Possible fix(deps): 75 vulnerable dependencies in yarn.lock

[begininvoke]

Came across something in client/yarn.lock around line 6233 that looked worth flagging.

The loader-utils package (versions < 1.4.1 and < 2.0.3) implements parseQuery by populating a plain object ({}) with keys taken directly from a URL‑encoded query string. An attacker can supply a key such as "proto", "prototype" or "constructor" and thereby mutate Object.prototype. This prototype pollution can affect every object created after the call, enabling further attacks like privilege escalation, denial‑of‑service, or injection of malicious properties into the application. The issue is rated CRITICAL because it is trivially exploitable and impacts all projects that use webpack loaders relying on this utility.

Something like this might fix it:

*** Begin Patch
*** Update File: node_modules/loader-utils/lib/parseQuery.js
@@
-function parseQuery(query) {
-  const result = {};
+function parseQuery(query) {
+  // Use a prototype‑less object to avoid prototype pollution attacks.
+  // Objects created via Object.create(null) do not inherit from Object.prototype,
+  // so malicious keys like "__proto__" cannot tamper with the global prototype.
+  const result = Object.create(null);
   if (!query) {
     return result;
   }
@@
-    const name = decodeURIComponent(pair[0]);
-    const value = decodeURIComponent(pair[1] || "");
-    result[name] = value;
+    const name = decodeURIComponent(pair[0]);
+    const value = decodeURIComponent(pair[1] || "");
+    // Guard against known prototype‑pollution vectors.
+    if (name === "__proto__" || name === "prototype" || name === "constructor") {
+      // Skip these keys; they would otherwise modify the object's prototype.
+      continue;
+    }
+    result[name] = value;
   }
   return result;
 }
*** End Patch

For reference: rule CVE-2022-37601. Rated critical.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.