[Snyk] Security upgrade webpack from 5.0.0 to 5.76.0

[codywalker77]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	808/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.3	Sandbox Bypass SNYK-JS-WEBPACK-3358798	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: webpack

The new version differs by 250 commits.

• 5d64468 Merge pull request repo sync github/docs#16792 from webpack/update-version
• 67af5ec chore(release): 5.76.0
• 97b1718 Merge pull request net.kdt.pojavlaunch.kiet github/docs#16781 from askoufis/loader-context-target-type
• b84efe6 Merge pull request Update viewing-workflow-run-history.md github/docs#16759 from ryanwilsonperkin/real-content-hash-regex-perf
• c98e9e0 Merge pull request Add TOTP Apps Google Authenticator. github/docs#16493 from piwysocki/patch-1
• 5f34acf feat: Add `target` to `LoaderContext` type
• b7fc4d8 Merge pull request Update and rename managing-your-profile-readme.md to robots-managing-… github/docs#16703 from ryanwilsonperkin/ryanwilsonperkin/fix-16160
• 63ea82d Merge branch 'webpack:main' into patch-1
• 4ba2252 Merge pull request Managing disruptive comments is overly prescriptive github/docs#16446 from akhilgkrishnan/patch-1
• 1acd635 Merge pull request Update githubs-products.md github/docs#16613 from jakebailey/ts-logo
• 302eb37 Merge pull request Update projects-filters.md github/docs#16614 from jakebailey/html5-logo
• cfdb1df Improve performance of hashRegExp lookup
• 4d561a6 Add test for behaviour of filesystem-cached assets with loaders
• dfaa3b4 lint: remove trailing comma
• dcc3e71 Serialize code generator data to support generated assets
• b67626c Merge pull request Fix spelling mistakes github/docs#16491 from lvivski/main
• d957cdf Fix formatting
• 6011163 Fix formatting
• ea5e864 Fix HTML5 logo in README
• 2112f9b Replace TypeScript logo in README
• 5513dd6 Merge branch 'webpack:main' into patch-1
• 4b4ca3b Merge pull request Update and rename content/support/contacting-github-support/creating-… github/docs#16500 from Jack-Works/avoid-cross-realm-object
• 4f39c9f fix: type error
• c922ee1 chore: revert breaking change

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[guardrails]

⚠️ We detected 76 security issues in this pull request:

Mode: paranoid | Total findings: 76 | Considered vulnerability: 76

Vulnerable Libraries (76)

