[Snyk-dev] Fix for 11 vulnerabilities #30

michael-go · 2022-06-19T17:34:42Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	No	Proof of Concept
681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	No	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	No	Proof of Concept
731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	No	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	No	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	No	Proof of Concept
541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	No	Proof of Concept
589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
596/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.5	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	No	Proof of Concept
636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	No	Proof of Concept
589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: cheerio

The new version differs by 106 commits.

c3ec1cd Release 0.20.0
ef848ca Add coveralls badge, remove link to old report
dbcbe90 Merge pull request #808 from leifhanack/lodash4
c04ead1 Merge pull request #668 from rwaldin/prop-method
b5531bb Merge pull request #671 from twolfson/dev/fallback.select.content.sqwished
9d98bd7 Merge pull request #704 from Rycochet/master
1b9c5c9 Merge pull request #797 from Delgan/641-appendTo_prependTo
b12cbe8 Update lodash dependeny to 4.1.0
8c9b2e0 Merge pull request #796 from Delgan/fix_780
b09db31 Fix PR #726 adding 'appendTo()' and 'prependTo()'
ce8829d Added appendTo and prependTo with tests #641
4779762 Fix #780 by changing options context in '.find()'
8dc1cc9 Add an unit test checking the query of child
b27bed6 fix #667: attr({foo: null}) removes attribute foo, like attr('foo', null)
70c5608 Include reference to dedicated "Loading" section
fa70a84 Added load method to $
4e8483a update css-select to 1.2.0
5f2777a Merge pull request #732 from jugglinmike/reinstate-toarray
106e42a Merge pull request #776 from dYale/master
97149d3 Fixing Grammatical Error
a1367ee Merge pull request #739 from TrySound/npm-files
6c73b7a Merge pull request #773 from JaKXz/patch-1
48bb22d Test against node v0.12 --> v4.2
ec2414d Correct output in example

See the full diff

Package name: glob

The new version differs by 89 commits.

3a7e71d v5.0.15
841fda0 use latest minimatch
4ba54a8 Skip some tests on Windows, make others pass
3936e1e Build: Add build for node v4
c47d451 v5.0.14
821fac8 Handle ENOTSUP for sync glob as well as async
9625618 Test for when readdir raises ENOTSUP
0a2b519 Generate fixtures more effectively, with -O instead of eval
f96190b Use js for benchmark cleanup
957fd93 Fix some 'use strict' errors
bf3381e Treat ENOTSUP like ENOTDIR in readdir
507733d v5.0.13
f5878af Do not emit 'match' events for ignored items
9439afd v5.0.12
6071f3a Revert "Use graceful-fs if available"
38ff16c v5.0.11
f09292b Use graceful-fs if available
4f39b60 Remove duplicate option description
e3cdccc v5.0.10
480da05 ignore .nyc_output, upgrade tap, use coverage, rm fixtures
155124b add more sync cb thrower tests
f7302ca Test base-matching
7530e88 v5.0.9
b185987 reduce cases where tests need to be regenerated

See the full diff

Package name: js-yaml

The new version differs by 25 commits.

2321c0b 3.2.7 released
6de643d Browser files rebuild
eaa5f30 Deps update, closes Make internal dependency policy less strict and point to a phantomjs … dalekjs/dalek#167
9a7ae34 3.2.6 released
fc35388 Browser files rebuild
f0d7ea9 Merge pull request Unable to stop test suite dalekjs/dalek#163 from Hypercubed/patch-1
a937a35 Update utils.js
c6a2320 Rename codepoint -> c
2539825 Rename encodeUTF16Char -> charFromCodepoint
14e3b76 Fix encoding of UTF-16 surrogate pairs
8a73181 3.2.5 released
a898401 Browser files rebuild
d36d316 Improve benchmark/add-by-tag.sh script
c2de702 Fixed bug: Tag on an empty node didn't resolve in some cases.
04ff648 Correct test description for issue dalek callback or custom functions dalekjs/dalek#154
f1a248d Fix indent checking within skipSeparationSpace function
52aa9cc Fix resolving of all built-in types on empty nodes
478e66b Add benchmark/implementations to .jshintignore
bf82559 Add benchmark/add-by-tag.sh script for quick downloading of old releases
d7b136c Ignore benchmark/implementations/* expect `current`
a88d676 Clean up benchmark/implementations
19bac78 3.2.4 released
a682a86 Update HISTORY.md
25f5c87 Merge pull request resize doesnt work properly dalekjs/dalek#155 from paolochiodi/master