[Snyk] Fix for 6 vulnerabilities

[Exnadella]

User description

Snyk has created this PR to fix 6 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• packages/common/package.json
• packages/common/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	696
	Prototype Pollution SNYK-JS-MINIMIST-559764	601
	Validation Bypass SNYK-JS-KINDOF-537849	506
	Prototype Pollution SNYK-JS-MINIMIST-2429795	506
	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	506
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	479

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Validation Bypass
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution

---

PR Type

Bug fix, Enhancement

---

Description

• Updated several dependencies in package.json to newer versions to address security vulnerabilities.
• Modified package-lock.json to ensure consistency with the updated package.json.
• Fixed vulnerabilities related to Regular Expression Denial of Service (ReDoS), Prototype Pollution, and Validation Bypass.

---

Changes walkthrough 📝

	Relevant files
Dependencies	package.json Update dependencies to fix vulnerabilities and enhance security packages/common/package.json Updated depcheck dependency version from ^0.6.0 to ^1.4.7. Updated gulp-eslint dependency version from ^4.0.0 to ^6.0.0. Updated gulp-mocha dependency version from ^6.0.0 to ^8.0.0. Updated run-sequence dependency version from ^1.0.0 to ^2.2.1. +5/-5      package-lock.json Update package-lock.json to match dependency upgrades        packages/common/package-lock.json Updated lock file to reflect changes in package.json. Resolved vulnerabilities by upgrading dependencies. +6584/-6483
Additional files (token-limit)	package-lock.json ...                                                                                                            packages/common/package-lock.json ... +6584/-6483

---

💡 PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[codiumai-pr-agent-pro]

PR Reviewer Guide 🔍

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Key issues to review Dependency Updates The PR updates several dependencies to newer versions, which may introduce breaking changes or require additional testing.

[codiumai-pr-agent-pro]

PR Code Suggestions ✨

Category	Suggestion	Score
Dependency update	Update the depcheck dependency to the latest version Update the depcheck dependency to the latest version 1.4.7 to benefit from bug fixes and new features. packages/common/package.json [22] -"depcheck": "^0.6.0", +"depcheck": "^1.4.7", Apply this suggestion Suggestion importance[1-10]: 9 Why: The suggestion correctly identifies the update of the depcheck dependency from version 0.6.0 to 1.4.7, which is reflected in the PR diff. This update is beneficial for incorporating bug fixes and new features.	9
	Update the gulp-eslint dependency to a newer version Update the gulp-eslint dependency to version 6.0.0 to ensure compatibility with the latest ESLint versions and benefit from improvements. packages/common/package.json [24] -"gulp-eslint": "^4.0.0", +"gulp-eslint": "^6.0.0", Apply this suggestion Suggestion importance[1-10]: 9 Why: The suggestion accurately reflects the update of the gulp-eslint dependency from version 4.0.0 to 6.0.0 in the PR diff, ensuring compatibility with the latest ESLint versions and improvements.	9
	Update the gulp-mocha dependency to a newer version Update the gulp-mocha dependency to version 8.0.0 to benefit from the latest features and bug fixes in Mocha integration with Gulp. packages/common/package.json [25] -"gulp-mocha": "^6.0.0", +"gulp-mocha": "^8.0.0", Apply this suggestion Suggestion importance[1-10]: 9 Why: The suggestion correctly identifies the update of the gulp-mocha dependency from version 6.0.0 to 8.0.0, as shown in the PR diff, which provides the latest features and bug fixes for Mocha integration with Gulp.	9
	Update the gulp-typescript dependency to a newer version Update the gulp-typescript dependency to version 4.0.0 to ensure compatibility with the latest TypeScript versions and benefit from improvements in Gulp integration. packages/common/package.json [27] -"gulp-typescript": "^3.0.0", +"gulp-typescript": "^4.0.0", Apply this suggestion Suggestion importance[1-10]: 9 Why: The suggestion accurately reflects the update of the gulp-typescript dependency from version 3.0.0 to 4.0.0 in the PR diff, ensuring compatibility with the latest TypeScript versions and improvements in Gulp integration.	9

[codiumai-pr-agent-pro]

CI Failure Feedback 🧐

(Checks updated until commit 9ae9312)

Action: test (ubuntu-latest)

Failed stage: Run npm run bootstrap [❌]

Failure summary: The action failed due to an error during the execution of the npm ci command within the lerna managed workspace 'wct-mocha'. The command exited with a non-zero status (exit code 1), indicating a failure. Multiple deprecated packages were detected, which might have contributed to the failure.

Relevant error logs: 1: ##[group]Operating System 2: Ubuntu ... 554: npm WARN deprecated [email protected]: this library is no longer supported 555: npm WARN deprecated [email protected]: Glob versions prior to v9 are no longer supported 556: npm WARN deprecated [email protected]: This package is no longer supported. 557: npm WARN deprecated [email protected]: This module is no longer supported. 558: npm WARN deprecated [email protected]: This package is no longer supported. 559: npm WARN deprecated [email protected]: This package is no longer supported. 560: npm WARN deprecated [email protected]: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. 561: npm WARN deprecated [email protected]: This package is no longer supported. 562: npm WARN deprecated @lerna/[email protected]: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. ... 738: npm ERR! [-ws|--workspaces] [--include-workspace-root] [--install-links] 739: npm ERR! 740: npm ERR! aliases: clean-install, ic, install-clean, isntall-clean 741: npm ERR! 742: npm ERR! Run "npm help ci" for more info 743: npm ERR! A complete log of this run can be found in: 744: npm ERR! /home/runner/.npm/_logs/2024-09-05T17_50_58_310Z-debug-0.log 745: lerna ERR! npm ci exited 1 in 'wct-mocha' 746: ##[error]Process completed with exit code 1.

---

✨ CI feedback usage guide:

---

The CI feedback tool (/checks) automatically triggers when a PR has a failed check.
The tool analyzes the failed checks and provides several feedbacks:

• Failed stage
• Failed test name
• Failure summary
• Relevant error logs

In addition to being automatically triggered, the tool can also be invoked manually by commenting on a PR:

/checks "https://github.com/{repo_name}/actions/runs/{run_number}/job/{job_number}"

where {repo_name} is the name of the repository, {run_number} is the run number of the failed check, and {job_number} is the job number of the failed check.

Configuration options

• enable_auto_checks_feedback - if set to true, the tool will automatically provide feedback when a check is failed. Default is true.
• excluded_checks_list - a list of checks to exclude from the feedback, for example: ["check1", "check2"]. Default is an empty list.
• enable_help_text - if set to true, the tool will provide a help message with the feedback. Default is true.
• persistent_comment - if set to true, the tool will overwrite a previous checks comment with the new feedback. Default is true.
• final_update_message - if persistent_comment is true and updating a previous checks message, the tool will also create a new message: "Persistent checks updated to latest commit". Default is true.

See more information about the checks tool in the docs.