Severity	Details
High	pkg:npm/cacheable-request@7.0.1@7.0.1 (t) upgrade to: 10.2.7
High	pkg:npm/tar@6.1.0@6.1.0 (t) upgrade to: 3.2.2,4.4.14,5.0.6,6.1.1
High	pkg:npm/y18n@4.0.0@4.0.0 (t) upgrade to: 3.2.2,4.0.1,5.0.5
High	pkg:npm/minimatch@3.0.4@3.0.4 (t) upgrade to: 3.0.5
Medium	pkg:npm/request@2.88.0@2.88.0 (t) - no patch available
High	pkg:npm/json5@1.0.1@1.0.1 (t) upgrade to: 2.2.2
High	pkg:npm/trim@0.0.1@0.0.1 (t) upgrade to: 0.0.3
High	pkg:npm/json5@2.1.3@2.1.3 (t) upgrade to: 2.2.2
Medium	pkg:npm/got@10.7.0@10.7.0 (t) - no patch available
High	pkg:npm/hosted-git-info@2.7.1@2.7.1 (t) - no patch available
Critical	pkg:npm/aws-sdk@2.610.0@2.610.0 (t) - no patch available
Medium	pkg:npm/node-notifier@7.0.0@7.0.0 (t) upgrade to: 8.0.1
Critical	pkg:npm/unset-value@1.0.0@1.0.0 (t) - no patch available
High	pkg:npm/semver-regex@2.0.0@2.0.0 (t) upgrade to: 3.1.3,4.0.1
High	pkg:npm/async@2.6.3@2.6.3 (t) upgrade to: 3.2.2,2.6.4
High	pkg:npm/path-parse@1.0.6@1.0.6 (t) - no patch available
High	pkg:npm/glob-parent@5.1.0@5.1.0 (t) upgrade to: 5.1.2
Medium	pkg:npm/@actions/core@1.2.6@1.2.6 (t) upgrade to: 1.9.1
Critical	pkg:npm/static-eval@2.0.3@2.0.3 (t) - no patch available
High	pkg:npm/fb-watchman@2.0.1@2.0.1 (t) - no patch available
N/A	pkg:npm/debug@2.6.9@2.6.9 (t) upgrade to: 3.1.0
Medium	pkg:npm/jsdom@16.2.2@16.2.2 (t) upgrade to: 16.5.0
High	pkg:npm/path-parse@1.0.5@1.0.5 (t) - no patch available
Critical	pkg:npm/execa@1.0.0@1.0.0 (t) - no patch available
High	pkg:npm/cacheable-request@6.1.0@6.1.0 (t) upgrade to: 10.2.7
Medium	pkg:npm/react@17.0.1@17.0.1 (t) - no patch available
High	pkg:npm/http-cache-semantics@4.0.3@4.0.3 (t) upgrade to: 4.1.1,4.1.1
High	pkg:npm/prompts@2.3.0@2.3.0 (t) - no patch available
Medium	pkg:npm/ws@7.2.5@7.2.5 (t) upgrade to: 7.4.6,6.2.2,5.2.3
Medium	pkg:npm/cookiejar@2.1.2@2.1.2 (t) upgrade to: 2.1.4
High	pkg:npm/postcss@7.0.21@7.0.21 (t) - no patch available
Medium	pkg:npm/got@9.6.0@9.6.0 (t) - no patch available
High	pkg:npm/async@3.2.0@3.2.0 (t) upgrade to: 3.2.2,2.6.4
Medium	pkg:npm/nwsapi@2.2.0@2.2.0 (t) - no patch available
High	pkg:npm/postcss@7.0.35@7.0.35 (t) - no patch available
Critical	pkg:npm/qs@6.6.0@6.6.0 (t) - no patch available
Medium	pkg:npm/ajv@6.11.0@6.11.0 (t) upgrade to: 6.12.3
Medium	pkg:npm/core-js@2.6.12@2.6.12 (t) - no patch available
High	pkg:npm/decode-uri-component@0.2.0@0.2.0 (t) - no patch available
High	pkg:npm/ansi-regex@3.0.0@3.0.0 (t) upgrade to: 6.0.1,5.0.1,4.1.1,3.0.1
Critical	pkg:npm/qs@6.7.0@6.7.0 (t) - no patch available
Medium	pkg:npm/istanbul-reports@3.0.2@3.0.2 (t) - no patch available
Medium	pkg:npm/axios@0.19.2@0.19.2 (t) - no patch available
N/A	pkg:npm/nth-check@2.0.0@2.0.0 (t) - no patch available
Critical	pkg:npm/find-process@1.4.4@1.4.4 (t) - no patch available
Critical	pkg:npm/minimist@1.2.5@1.2.5 (t) upgrade to: 1.2.6
Medium	pkg:npm/https-proxy-agent@2.2.4@2.2.4 (t) - no patch available
Medium	pkg:npm/read-package-json@2.1.0@2.1.0 (t) - no patch available
High	pkg:npm/ansi-regex@5.0.0@5.0.0 (t) upgrade to: 6.0.1,5.0.1,4.1.1,3.0.1
Critical	pkg:npm/qs@6.5.2@6.5.2 (t) - no patch available
High	pkg:npm/tmpl@1.0.4@1.0.4 (t) upgrade to: 1.0.5
Medium	pkg:npm/node-fetch@2.6.7@2.6.7 (t) - no patch available
Critical	pkg:npm/lodash@4.17.20@4.17.20 (t) - no patch available
Critical	pkg:npm/json-schema@0.2.3@0.2.3 (t) upgrade to: 0.4.0
High	pkg:npm/nth-check@1.0.2@1.0.2 (t) upgrade to: 2.0.1
High	pkg:npm/follow-redirects@1.5.10@1.5.10 (t) upgrade to: 1.14.7
High	pkg:npm/flat@5.0.0@5.0.0 (t) - no patch available
Medium	pkg:npm/express@4.17.1@4.17.1 (t) - no patch available
N/A	pkg:npm/browserslist@4.15.0@4.15.0 (t) - no patch available
High	pkg:npm/glob-parent@5.1.1@5.1.1 (t) upgrade to: 5.1.2
Medium	pkg:npm/ws@6.2.1@6.2.1 (t) upgrade to: 7.4.6,6.2.2,5.2.3
High	pkg:npm/cacheable-request@7.0.2@7.0.2 (t) upgrade to: 10.2.7
Critical	pkg:npm/loader-utils@2.0.0@2.0.0 (t) upgrade to: 2.0.3
High	pkg:npm/revalidator@0.3.1@0.3.1 (t) - no patch available
Medium	pkg:npm/csurf@1.11.0@1.11.0 (t) - no patch available
Critical	pkg:npm/nodemon@2.0.4@2.0.4 (t) - no patch available
Critical	pkg:npm/set-value@2.0.1@2.0.1 (t) - no patch available
High	pkg:npm/redis@3.0.2@3.0.2 (t) upgrade to: 3.1.1
Medium	pkg:npm/browserslist@3.2.8@3.2.8 (t) - no patch available
Critical	pkg:npm/loader-utils@1.2.3@1.2.3 (t) upgrade to: 2.0.3
Critical	pkg:npm/loader-utils@1.4.0@1.4.0 (t) upgrade to: 2.0.3
High	pkg:npm/merge-deep@3.0.2@3.0.2 (t) - no patch available
High	pkg:npm/css-what@2.1.3@2.1.3 (t) - no patch available
High	pkg:npm/ioredis@4.19.4@4.19.4 (t) - no patch available
High	pkg:npm/ansi-regex@4.1.0@4.1.0 (t) upgrade to: 6.0.1,5.0.1,4.1.1,3.0.1
Low	pkg:npm/request@2.88.2@2.88.2 (t) - no patch available

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.