Bump css-loader from 2.1.1 to 3.2.0 in /WcaOnRails

[dependabot-preview]

Bumps css-loader from 2.1.1 to 3.2.0.

Release notes

Sourced from css-loader's releases.

v3.2.0

Bug Fixes

• replace . characters in localIndent to - character (regression) (#982) (967fb66)

Features

• support es modules for assets loader (#984) (9c5126c)

v3.1.0

3.1.0 (2019-07-18)

Bug Fixes

• converting all (including reserved and control) filesystem characters to - (it was regression in 3.0.0 version) (#972) (f51859b)
• default context should be undefined instead of null (#965) (9c32885)

Features

• allow modules.getLocalIdent to return a falsy value (#963) (9c3571c)
• improved validation error messages (65e4fc0)

v3.0.0

3.0.0 (2019-06-11)

Bug Fixes

• avoid the "from" argument must be of type string error (#908) (e5dfd23)
• invert Function behavior for url and import options (#939) (e9eb5ad)
• properly export locals with escaped characters (#917) (a0efcda)
• property handle non css characters in localIdentName (#920) (d3a0a3c)

Features

• modules options now accepts object config (#937) (1d7a464)
• support @value at-rule in selectors (#941) (05a42e2)

BREAKING CHANGES

• minimum required nodejs version is 8.9.0
• @value at rules now support in selector, recommends checking all @values at-rule usage (hint: you can add prefix to all @value at-rules, for example @value v-foo: black; or @value m-foo: screen and (max-width: 12450px), and then do upgrade)
• invert {Function} behavior for url and import options (need return true when you want handle url/@import and return false if not)
• exportLocalsStyle option was remove in favor localsConvention option, also it is accept only {String} value (use camelCase value if you previously value was true and asIs if you previously value was false)
• exportOnlyLocals option was remove in favor onlyLocals option

... (truncated)

Changelog

Sourced from css-loader's changelog.

3.2.0 (2019-08-06)

Bug Fixes

• replace . characters in localIndent to - character (regression) (#982) (967fb66)

Features

• support es modules for assets loader (#984) (9c5126c)

3.1.0 (2019-07-18)

Bug Fixes

• converting all (including reserved and control) filesystem characters to - (it was regression in 3.0.0 version) (#972) (f51859b)
• default context should be undefined instead of null (#965) (9c32885)

Features

• allow modules.getLocalIdent to return a falsy value (#963) (9c3571c)
• improved validation error messages (65e4fc0)

3.0.0 (2019-06-11)

Bug Fixes

• avoid the "from" argument must be of type string error (#908) (e5dfd23)
• invert Function behavior for url and import options (#939) (e9eb5ad)
• properly export locals with escaped characters (#917) (a0efcda)
• property handle non css characters in localIdentName (#920) (d3a0a3c)

Features

• modules options now accepts object config (#937) (1d7a464)
• support @value at-rule in selectors (#941) (05a42e2)

BREAKING CHANGES

• minimum required nodejs version is 8.9.0
• @value at rules now support in selector, recommends checking all @values at-rule usage (hint: you can add prefix to all @value at-rules, for example @value v-foo: black; or @value m-foo: screen and (max-width: 12450px), and then do upgrade)
• invert {Function} behavior for url and import options (need return true when you want handle url/@import and return false if not)

... (truncated)

Commits

• 39f18f8 chore(release): 3.2.0
• 9c5126c feat: support es modules for assets loader (#984)
• 2ac79c3 docs: example with CSS modules and pure CSS (#983)
• 967fb66 fix: replace . characters in localIndent to - character (regression) (#982)
• 036b5f1 docs: fix camelCase reference in 3.0 changelog (#979)
• 926ebbd chore(release): 3.1.0
• 5d2c52e test: escaped in selectors (#973)
• f51859b fix: converting reserved and control filesystem characters to - (#972)
• 65e4fc0 feat: improved validation error messages
• 9c32885 fix: default context should be undefined instead of null (#965)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[jfly]

Same as #4346 (comment). We can

@dependabot-bot ignore this version

I also dug into why dependabot is even trying to upgrade this package to a version that webpacker doesn't support. https://lexi-lambda.github.io/blog/2016/08/24/understanding-the-npm-dependency-model/ explains a lot about how node supports multiple versions of the same package, and talks a bit about how npm/yarn can take advantage of that. I wrote up my findings here: rails/webpacker#2197 (comment).

I'm not sure what else we can do in the mean time, except continue to ignore these updates.