Style-loader is a popular npm package designed for webpack, enabling developers to inject CSS into their applications by adding it to the DOM. Comparing versions 0.17.0 and 0.18.0 reveals some key changes primarily in the dependency landscape. Notably, version 0.18.0 introduces "schema-utils" as a dependency, a module used for validating options against a schema. This addition suggests an enhanced focus on configuration validation, potentially leading to more robust and predictable behavior when configuring the loader.
Furthermore, the devDependencies also show changes. Version 0.18.0 upgrades "css-loader" to version 0.28.1 and "file-loader" to version 0.11.1. This is important because css-loader resolves CSS imports and file-loader handles file imports within CSS, so these updates likely incorporate new features, bug fixes, and potentially performance improvements related to how CSS and assets are handled within the webpack build process. The upgrade could mean better compatibility with newer CSS features or more efficient asset handling. The jsdom devDependency is also bumped from 9.11.0 to 9.12.0, which is relevant for testing in a simulated browser environment.
Developers upgrading should test these new versions of css-loader and file-loader for compatibility with their existing CSS and asset handling configurations within their webpack setup. The introduction of "schema-utils" might require adjustments to style-loader configuration to align with the enforced schema, potentially improving build stability and catching configuration errors earlier. The style-loader package itself remains under the MIT license, ensuring broad usability and flexibility.
All the vulnerabilities related to the version 0.18.0 of the package
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
