[Snyk] Fix for 25 vulnerabilities

[Someguy123]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	679/1000 Why? Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962463	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-COLORSTRING-1082939	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
	541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASHTEMPLATE-1088054	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
	596/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.5	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	No	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: babel-eslint

The new version differs by 103 commits.

• a0fbd50 8.0.2
• 2004b91 require correct deps
• fa56d21 Always use unpad (#535)
• 295091d Allow ^ version for babel dependencies (#534)
• d3b8519 fix(package): update babylon to version 7.0.0-beta.31 (#533)
• 54ab4ac 8.0.1
• c1a7882 Update README.md support (#531) [skip ci]
• 51100c9 chore(package): update mocha to version 4.0.0 (#524)
• 5742b71 Adding optionalCatchBinding to plugins. (#521)
• 905887c 8.0.0
• 49493e4 update to beta.0
• 42d0c5b Remove already fixed workaround (#508)
• 25bd208 8.0.0-alpha.17
• 1468905 alpha.17
• 57c133e 8.0.0-alpha.15
• 1e41162 update (#504)
• c31b577 Readme update usage section (#501) [skip ci]
• c2626f9 Update eslint to the latest version 🚀 (#500)
• 3c6b2de chore(package): update husky to version 0.14.0 (#498)
• e052d5a Update install instructions to use latest stable release (#497) [skip ci]
• 8e3e088 8.0.0-alpha.13
• f757e22 Merge pull request #493 from danez/regression-test
• 5736be6 Update babylon
• 37f9242 Add Prettier (#491)

See the full diff

Package name: css-loader

The new version differs by 136 commits.

• 43179a8 chore(release): 1.0.0
• 3d53968 Merge remote-tracking branch 'origin/master'
• 240db53 version 1.0 (#742)
• 1b7acf7 Merge remote-tracking branch 'origin/master'
• 1703721 docs(README): add more context to `localIdentName` (#711)
• 1c51265 docs(README): fix malformed emoji (#701)
• 50f8ec0 Merge remote-tracking branch 'origin/master'
• 07444ad tests: css custom variables (#709)
• 3de8aa7 tests: css custom variables (#709)
• df497db chore(release): 0.28.11
• c788450 fix(lib/processCss): don't check `mode` for `url` handling (`options.modules`) (#698)
• c35d8bd chore(release): 0.28.10
• 9f876d2 fix(getLocalIdent): add `rootContext` support (`webpack >= v4.0.0`) (#681)
• 0452f26 test: hashes inside `@ font-face` url (#678)
• 630579d chore(release): 0.28.9
• 604bd4b chore(package): update dependencies
• d1d8221 fix: ignore invalid URLs (`url()`) (#663)
• 0fc46c7 chore(release): 0.28.8
• 333a2ce chore(package): update `dependencies`
• 39773aa ci(travis): use `npm`
• 8897d44 fix: proper URL escaping and wrapping (`url()`) (#627)
• 0dccfa9 fix(loader): correctly check if source map is `undefined` (#641)
• d999f4a docs: Update importLoaders documentation (#646)
• 05c36db test: removed redundant `modules` argument (#599)

See the full diff

Package name: koa-logger

The new version differs by 33 commits.

• e7b24bd 3.2.1
• 66f5551 bump deps
• a8c6c57 fix script
• 225b98e lint
• 3ded55e bump deps
• f683c31 travis - add node v10, v12
• 0f4e7a1 Fixed error when using custom error codes > 800. The default color at index 0 is used by default. ([Snyk] Fix for 2 vulnerabilities #73)
• d04c9d2 docs: added note about request-received
• 17cdb74 [feat] add support for request-received middleware (closes [Snyk] Fix for 1 vulnerabilities #76)
• 6bec129 3.2.0
• 7daa5f4 lint
• afc9680 add npmrc: disable package-lock
• 8862cc4 add a transporter to logger opts param ([Snyk] Fix for 1 vulnerabilities #65)
• 3481627 3.1.0
• d68995c travis: test on node@8
• b0493a5 lint
• 1e522e8 Adds Boom compatibility ([Snyk] Fix for 2 vulnerabilities #64)
• bfcd3ab 3.0.1
• df46732 Fixes error 'chalk[color] does not return function' when using custom ([Snyk] Security upgrade webpack from 1.15.0 to 3.0.0 #61)
• 866ff23 change `new Date()` to `Date.now()` for performance ([Snyk] Security upgrade sequelize-cli from 2.8.0 to 6.3.0 #60)
• cd1b6a2 3.0.0
• 28c4a0b lint
• fb947af use async function
• 8d26a8e travis: test node@7 only

See the full diff

Package name: node-sass

The new version differs by 250 commits.

