[Snyk] Fix for 2 vulnerabilities

[caniszczyk]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• ui/package.json
• ui/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18512280	828
	Directory Traversal SNYK-JS-POSTCSS-18512282	738

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Directory Traversal

[caniszczyk]

This set of upgrades includes multiple major versions for critical webpack build-chain components. These updates introduce significant breaking changes that will require configuration updates and careful testing.

1. webpack-dev-server (4.15.2 → 5.1.0)
This is a high-risk upgrade with major breaking changes in v5.0.0.

• Node.js Requirement: Support for Node.js versions below 18.12.0 has been dropped.
• Configuration Changes: Many options have been removed or altered. Notably, all CLI flags are removed in favor of configuration files, proxy.bypass is removed, and SockJS support is dropped.
• ESM Package: The package is now distributed as native ES Modules, which may affect your build setup.

2. css-loader (3.6.0 → 5.0.0)
This upgrade crosses two major versions (v4 and v5), both containing significant breaking changes.

• Webpack Requirement: v5.0.0 requires webpack 5.
• Default Behavior: The esModule option is now true by default, which changes how CSS module imports work. You may need to change import styles from './style.css' to import * as styles from './style.css'.
• Option Changes: Many top-level options were moved into a nested modules object in v4.0.0. The ~ alias for resolving node_modules is also deprecated.

3. autoprefixer (7.1.6 → 10.0.0)
This upgrade spans three major versions and requires a toolchain update.

• PostCSS 8: Version 10.0.0 requires PostCSS 8 and moves postcss to be a peerDependency, which you must install explicitly.
• Node.js Requirement: Support for Node.js versions 6, 8, and 11 has been dropped.

Other Upgrades:

• postcss-flexbugs-fixes (4.1.0 → 5.0.0): This also upgrades to PostCSS 8 and moves postcss to a peerDependency.

Recommendation: These upgrades are substantial and will likely break your existing development and build configurations. A careful migration is required. Review your webpack.config.js for webpack-dev-server and css-loader options, update your PostCSS plugin setup for autoprefixer and postcss-flexbugs-fixes, and ensure your Node.js version is compatible.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[netlify]

✅ Deploy Preview for devspace-docs canceled.

Name	Link
🔨 Latest commit	2b93a1e
🔍 Latest deploy log	https://app.netlify.com/projects/devspace-docs/deploys/6a71a6fd9e056c00089e5575