Upgrade 'css-what' to fix high severity vulnerability

[webinarium]

The css-what library contains "Denial of Service" vulnerability, which has been fixed as of 5.0.1.
Could you please upgrade the webpack-encore dependencies as advised below.

Severity: High
Vulnerability: Denial of Service
Package: css-what
Patched in: >=5.0.1
Dependency of: @symfony/webpack-encore [dev]
Path: @symfony/webpack-encore > css-minimizer-webpack-plugin > cssnano > cssnano-preset-default > postcss-svgo > svgo > css-select > css-what
More info: https://npmjs.com/advisories/1754

[Lyrkan]

Hello @webinarium,

As you can see in the path you provided this is not a direct dependency of Encore.

The issue is that the latest version of svgo (2.3.0) relies on css-select@^3.1.2 which then requires css-what@^4.0.0.

There is a PR on svgo to update to css-select@^4.1.3 here: svg/svgo#1485
We can't do anything but wait for it to get merged.

Note that this vulnerability should not be that critical unless you're doing some really exotic stuff.