• 3b556c1 7.0.2
• c716359 Bump sass-graph@^4.0.1 (#3292)
• 24741b3 docs(readme): fix docpad plugin link
• 1523330 feat: Drop Node 12
• 365d357 update https://registry.npm.taobao.org to https://registry.npmmirror.com
• 1456114 build(deps): bump actions/upload-artifact from 2 to 3
• b465b69 chore: bump GitHub Actions to Windows 2019 (#3254)
• e6194b1 build(deps): bump make-fetch-happen from 9.1.0 to 10.0.4
• 4edf594 build(deps): bump node-gyp from 8.4.1 to 9.0.0
• 29e2344 build(deps): bump actions/checkout from 2 to 3
• 85b0d22 build(deps): bump actions/setup-node from 2 to 3
• 3bb51da Use make-fetch-happen instead of request (#3193)
• adc2f8b build(deps): bump true-case-path from 1.0.3 to 2.2.1 (#3000)
• 77d12f0 chore: disable Apline for Node 16/17 builds
• 308d533 ci: use Python 3 for Node 12
• c818907 ci: unpin actions/setup-node to v2
• 99242d7 7.0.1
• 77049d1 build(deps): bump sass-graph from 2.2.5 to 4.0.0 (#3224)
• c929f25 build(deps): bump node-gyp from 7.1.2 to 8.4.1 (#3209)
• 918dcb3 Lint fix
• 0a21792 Set rejectUnauthorized to true by default (#3149)
• e80d4af chore: Drop EOL Node 15 (#3122)
• d753397 feat: Add Node 17 support (#3195)
• dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0

See the full diff

Package name: purest

The new version differs by 71 commits.

• 1c3ebaf Update codecov badge url
• bf70218 Update @ purest/config version
• 231e56e Update changelog
• cedf843 Update docs
• d8feaec Update build targets
• b2b77b1 Transform the common multipart option into formData for request legacy
• 11492e8 Set content-length by default
• d11f526 Remove the before hook test and logic
• e0dc53a Add todo reminders in the api module
• 46cec8d Minor fix
• 27e7870 Add custom oauth method
• 24db7d0 Remove all methods inherited from @ request/api and @ request/interface
• 9f4b6dd Update to @ request/api@0.6.0
• e8a95a0 Move the defaults logic to the request wrapper
• 2ac2a18 Merge the basic and query api modules
• 0e8326a Rename the basic option to api
• 65538e2 Rename the api option to alias
• cb86cb6 Move basic api to @ request/api
• e8855b2 Refactoring
• 936f3a4 Add codecov.io dev dep
• ba32104 Fix .travis.yml
• a409a08 Use standard eslint
• 9e1e24b Merge branch 'master' of @ purest/client
• 6ed61e9 Add options method

See the full diff

Package name: sequelize-cli

The new version differs by 28 commits.

• f409094 3.0.0
• df04135 changelog: v3
• 5633648 refactor: use single log/warn/error methods, make output pretty (#552)
• e5a9b15 fix(db:create/drop): properly quote database name, fixed #545
• 20d17ee chore(package): update js-beautify to version 1.7.1 (#547)
• 0846642 docs(migrations): point to docs site
• 6d583d2 fix: use directive for __filename, fixes #527
• 98613d2 Minor grammar fix (#541)
• 7c169b0 docs: how to use with SSL
• db51c18 docs: how to use with SSL
• 51bd094 3.0.0-3
• d87a71c changelog: v3.0.0-3 update
• c035f54 added: db:create / db:drop tasks (#540)
• 88ab111 fix: error when creating nested config (#539)
• bc980ed 3.0.0-2
• 6fae353 docs: changelog v3.0.0-2
• 2dcefdf fix(.sequelizerc): options files is not used by all commands (#537)
• f0911cf changelog v3.0.0-1
• 623e1db 3.0.0-1
• 733ced9 fix: update skeletons to use es6, closes #482
• c70231e added: warn when using with Sequelize v4
• a6290fd Docs (#535)
• e731a26 changelog: v3.0.0-0
• 05419ab 3.0.0-0

See the full diff

Package name: webpack

The new version differs by 250 commits.

• 4be093d 2.2.0
• 2278469 2.2.0-rc.8
• b946eb4 Merge pull request #3988 from malstoun/bug/2664
• 260e413 Merge pull request #3986 from webpack/bugfix/revert_use_of_buffer_dot_from
• 0ec7de9 Fix regression with watch cli opt, add tests for this case
• 72226db add missing disable line
• 4d30675 build fresh yarn.lock file to remove buffer polyfill
• 91c1f35 fix(node): rollback changes of Buffer.from to new Buffer() and bump down travis to 4.3 min node v
• 0b47602 2.2.0-rc.7
• db6ccbc Merge pull request #3978 from webpack/bugfix/conditional-reexports
• 82a5b03 Merge pull request #3977 from malstoun/bug/2664
• fc1a43b Merge pull request #3976 from timse/rely-on-defaults
• a44694a hoist exports declarations too
• 682bde8 Fix lint
• c6d7d90 Add tests
• af8d49e remove defaults values to shave a few bytes
• 9796696 2.2.0-rc.6
• e9bdb05 Merge pull request #3971 from webpack/bugfix/fix_available_vars_in_fmtp
• bd45bdc add test case for global in harmony modules
• bfccb20 fix PR
• 5a3a23f fix(nmf): Fix exports for var injection to include free glob exports or arguments
• 437dce4 2.2.0-rc.5
• 91cb1df Merge pull request #3970 from webpack/ci/appveyor
• 9fd55e5 Merge pull request #3969 from webpack/bugfix/issue-3964

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Improper Input Validation
🦉 More lessons are available in Snyk Learn