Security vulnerability with is-svg@^3.0.0

Describe the bug

Dependabot alerts for a high severity vulnerability:

Dependabot cannot update is-svg to a non-vulnerable version The latest possible version that can be installed is 3.0.0 because of the following conflicting dependency:

react-scripts@4.0.3 requires is-svg@^3.0.0 via a transitive dependency on postcss-svgo@4.0.2 The earliest fixed version is 4.2.2.

CVE-2021-28092

Suggested dependabot remediation

Upgrade is-svg to version 4.2.2 or later. For example:

"dependencies": {
  "is-svg": ">=4.2.2"
}

or…

"devDependencies": {
  "is-svg": ">=4.2.2"
}

[AviVahl]

Should be fixed now. New postcss-svgo patch release dropped is-svg.

[ziaulrehman40]

react-scripts: 4.0.3 has "resolve-url-loader": "^3.1.2" dependency, which resolves to 3.1.3. resolve-url-loader: 3.1.3 lists a dependency: "postcss": "7.0.21" which is a fixed version dependency, so I am unable to get rid of postcss security issue even if i add "postcss": ">=8.2.10" in my package.json.

Sounds like react-script needs some updates to fix all these vulnerabilities.