Security issue

Created patch against 2.0.x

Thanks, as a heads up, its usually bad practice to be building/committing these packages to publicly accessible places as they are strictly used in development of the module, never in application.

Anyhow, I've updated the patch to not just update the lock, but require the same versions as core and remove raw-loader per core issue #3319917: Remove raw-loader dependency → .

back to review, forgot patch

The patch looks good. I have reviewed, and scans do not show any issues after deploying.