Update dependency webpack-bundle-analyzer to v3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
webpack-bundle-analyzer	devDependencies	major	2.11.1 -> 3.3.2

GitHub Vulnerability Alerts

GHSA-pgr8-jg6h-8gw6 / WS-2019-0058

Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify() without properly escaping input which may lead to Cross-Site Scripting.

---

Release Notes

webpack-contrib/webpack-bundle-analyzer

v3.3.2

Compare Source

• Bug Fix
  • Fix regression with escaping internal assets (#​264, fixes #​263)

v3.3.1

Compare Source

• Improvements

  • Use relative links for serving internal assets (#​261, fixes #​254)
  • Properly escape embedded JS/JSON (#​262)

• Bug Fix

  • Fix showing help message on -h flag (#​260, fixes #​239)

v3.3.0

Compare Source

• New Feature

  • Show/hide chunks using context menu (#​246, @​bregenspan)

• Internal

  • Updated dev dependencies

v3.2.0

Compare Source

• Improvements
  • Add support for .mjs output files (#​252, @​jlopezxs)

v3.1.0

Compare Source

• Bug Fix
  • Properly determine the size of the modules containing special characters (#​223, @​hulkish)
  • Update acorn to v6 (#​248, @​realityking)

v3.0.4

Compare Source

• Bug Fix
  • Make webpack's done hook wait until analyzer writes report or stat file (#​247, @​mareolan)

v3.0.3

Compare Source

• Bug Fix
  • Disable viewer websocket connection when report is generated in static mode (#​215, @​sebastianhaeni)

v3.0.2

Compare Source

• Improvements

  • Drop @babel/runtime dependency (#​209, @​realityking)
  • Properly specify minimal Node.js version in .babelrc (#​209, @​realityking)

• Bug Fix

  • Move some "dependencies" to "devDependencies" (#​209, @​realityking)

v3.0.1

Compare Source

• Bug Fix
  • Small UI fixes

v3.0.0

Compare Source

• Breaking change

  • Dropped support for Node.js v4. Minimal required version now is v6.14.4
  • Contents of concatenated modules are now hidden by default because of a number of related issues (details), but can be shown using a new checkbox in the sidebar.

• New Feature

  • Added modules search
  • Added ability to pin and resize the sidebar
  • Added button to toggle the sidebar
  • Added checkbox to show/hide contents of concatenated modules

• Improvements

  • Nested folders that contain only one child folder are now visually merged i.e. folder1 => folder2 => file1 is now shown like folder1/folder2 => file1 (thanks to @​varun-singh-1 for the idea)

• Internal

  • Dropped support for Node.js v4
  • Using MobX for state management
  • Updated dependencies

v2.13.1

Compare Source

• Improvement

  • Pretty-format the generated stats.json (#​180) @​edmorley)

• Bug Fix

  • Properly parse Webpack 4 async chunk with Array.concat optimization (#​184, fixes #​183)

• Internal

  • Refactor bundle parsing logic (#​184)

v2.13.0

Compare Source

• Improvement
  • Loosen bundle parsing logic (#​181). Now analyzer will still show parsed sizes even if:
    • It can't parse some bundle chunks. Those chunks just won't have content in the report. Fixes issues like #​160.
    • Some bundle chunks are missing (it couldn't find files to parse). Those chunks just won't be visible in the report for parsed/gzipped sizes.

v2.12.0

Compare Source

• New Feature
  • Add option that allows to exclude assets from the report (#​178)

v2.11.3

Compare Source

• Bug Fix
  • Filter out modules that weren't found during bundles parsing (#​177)

v2.11.2

Compare Source

• Bug Fix
  • Properly process stat files that contain modules inside of chunks array (#​175)
  • Fix parsing of async chunks that push to this.webpackJsonp array (#​176)

---

Renovate configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by WhiteSource Renovate. View repository job log here.