-utils (CRITICAL) Affected versions: < 1.4.1 Patched version: 1.4.1	react-rust-postgres/frontend/package-lock.json	⚠︎

View full report↗︎

Next steps

What is a critical CVE?

Contains a Critical Common Vulnerability and Exposure (CVE).

Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/loader-utils@1.4.0