Vulnerability in loader-utils version

Bug report

Vulnerability of in dependency tree: minimist, dependency of loader-utils

Describe the bug

Nextjs has a dependency on loader-utils, currently using version 1.2.3. In this version of loader-utils, there is a dependency on json5, which had a dependency on minimist in a version that has a vulnarability. Loader-utils package fixed that dependency here: https://github.com/webpack/loader-utils/commit/c78786d5b540dea5e50d741557c72f2523976ef3#diff-b9cfc7f2cdf78a7f4b91a753d10865a2

Loader-utils has updated their dependency to minimist in 2.x. Hope it will be possible to upgrade to the new version?

The vulnarability is described here: https://nvd.nist.gov/vuln/detail/CVE-2020-7598#vulnCurrentDescriptionTitle https://snyk.io/vuln/SNYK-JS-MINIMIST-559764

To Reproduce

First of all the issue was found using Anchore cli After that the cause of this particular dependency was found by:

1. using nextjs 9.3.0
2. yarn why minimist

result:

   - Hoisted from "next#loader-utils#json5#minimist"

System information

• OS: docker container node:lts-alpine
• Version of Next.js: 9.3.0

[timneutkens]

Those are different. Both have been updated, check next@canary.

See #11149

[balazsorban44]

This issue has been automatically locked due to no recent activity. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.