Remove dependency on deprecated/unmaintained bundle-loader

[rmja]

I'm submitting a feature request

• Library Version:
  master

Current behavior:
The plugin depends on bundle-loader as a runtime dependency, but that library is currently archived on GitHub and is no longer maintained. It has issues that have not been addressed for years, so it would be really nice if the plugin did not depend on its existence.

Expected/desired behavior:
Avoid using the deprecated bundle-loader dependency, and maybe replace its use with dynamic imports.

[Alexander-Taran]

Would you like to provide a pull request for it @rmja ?

[rmja]

I don't think that i know the internals of webpack and this plugin good enough to do this...

[MaximBalaganskiy]

bump!
there's a critical vulnerability in bundle-loader -> loader-utils@1.4.1

[Alexander-Taran]

@bigopon ping

[Garbageous]

Is there an ETA on a fix for this? Our SCA tool is giving us warnings about this.

[bigopon]

I'll get on this soon.

[bigopon]

I'm not aware of a replacement for bundle-loader, I think the simplest fix which I'll apply is to have a local copy in the dist of tis plugin and use it instead, then remove the dep on bundle-loader.

[rmja]

@bigopon if you do that, then please add this fix: webpack-contrib/bundle-loader#75

[bigopon]

v 5.0.5 has been published for the fix of this issue. Thanks everyone.

@rmja we can't just change it, can you help create a fail test case? Or if you want, can bundle the failing test case with your fix in a PR.