Installation

npm install @stackline/loader-utils@1.0.6

Node.js: >=12.13.0. Read the compatibility and maintenance notes before migrating.

Usage and API

@stackline/loader-utils

Maintained, security-hardened fork compatible with loader-utils 2.0.4 consumers.

Documentation | npm | Issues | Repository

Current package version: 1.0.6

Why this package?

Maintained, security-hardened utilities for webpack loaders. This package preserves the complete public API and behavior of loader-utils@2.0.4, including Webpack 4 option parsing and legacy deep imports.

Why This Fork Exists

The upstream webpack/loader-utils repository was archived in March 2025. Stackline maintains this fork so projects can retain the established API while using an actively tested package with:

• two pinned leaf dependencies with documented current maintenance evidence;
• clean direct and legacy-name installations;
• zero known npm audit vulnerabilities;
• exhaustive differential tests against loader-utils@2.0.4 and downstream Webpack 4/5 builds;
• Node.js 12.13 through current Node.js compatibility checks;
• TypeScript declarations validated with TypeScript 3.9 and current TypeScript;
• reproducible release artifacts, SBOMs and immutable GitHub releases.

This is an independent fork and is not affiliated with webpack or the JS Foundation.

Compatibility

The scoped package uses its own 1.x release line. @stackline/loader-utils@1.0.3 is the first public release, validated against the complete 2.0.4 contract and real resolve-url-loader Webpack 4/5 builds.

Installation

Install

New projects can use the scoped name:

Usage

npm install @stackline/loader-utils

const loaderUtils = require("@stackline/loader-utils");

For an existing project that imports loader-utils, use an npm alias and keep every source import unchanged:

npm install loader-utils@npm:@stackline/loader-utils

const loaderUtils = require("loader-utils");

Features and Integrations

Documentation

• Migration guide
• Compatibility policy
• Production dependency review
• Security policy
• Public documentation

Security

Review inputs and the package-specific compatibility limits before processing untrusted data. Report suspected vulnerabilities as described in the security policy.

API Surface

API

Loader context helpers

getOptions, parseQuery, stringifyRequest, getRemainingRequest, getCurrentRequest and parseString retain their loader-utils@2.0.4 signatures and behavior. Query parsing additionally ignores __proto__, prototype and constructor keys.

const options = loaderUtils.getOptions(this);
const request = loaderUtils.stringifyRequest(this, this.resourcePath);

isUrlRequest(url)

Returns whether a URL should be handled as a webpack request.

if (loaderUtils.isUrlRequest("images/logo.svg")) {
  // Handle the value as a module request.
}

urlToRequest(url, root?)

Converts a resource URL to a webpack module request.

loaderUtils.urlToRequest("styles/main.css");
// "./styles/main.css"

loaderUtils.urlToRequest("/images/logo.svg", "/public");
// "/public/images/logo.svg"

interpolateName(loaderContext, name?, options?)

Interpolates [ext], [name], [path], [folder], [query], [hash] and [contenthash] filename tokens.

const filename = loaderUtils.interpolateName(
  { resourcePath: "/src/logo.svg" },
  "assets/[name].[contenthash:8].[ext]",
  { content: Buffer.from("file contents") }
);

Supported digest templates include xxhash64, md4, native-md4, Node.js crypto algorithms, hex, base26, base32, base36, base49, base52, base58, base62, base64 and base64safe.

getHashDigest(buffer, hashType?, digestType?, maxLength?)

Creates a loader-compatible content digest.

loaderUtils.getHashDigest(
  Buffer.from("file contents"),
  "sha256",
  "base64safe",
  12
);

Local Development

git clone https://github.com/alexandroit/stackline-loader-utils.git
cd stackline-loader-utils
npm ci
npm run verify

Release tooling uses Node.js 24.20.0 and npm 11.19.0. The consumer runtime contract remains the one documented above.

Consumer Smoke Test

Run the repository's existing consumer/package check after installing development dependencies:

npm run test:smoke

Release Checklist

Verification

npm ci
npm run verify

The release gate runs linting, the complete upstream suite, differential compatibility tests, security regressions, TypeScript 3.9/current checks, coverage thresholds, direct and alias installation smoke tests, package validation and full/prod npm audits.

Run npm run verify and inspect the package contents before release. Publish a new version through the GitHub Actions publishing workflow, using the SHA-512 digest of the reviewed tarball. Verify the exact published version, tarball integrity, and npm provenance after the run.

License

License and Attribution

MIT. The original copyright and license are preserved in LICENSE. See NOTICE and THIRD_PARTY_LICENSES.md for provenance and attribution.

Dependency maintenance for this release is documented in DEPENDENCY_UPDATES.md.

Credits and original authors

• Stackline Maintainers.
• Tobias Koppers.
• JS Foundation and other contributors.
• Stackline maintenance: Alexandro Paixao Marques and Stackline contributors.

