US582211 Update loader-utils version to 2.0.3

[vishalkumar-barnwal]

https://internal.almoctane.com/ui/entity-navigation?p=131002/6001&entityType=work_item&id=582211

[buildmachine-sou-jenkins2]

CI Build Link:
https://jenkins.swinfra.net/job/SEPG/job/MicroFocus/job/MicroFocus~microfocus.github.io~US582211-loader-utils-2.0.3~CI

[buildmachine-sou-jenkins2]

The Documentation QA site for this branch has been built:
https://pages.github.houston.softwaregrp.net/sepg-docs-qa/MicroFocus_CI_microfocus.github.io_US582211-loader-utils-2.0.3

[vishalkumar-barnwal]

@andyreidz the dependabot alert has been withdrawn, it's no longer available. Do we still need this change in the version of loader-utils?

BTW the vulnerability details are here.

[andyreidz]

@vishalkumar-barnwal Can you research why alerts get withdrawn, in the general sense.
Also, have other opensource project experienced the same issue?

[vishalkumar-barnwal]

@andyreidz, CVE-2022-37601 is actually based on the issue. Dependabot suggestion was to upgrade loader-utils version to 2.0.3 or above but few hours back only issue fixed for v1.4.1 also because of these reasons. Suggested advisory also updated. This could be a reason that the old alert has been withdrawn.

References:
https://nvd.nist.gov/vuln/detail/CVE-2022-37601
webpack/loader-utils#212
https://github.com/webpack/loader-utils/releases/tag/v2.0.3
https://github.com/webpack/loader-utils/releases/tag/v1.4.1
GHSA-76p3-8jx3-jpfq