Update dependencies

CHANGELOG.md

@@ -14,7 +14,7 @@ Changes since last non-beta release.
 
   This change may increase the file size of your bundles, and may change some behavior in your app if your code touches upon one of the edge cases where Loose mode differs from native JavaScript. There are notes in the linked PR about how to turn Loose mode back on if you need to, but consider migrating to Compiler Assumptions when you can. If you have already customized your babel config, this change probably won't affect you.
 
-- Use last modified timestamps rather than file digest to determine compiler freshness. [PR 97](https://github.com/shakacode/shakapacker/pull/94) by [tomdracz](https://github.com/tomdracz).
+- Use last modified timestamps rather than file digest to determine compiler freshness. [PR 97](https://github.com/shakacode/shakapacker/pull/97) by [tomdracz](https://github.com/tomdracz).
 
   Rather than calculating SHA digest of all the files in the paths watched by the compiler, we are now comparing the modified time of the `manifest.json` file versues the latest modified timestamp of files and directories in watched paths. Unlike calculating digest, which only looked at the files, the new calculation also considers directory timestamps, including the parent ones (i.e. `config.source_path` folder timestamp will be checked together will timestamps of all files and directories inside of it).
 
@@ -24,6 +24,10 @@ Changes since last non-beta release.
 - Adds `webpacker_precompile` setting to `webpacker.yml` to allow controlling precompile behaviour, similar to existing `ENV["WEBPACKER_PRECOMPILE"]` variable. [PR 102](https://github.com/shakacode/shakapacker/pull/102) by [Judahmeek](https://github.com/Judahmeek).
 - Adds `append_javascript_pack_tag` helper. Allows for easier usage and coordination of multiple javascript packs. [PR 94](https://github.com/shakacode/shakapacker/pull/94) by [tomdracz](https://github.com/tomdracz).
 
+### Improved
+- Bump dependency versions in package.json to address security vulnerabilities. [PR 109](https://github.com/shakacode/shakapacker/pull/109) by [tomdracz](https://github.com/tomdracz).
+- Add `webpack-dev-server` as `peerDependency` to make its usage clear. [PR 109](https://github.com/shakacode/shakapacker/pull/109) by [tomdracz](https://github.com/tomdracz).
+
 ## [v6.2.1] - April 15, 2022
 ### Fixed
 - Put back config.public_manifest_path, removed in 6.2.0 in PR 78. [PR 104](https://github.com/shakacode/shakapacker/pull/104) by [justin808](https://github.com/justin808).

package.json

@@ -12,16 +12,17 @@
     "yarn": ">=1 <4"
   },
   "peerDependencies": {
-    "@babel/core": "^7.15.5",
-    "@babel/plugin-transform-runtime": "^7.15.0",
-    "@babel/preset-env": "^7.15.6",
-    "@babel/runtime": "^7.15.4",
-    "babel-loader": "^8.2.2",
+    "@babel/core": "^7.17.9",
+    "@babel/plugin-transform-runtime": "^7.17.9",
+    "@babel/preset-env": "^7.16.11",
+    "@babel/runtime": "^7.17.9",
+    "babel-loader": "^8.2.4",
     "compression-webpack-plugin": "^9.0.0",
-    "terser-webpack-plugin": "^5.2.4",
-    "webpack": "^5.53.0",
+    "terser-webpack-plugin": "^5.3.1",
+    "webpack": "^5.72.0",
     "webpack-assets-manifest": "^5.0.6",
-    "webpack-cli": "^4.8.0",
+    "webpack-cli": "^4.9.2",
+    "webpack-dev-server": "^4.8.1",
     "webpack-merge": "^5.8.0"
   },
   "dependencies": {
@@ -30,7 +31,7 @@
     "path-complete-extname": "^1.0.0"
   },
   "devDependencies": {
-    "babel-loader": "^8.2.2",
+    "babel-loader": "^8.2.4",
     "compression-webpack-plugin": "^9.0.0",
     "esbuild-loader": "^2.18.0",
     "eslint": "^7.32.0",
@@ -41,7 +42,7 @@
     "eslint-plugin-react": "^7.26.0",
     "jest": "^27.2.1",
     "swc-loader": "^0.1.15",
-    "webpack": "^5.53.0",
+    "webpack": "^5.72.0",
     "webpack-assets-manifest": "^5.0.6",
     "webpack-merge": "^5.8.0"
   },