Original copyright, license notices and contributor acknowledgements remain part of this distribution. Stackline maintenance does not replace authorship of the original work.

Community and Links

• Stackline website
• GitHub projects
• npm packages
• Reddit community — r/Stackline
• Maintainer LinkedIn

Use this repository's issue tracker for reproducible bugs and feature requests. Join r/Stackline for examples, usage questions and release discussions.

Migration

Migration

Keep Existing Imports

Replace the registry dependency with an npm alias:

{
  "dependencies": {
    "loader-utils": "npm:@stackline/loader-utils@1.0.2"
  }
}

No JavaScript or TypeScript import changes are required:

const loaderUtils = require("loader-utils");

Use the Scoped Name

New code can depend directly on the maintained package:

{
  "dependencies": {
    "@stackline/loader-utils": "1.0.2"
  }
}

const loaderUtils = require("@stackline/loader-utils");

Compatibility Baseline

The 1.0.x Stackline line targets the complete loader-utils@2.0.4 contract: all ten root exports, export order, overlapping URL/hash behavior, JSON5 query parsing, emoji interpolation and deep imports. This allows existing Webpack 4 loader paths to migrate without source changes.

Lockfile Verification

After changing the dependency, regenerate the lockfile and verify the complete installed tree:

npm install
npm ls --all
npm audit --omit=dev --audit-level=low

Compatibility

Compatibility Policy

@stackline/loader-utils is a maintained, security-hardened fork of loader-utils@2.0.4.

Preserved Contract

• require("loader-utils") when installed through an npm alias;
• require("@stackline/loader-utils") for direct scoped use;
• all ten root exports in their original order;
• getHashDigest, interpolateName, isUrlRequest and urlToRequest with 2.0.4 defaults and edge behavior;
• getOptions, parseQuery, stringifyRequest, getRemainingRequest, getCurrentRequest and parseString;
• CommonJS behavior and dynamic ESM import;
• published lib/* deep imports;
• Node.js 12.13 or newer;
• filename tokens, digest defaults and error behavior from the baseline;
• TypeScript 3.9-compatible declarations.

Version Mapping

Patch releases may add tests, documentation, declarations and security hardening that does not intentionally change the public contract. Any intentional breaking change requires a new major version.

Continuous Evidence

The suite executes a broad differential matrix against an independently installed loader-utils@2.0.4, including hash algorithms, every custom base, truncation, URL roots, query forms, request serialization and deterministic emoji interpolation. The package is also installed under both its scoped name and the legacy loader-utils key before release, then exercised by real Webpack 4 and 5 builds in @stackline/resolve-url-loader.

Release changes

Changelog

1.0.4 - 2026-09-28

• Pin verified Stackline maintenance forks under the existing dependency import names; see DEPENDENCY_UPDATES.md.
• Preserve the package API, supported runtimes, upstream comparison tests, and original licenses.

[1.0.3] - 2026-09-28

• Organize package documentation, preserve API and migration examples, and add Stackline community links.
• Improve package discovery keywords with precise domain terms and stackline.
• Pin GitHub Actions release tooling and require an explicit missing-version response before publication.

All notable changes to this project will be documented in this file.

[1.0.2] - 2026-08-30

Fixed

• Restored the complete loader-utils@2.0.4 contract, including export order and the original isUrlRequest, urlToRequest, hashing, interpolation and option-parsing semantics required by real Webpack 4 loaders.
• Replaced the mixed 2.0.4/3.3.1 behavior from the Verdaccio-only 1.0.1 preflight after downstream resolve-url-loader tests exposed an incompatible non-file URL classification.
• Preserved 2.0.4 custom-base hash output without big.js through a native encoder verified across algorithms, bases and truncation lengths.

Security

• Ported the linear-time URL and hash hardening from the later upstream line without changing the 2.0.4 public outputs.
• Recursively ignores __proto__, prototype and constructor in parsed and object-form loader options.
• Pins the complete production closure to maintained leaf packages emojis-list@3.0.0 and json5@2.2.3, with exact license checks and zero known npm audit findings.

Compatibility

• Added exhaustive differential tests against an independently installed loader-utils@2.0.4 and downstream Webpack 4/5 release gates.
• Retains CommonJS, dynamic ESM import, published deep imports, Node.js 12.13+ and TypeScript 3.9 declarations.

[1.0.1] - 2026-08-30

Added

• Restored the loader-utils@2.0.4 helper APIs required by Webpack 4 loader paths while preserving the 3.3.1 current API behavior.
• Added differential coverage against both upstream baselines.
• Added recursive unsafe-key filtering for __proto__, prototype and constructor in query parsing.
• Pinned json5@2.2.3, documented current maintenance evidence, shipped its complete MIT license and verified the exact one-package production closure.

Changed

• Raised the Stackline package version after the Verdaccio-only 1.0.0 preflight artifact exposed the missing Webpack 4 compatibility path.

