chore(deps): update dependency webpack-bundle-analyzer to v3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
webpack-bundle-analyzer	2.9.1 -> 3.3.2

GitHub Vulnerability Alerts

GHSA-pgr8-jg6h-8gw6

Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify() without properly escaping input which may lead to Cross-Site Scripting.

Recommendation

Upgrade to version 3.3.2 or later.

---

Release Notes

webpack-contrib/webpack-bundle-analyzer (webpack-bundle-analyzer)

v3.3.2

Compare Source

• Bug Fix
  • Fix regression with escaping internal assets (#​264, fixes #​263)

v3.3.1

Compare Source

• Improvements

  • Use relative links for serving internal assets (#​261, fixes #​254)
  • Properly escape embedded JS/JSON (#​262)

• Bug Fix

  • Fix showing help message on -h flag (#​260, fixes #​239)

v3.3.0

Compare Source

• New Feature

  • Show/hide chunks using context menu (#​246, @​bregenspan)

• Internal

  • Updated dev dependencies

v3.2.0

Compare Source

• Improvements
  • Add support for .mjs output files (#​252, @​jlopezxs)

v3.1.0

Compare Source

• Bug Fix
  • Properly determine the size of the modules containing special characters (#​223, @​hulkish)
  • Update acorn to v6 (#​248, @​realityking)

v3.0.4

Compare Source

• Bug Fix
  • Make webpack's done hook wait until analyzer writes report or stat file (#​247, @​mareolan)

v3.0.3

Compare Source

• Bug Fix
  • Disable viewer websocket connection when report is generated in static mode (#​215, @​sebastianhaeni)

v3.0.2

Compare Source

• Improvements

  • Drop @babel/runtime dependency (#​209, @​realityking)
  • Properly specify minimal Node.js version in .babelrc (#​209, @​realityking)

• Bug Fix

  • Move some "dependencies" to "devDependencies" (#​209, @​realityking)

v3.0.1

Compare Source

• Bug Fix
  • Small UI fixes

v3.0.0

Compare Source

• Breaking change

  • Dropped support for Node.js v4. Minimal required version now is v6.14.4
  • Contents of concatenated modules are now hidden by default because of a number of related issues (details), but can be shown using a new checkbox in the sidebar.

• New Feature

  • Added modules search
  • Added ability to pin and resize the sidebar
  • Added button to toggle the sidebar
  • Added checkbox to show/hide contents of concatenated modules

• Improvements

  • Nested folders that contain only one child folder are now visually merged i.e. folder1 => folder2 => file1 is now shown like folder1/folder2 => file1 (thanks to @​varun-singh-1 for the idea)

• Internal

  • Dropped support for Node.js v4
  • Using MobX for state management
  • Updated dependencies

v2.13.1

Compare Source

• Improvement
  • Pretty-format the generated stats.json (#​180) @​edmorley)
• Bug Fix
  • Properly parse Webpack 4 async chunk with Array.concat optimization (#​184, fixes #​183)
• Internal
  • Refactor bundle parsing logic (#​184)

v2.13.0

Compare Source

• Improvement
  • Loosen bundle parsing logic (#​181). Now analyzer will still show parsed sizes even if:
    • It can't parse some bundle chunks. Those chunks just won't have content in the report. Fixes issues like #​160.
    • Some bundle chunks are missing (it couldn't find files to parse). Those chunks just won't be visible in the report for parsed/gzipped sizes.

v2.12.0

Compare Source

• New Feature
  • Add option that allows to exclude assets from the report (#​178)

v2.11.3

Compare Source

• Bug Fix
  • Filter out modules that weren't found during bundles parsing (#​177)

v2.11.2

Compare Source

• Bug Fix
  • Properly process stat files that contain modules inside of chunks array (#​175)
  • Fix parsing of async chunks that push to this.webpackJsonp array (#​176)

v2.11.1

Compare Source

• Improvement
  • Add support for parsing Webpack 4's chunked modules (#​159, @​jdelStrother)

v2.11.0

Compare Source

• Improvement
  • Show contents of concatenated module (requires Webpack 4) (#​158, closes #​157)

v2.10.1

Compare Source

• Improvement
  • Support webpack 4 without deprecation warnings. @​ai in #​156, fixes #​154

v2.10.0

Compare Source

• Bug Fix

  • Fix "out of memory" crash when dealing with huge stats objects (#​129, @​ryan953)

• Internal

  • Update dependencies (#​146)
  • Update gulp to v4 and simplify gulpfile (#​146, #​149)
  • Simplify ESLint configs (#​148)

v2.9.2

Compare Source

• Bug Fix

  • Add a listener for the 'error' event on the WebSocket server client (#​140)

• Internal

  • Clean up .travis.yml (#​140)
  • Update ws to version 4.0.0 (#​140)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.