Packages.json includes a dependency on loader-utils ^1.1.0 however there are some **severe** vulnerabilities with this version see https://security.snyk.io/package/npm/loader-utils/1.1.0 (or: GitHub's dependabot scanner) Even if this package doesn't expose these vulnerabilities, having this dependency blocks other packages from using later loader-utils versions.