Resolve-url-loader 4.0.0 represents a significant update to a crucial tool for Webpack projects dealing with relative paths in CSS url() statements. It enhances how these paths are resolved, ensuring correct asset referencing within complex project structures. The core functionality remains the same, addressing the common problem of incorrect asset paths after CSS transformations. However, key changes are apparent in the dependencies and overall structure.
One notable change is the removal of camelcase, compose-function, and es6-iterator dependencies. This suggests a possible refactoring focusing on leaner code and optimized performance. The upgrade of adjust-sourcemap-loader to version ^4.0.0 from 3.0.0 in the previous version (3.1.5) indicates improvements in sourcemap handling, which is vital for debugging CSS effectively. Another important upgrade is loader-utils to version ^2.0.0 from ^1.2.3. This could bring compatibility with newer Webpack features and security updates. The update in postcss to version ^7.0.35 from 7.0.36 may contain essential bug fixes or performance tweaks though the difference is minor. Version 4.0.0 also demonstrates a restructured package, doubling the file count (22 vs 11) and increasing the unpacked size significantly (117KB vs 42KB), potentially due to expanded features, enhanced testing, or refined modularization. Developers should pay close attention to these changes to understand the underlying refactoring and confirm seamless migration with their existing build processes. The later release date of version 3.1.5 doesn't signify that 4.0.0 is older, simply that 3.1.5 was patched later on.
All the vulnerabilities related to the version 4.0.0 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
