Updates postcss-url to version 7

[aeimer]

GITHUB warned us in our project, so here the fix:

We found a potential security vulnerability in one of your dependencies.

The handlebars dependency defined in package-lock.json has a known moderate severity security vulnerability in version range < 4.0.0 and should be updated.

Only users who have been granted access to vulnerability alerts for this repository can see this message.
Learn more about vulnerability alerts

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed, please reply here (e.g. I signed it!) and we'll verify. Thanks.

---

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
• If your company signed a CLA, they designated a Point of Contact who decides which employees are authorized to participate. You may need to contact the Point of Contact for your company and ask to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the project maintainer to go/cla#troubleshoot.
• In order to pass this check, please resolve this problem and have the pull request author add another comment and the bot will run again.

[olivierlemasle]

As mentioned in the Contributing guide, could you please:

• sign the CLA and comment the PR,
• amend your commit to comply to the Commit message guidelines; I suppose that this would be correct:

build(@angular/cli): update postcss-url to version 7

Did you willingly omit to mention the particular vulnerability and the CVE link in order so as not to expose the vulnerability? If not, you could add more details in the commit message and/or the pull request.

Thank you!

[olivierlemasle]

Fixes #8521

[hansl]

@olivierlemasle actually this would be a fix(), not a build. build is for project management only, this affects created applications.

@aeimer I'll let you sign the CLA and reword your commit, but if nothing changes in the next 3 hours I'll make another PR (I was already in the process of upgrading those dependencies).

We'll release this fix next wednesday with 1.5.2.

[aeimer]

@hansl see #8528

[googlebot]

CLAs look good, thanks!

[hansl]

@aeimer thanks. FYI you don't need to create a new PR for this (I can change the commit message prior to merging). You could just open your branch, do git commit --amend, change the message then git push -f to update this PR. :)

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}