@angular/fire indirectly depends on webpack

[Ionaru]

Version info

Angular: 15.2.1

Firebase: 9.17.2

AngularFire: 7.5.0

Other (e.g. Ionic/Cordova, Node, browser, operating system):

• @ionic/angular: 6.6.0
• Node: 18.13.0
• Windows 11

How to reproduce these conditions

Steps to set up and reproduce

• npm install @angular/fire
• npm ls webpack --omit=dev

Expected behavior

my-project@0.0.1 C:\Users\name\Projects\my-project
`-- (empty)

Actual behavior

my-project@0.0.1 C:\Users\name\Projects\my-project
`-- @angular/fire@7.5.0
  `-- file-loader@6.2.0
    `-- webpack@5.75.0
      `-- terser-webpack-plugin@5.3.6
        `-- webpack@5.75.0 deduped

Additional information

A search of this repository does not show that file-loader is used anywhere, maybe it can be removed from https://github.com/angular/angularfire/blob/master/src/package.json? But I could be wrong.

Webpack should probably not be a (production)dependency, but a devDependency instead?

Running npm audit --omit=dev is how I noticed this dependency: GHSA-hc6q-2mpp-qw7j

[google-oss-bot]

This issue does not seem to follow the issue template. Make sure you provide all the required information.

[jamesdaniels]

Ah we used to use file-loader but no longer do, since Firestore fixed their bundling issue. We'll remove this, thanks for pointing out.