[1.0.0] - 2026-08-30

Added

• First Stackline release based on loader-utils@3.3.1.
• Warning-free direct and legacy-name installation gates with recursive dependency and npm advisory verification.
• TypeScript declarations tested with TypeScript 3.9 and current TypeScript.
• Differential compatibility, security, ESM and package-boundary tests.
• Public maintenance, migration, compatibility, provenance and security documentation.

Preserved

• The complete upstream CommonJS API, behavior, deep imports, Node.js 12.13 floor, source history and MIT attribution.

3.3.1 (2024-06-05)

Bug Fixes

• base64safe regex (3b2d3b1)

3.3.0 (2024-06-04)

Features

• add digestType 'base64safe' (#259) (af15793)

3.2.2 (2024-05-29)

Bug Fixes

• unreachable code for directories (128f945)

3.2.1 (2022-11-11)

Bug Fixes

• ReDoS problem (#224) (d2d752d)

3.2.0 (2021-11-11)

Features

• hash uniformity for base digests (451858b)

3.1.3 (2021-11-04)

Bug Fixes

• crash with md4 hash (#198) (ef084d4)

3.1.2 (2021-11-04)

Bug Fixes

• bug with unicode characters (#196) (0426405)

3.1.1 (2021-11-04)

Bug Fixes

• base64 and unicode characters (02b1f3f)

3.1.0 (2021-10-29)

Features

• added md4 (wasm version) and md4-native (crypto module version) algorithms (cbf9d1d)

3.0.0 (2021-10-20)

⚠ BREAKING CHANGES

• minimum supported Node.js version is 12.13.0 (93a87ce)
• use xxhash64 by default for [hash]/[contenthash] and getHashDigest API
• [emoji] was removed without replacements, please use custom function if you need this
• removed getOptions in favor loaderContext.getOptions (loaderContext is this inside loader function), note - special query parameters like ?something=true is not supported anymore, if you need this please do it on loader side, but we strongly recommend avoid it, as alternative you can use ?something=1 and handle 1 as true
• removed getRemainingRequest in favor loaderContext.remainingRequest (loaderContext is this inside loader function)
• removed getCurrentRequest in favor loaderContext.currentRequest (loaderContext is this inside loader function)
• removed parseString in favor JSON.parse
• removed parseQuery in favor new URLSearchParams(loaderContext.resourceQuery.slice(1)) where loaderContext is this in loader function
• removed stringifyRequest in favor JSON.stringify(loaderContext.utils.contextify(loaderContext.context || loaderContext.rootContext, request)) (loaderContext is this inside loader function), also it will be cachable and faster
• isUrlRequest ignores only absolute URLs and #hash requests, data URI and root relative request are handled as requestable due webpack v5 support them

Bug Fixes

• allowed the interpolateName API works without options (862ea7d)

2.0.0 (2020-03-17)

⚠ BREAKING CHANGES

• minimum required Node.js version is 8.9.0 (#166) (c937e8c)
• the getOptions method returns empty object on empty query (#167) (b595cfb)
• Use md4 by default

1.4.0 (2020-02-19)

Features

• the resourceQuery is passed to the interpolateName method (#163) (cd0e428)

1.3.0 (2020-02-19)

Features

• support the [query] template for the interpolatedName method (#162) (469eeba)

1.2.3 (2018-12-27)

Bug Fixes

• interpolateName: don't interpolated hashType without hash or contenthash (#140) (3528fd9)

1.2.2 (2018-12-27)

Bug Fixes

• fixed a hash type extracting in interpolateName (#137) (f8a71f4)

1.2.1 (2018-12-25)

Bug Fixes

• isUrlRequest: better handle absolute urls and non standards (#134) (aca43da)

Reverts

• PR #79 (#135) (73d350a)

1.2.0 (2018-12-24)

Features

• interpolateName: support [contenthash]

Fixes

• urlToRequest: empty urls are not rewritten to relative requests
• urlToRequest: don't rewrite absolute urls
• isUrlRequest: ignore all url with extension (like moz-extension:, ms-browser-extension: and etc)
• isUrlRequest: ignore about:blank
• interpolateName: failing explicitly when ran out of emoji
• interpolateName: [hash] token regex in interpolate string to capture any hash algorithm name
• interpolateName: parse string for emoji count before use

1.1.0 (2017-03-16)

Features

• automatic-release: Generation of automatic release (7484d13)
• parseQuery: export parseQuery (ddf64e4)

Release files and references

• README.md
• CHANGELOG.md
• MIGRATION.md
• COMPATIBILITY.md
• LICENSE
• NOTICE
• Package and publication metadata
• Full text documentation

Package bytes, npm provenance and the immutable GitHub release were verified for this version. Security checks describe the reviewed release; documented compatibility risks and upstream reports are not blanket claims of resolution.