# Contributing

Open an issue before changing source-map codecs, URL parsing, join ordering, or
error text. Bug reports need a minimal stylesheet, source map, loader chain,
expected `resolve-url-loader@5.0.0` behavior, actual behavior, operating system,
and webpack version. Pull requests must retain both upstream licenses and pass
`npm run verify`.

Do not report suspected vulnerabilities publicly; follow SECURITY.md.