Skip to content

Conversation

@mend-for-github-com
Copy link
Contributor

@mend-for-github-com mend-for-github-com bot commented Aug 4, 2025

This PR contains the following updates:

Package Type Update Change
css-loader dependencies major ^5.0.0^6.0.0

By merging this PR, the issue #115 will be automatically resolved and closed:

Severity CVSS Score Vulnerability Reachability
Medium Medium 5.3 CVE-2023-44270

Unreachable

Medium Medium 4.3 CVE-2024-55565

Unreachable


Release Notes

webpack/css-loader (css-loader)

v6.0.0

Compare Source

Notes
  • using ~ is deprecated when the esModule option is enabled (enabled by default) and can be removed from your code (we recommend it) (url(~package/image.png) -> url(package/image.png), @import url(~package/style.css) -> @import url(package/style.css), composes: import from '~package/one.css'; -> composes: import from 'package/one.css';), but we still support it for historical reasons. Why can you remove it? The loader will first try to resolve @import/url()/etc as relative, if it cannot be resolved, the loader will try to resolve @import/url()/etc inside node_modules or modules directories.
  • file-loader and url-loader are deprecated, please migrate on asset modules, since v6 css-loader is generating new URL(...) syntax, it enables by default built-in assets modules, i.e. type: 'asset' for all url()
⚠ BREAKING CHANGES
  • minimum supported Node.js version is 12.13.0
  • minimum supported webpack version is 5, we recommend to update to the latest version for better performance
  • for url and import options Function type was removed in favor Object type with the filter property, i.e. before { url: () => true }, now { url: { filter: () => true } } and before { import: () => true }, now { import: { filter: () => true } }
  • the modules.compileType option was removed in favor the modules.mode option with icss value, also the modules option can have icss string value
  • new URL() syntax used for url(), only when the esModule option is enabled (enabled by default), it means you can bundle CSS for libraries
  • data URI are handling in url(), it means you can register loaders for them, example
  • aliases with false value for url() now generate empty data URI (i.e. data:0,), only when the esModule option is enabled (enabled by default)
  • [ext] placeholder don't need . (dot) before for the localIdentName option, i.e. please change .[ext] on [ext] (no dot before)
  • [folder] placeholder was removed without replacement for the localIdentName option, please use a custom function if you need complex logic
  • [emoji] placeholder was removed without replacement for the localIdentName option, please use a custom function if you need complex logic
  • the localIdentHashPrefix was removed in favor the localIdentHashSalt option
Features
  • supported resolve.byDependency.css resolve options for @import
  • supported resolve.byDependency.icss resolve CSS modules and ICSS imports (i.e. composes/etc)
  • added modules.localIdentHashFunction, modules.localIdentHashDigest, modules.localIdentHashDigestLength options for better class hashing controlling
  • less dependencies
Bug Fixes
  • better performance
  • fixed circular @import
Notes
  • we strongly recommend not to add .css to resolve.extensions, it reduces performance and in most cases it is simply not necessary, alternative you can set resolve options by dependency
5.2.7 (2021-07-13)
Bug Fixes
  • fix crash when source map is unavailable with external URL in [@import](https://redirect.github.com/import) (bb76fe4)
5.2.6 (2021-05-24)
Bug Fixes
  • always write locals export when css modules/icss enabled (#​1315) (075d9bd)
5.2.5 (2021-05-20)
Bug Fixes
5.2.4 (2021-04-19)
Bug Fixes
5.2.3 (2021-04-19)
Bug Fixes
  • improve performance
5.2.2 (2021-04-16)
Bug Fixes
  • avoid escape nonASCII characters in local names (0722733)
5.2.1 (2021-04-09)
Bug Fixes

  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by Mend label Aug 4, 2025
@mend-for-github-com mend-for-github-com bot changed the title Update dependency css-loader to v6 (main) Update dependency css-loader to v6 (main) - autoclosed Jan 26, 2026
@mend-for-github-com mend-for-github-com bot deleted the whitesource-remediate/main-css-loader-6.x branch January 26, 2026 06:38
@mend-for-github-com mend-for-github-com bot changed the title Update dependency css-loader to v6 (main) - autoclosed Update dependency css-loader to v6 (main) Jan 29, 2026
@mend-for-github-com mend-for-github-com bot reopened this Jan 29, 2026
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/main-css-loader-6.x branch 2 times, most recently from 5df0e4d to ae3fa58 Compare January 29, 2026 13:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by Mend

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants