upgrade resolve-url-loader to 3.1.2 to resolve Prototype Pollution vulnerability

[malkrad]

Bug report

Describe the bug

resolve-url-loader is a production dependency inside next.
resolve-url-loader relies on adjust-sourcemap-loader as a production dependency.
adjust-sourcemap-loader relies on object-path as a production dependency.
object-path has a high severity vulnerability described here: https://www.npmjs.com/advisories/1573

To Reproduce

run 'npm audit'

Screenshot

Expected behavior

No high severity vulnerability inside production dependencies.

System information

• OS: Windows
• Version of Next.js: 9.5.5
• Version of Node.js: 12.9.0

Additional context

Although the vulnerability inside the newest object-path version is fixed: https://github.com/mariocasciaro/object-path,
the author of adjust-sourcemap-loader decided to drop it and replace its function with direct coding here: bholloway/adjust-sourcemap-loader#17
resolve-url-loader is being updated here: bholloway/resolve-url-loader#172
The last step, after the update and upgrade of resolve-url-loader is ready, is to upgrade resolve-url-loader inside next dependencies to resolve the vulnerability.

[malkrad]

resolve-url-loader is updated to 3.1.2: bholloway/resolve-url-loader#170 (comment)
Please consider upgrading the dependency inside package.json

[tahtoh]

hi, when i pull the latest next js version i still get 3.1.1 and its on the package.lock.json so i cant update it, how can i fix this.

[timneutkens]

You can use next@canary for now. New stable will be out soon.

[balazsorban44]

This issue has been automatically locked due to no recent activity. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.