[Snyk] Fix for 4 vulnerabilities

[caniszczyk]

Snyk has created this PR to fix 4 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• ui/package.json
• ui/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18313044	828
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-18313070	828
	Directory Traversal SNYK-JS-POSTCSS-18313036	721
	Directory Traversal SNYK-JS-POSTCSS-18313038	721

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Directory Traversal

[caniszczyk]

This upgrade contains multiple major versions with significant breaking changes, particularly in css-loader, webpack-dev-server, and js-yaml. These changes will require updates to your webpack configuration, code, and potentially your Node.js version.

Top Breaking Changes:

• css-loader (3.6.0 → 5.0.0): HIGH RISK

  • Requires webpack 5. The upgrade to v5.0.0 mandates using webpack 5.
  • Node.js Polyfills Removed: Webpack 5 no longer automatically includes polyfills for Node.js core modules, which can cause build failures if your dependencies rely on them.
  • Configuration Changes: In v4.0.0, esModule became true by default. In v5.0.0, options like minimize and alias were removed in favor of using other tools like postcss-loader.
  • Stricter Path Resolution: v4.0.0 became stricter about resolving url() paths, failing builds on paths it cannot find, which v3 may have ignored.

• webpack-dev-server (4.15.2 → 5.1.0): HIGH RISK

  • Configuration Renames: Several options have been renamed. For example, the dev option is now devMiddleware, and the overlay option has been moved inside the client object.
  • Default Directory Change: The default directory for the static option has changed from static to public.
  • Node.js Requirement: Requires Node.js v12.13.0 or higher.

• js-yaml (4.1.1 → 5.2.2): HIGH RISK

  • API Change (ESM): The library now uses named exports instead of a default export. You must change require('js-yaml') to const { load, dump } = require('js-yaml').
  • Behavioral Change: load('') on an empty string now throws an error instead of returning undefined.
  • Schema Change: The default schema no longer supports the !!merge (merge key <<) feature. It must be added back manually if needed.

Other Major Upgrades:

• autoprefixer (7.1.6 → 10.0.0): MEDIUM RISK

  • Requires an upgrade to PostCSS 8, as postcss is now a peerDependency. The browsers option was deprecated in v9 in favor of a browserslist configuration file.

• postcss-flexbugs-fixes (4.1.0 → 5.0.0): MEDIUM RISK

  • Similar to autoprefixer, this upgrade requires PostCSS 8 and moves postcss to a peerDependency.

• babel-preset-react-app (4.0.0 → 9.1.0): MEDIUM RISK

  • No specific breaking

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[netlify]

✅ Deploy Preview for devspace-docs canceled.

Name	Link
🔨 Latest commit	3a0c69f
🔍 Latest deploy log	https://app.netlify.com/projects/devspace-docs/deploys/6a6710068ec0ba0008ca9893