[Snyk] Fix for 13 vulnerabilities

[aliscco]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • tools/node_modules/eslint/node_modules/esrecurse/node_modules/estraverse/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
	541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASHTEMPLATE-1088054	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gulp

The new version differs by 134 commits.

• 55eb23a Release: 4.0.0
• 173a532 Docs: Fix the installation instructions
• ec54d09 Docs: Improve note about out-of-date docs
• 03b7c98 Docs: Update recipes to install gulp@next
• 2eba29e Docs: Remove run-sequence from recipes
• 76eb4d6 Docs: Add installation instructions & update badges
• fbc162f Docs: Remove references to gulp-util
• 3011cf9 Scaffold: Normalize repository
• f27be05 Update: Remove graceful-fs from test suite
• 361ab63 Upgrade: Update glob-watcher
• 064d100 Build: Avoid broken node 9
• 057df59 Release: 4.0.0-alpha.3
• c1ba80c Breaking: Upgrade major versions of glob-watcher, gulp-cli & vinyl-fs
• 89acc5c Docs: Improve ES2015 task exporting examples ([Snyk] Security upgrade jest from 24.9.0 to 28.0.0 #1999)
• 0ac9e04 Docs: Add "Project structure" section to CONTRIBUTING.md ([Snyk] Security upgrade lerna-changelog from 1.0.1 to 2.2.0 #1859)
• 723cbc4 Docs: Fix syntax in recipe example ([Snyk] Fix for 1 vulnerabilities #1715)
• d420a6a Docs: Have gulp.lastRun take a function to avoid task registration ([Snyk] Fix for 1 vulnerabilities #1828)
• 29ece6f Upgrade: Update undertaker
• e931cb0 Docs: Fix changelog typos ([Snyk] Security upgrade coveralls from 2.13.3 to 3.0.0 #1696)
• 477db84 Docs: Add a "BrowserSync with Gulp 4" recipe ([Snyk] Security upgrade xo from 0.37.1 to 0.42.0 #1659)
• d4ed3c7 Docs: Add options.cwd for gulp.src API ([Snyk] Security upgrade tap from 5.8.0 to 11.1.3 #1645)
• 5dc3b07 Docs: Update gulp.watch API to align with glob-watcher
• 0c66069 Breaking: Replace chokidar as gulp.watch with glob-watcher wrapper
• c3dbc10 Docs: Clarify incremental builds example ([Snyk] Security upgrade tap from 9.0.3 to 12.0.2 #1609)

See the full diff

Package name: gulp-bump

The new version differs by 14 commits.

• aa25493 1.0.0
• c87e010 clean required modules - add plugin error/log/vinyl
• f264fd1 remove gulp-util, add dotnotation type test
• ffa9596 rebuild plugin - close [Snyk] Security upgrade pacote from 11.3.5 to 12.0.0 #41 close [Snyk] Fix for 1 vulnerabilities #42 close [Snyk] Security upgrade pacote from 11.3.5 to 12.0.0 #43 close [Snyk] Security upgrade d3 from 5.7.0 to 7.0.0 #38
• dad1d96 0.3.1
• 776cac7 update license
• d588ac4 add preid to readme
• 7fb8a69 merge
• 3292fc2 0.3.0
• 59ef309 update deps
• 46fdc14 add test for preid
• 6920483 add basic test for preid
• 919cc8e Merge pull request [Snyk] Security upgrade acorn-private-class-elements from 0.1.1 to 0.2.0 #36 from scamden/master
• d23cb78 allow preid to be passed

See the full diff

Package name: gulp-filter

The new version differs by 27 commits.

• 845b913 5.1.0
• b00bb32 Meta tweaks
• 52df753 Remove deprecated gulp-util dependency (build(deps): bump minimatch from 3.0.4 to 3.1.2 in /tools/node-lint-md-cli-rollup #86)
• b9fb0bc 5.0.1
• b40dd36 Meta tweaks
• d7cf3d4 Support Windows for resolve path ([Snyk] Security upgrade acorn-private-class-elements from 0.1.1 to 0.2.0 #80)
• f27adc6 Fix testcase for Windows ([Snyk] Security upgrade mocha from 8.2.1 to 9.2.2 #81)
• 7276430 5.0.0
• 835efdf ES2015ify and require Node.js 4
• f148c7b Add support for relative parent paths ([Snyk] Security upgrade acorn-private-class-elements from 0.1.1 to 0.2.0 #78)
• 2e3dd05 Fix option typo
• f1dbe11 meta tweaks
• a551307 Merge pull request build(deps-dev): bump remark-html from 13.0.1 to 13.0.2 in /tools/doc #60 from leocaseiro/patch-1
• 922496e Fix documents with references from [Snyk] Fix for 1 vulnerabilities #55
• 317ec39 4.0.0
• b0728ab Merge pull request build(deps): bump path-parse from 1.0.6 to 1.0.7 in /tools/clang-format #59 from cb1kenobi/relative-fix
• 5fd40bc Fixed code to use the correct relative path wrt the current working directory.
• 3310ca3 improve readme
• 4163b9a 3.0.1
• 91c996a add XO
• 83b219b Merge pull request [Snyk] Fix for 1 vulnerabilities #46 from sindresorhus/stevemao-patch-1
• 93d4c4b Fixing tests
• b92d8e9 Bumping streamfilter
• 9124d6d Update options.restore brief to the latest API

See the full diff

Package name: gulp-git

The new version differs by 31 commits.

• 9327f6a 2.5.0
• 83ff535 core: remove deprecated gulp-util dependency ([Snyk] Security upgrade tap from 12.7.0 to 15.0.0 #176)
• d54339b Add current branch name example to readme
• 852ffda added the possiblity to use an array of strings as message in git.commit ([Snyk] Fix for 7 vulnerabilities #173)
• 61c9eaa node 4, 7, 8
• a5c8391 added the possiblity to use an array of strings as message in git.commit and git.tag to the docs ([Snyk] Fix for 19 vulnerabilities #172)
• f831f03 travis only clones depth 10, fixes tag test
• 38eb389 2.4.2
• 951c0d7 ensure all tags are returned if no message is sent - closes [Snyk] Security upgrade nodeunit from 0.9.5 to 0.11.3 #170
• 0accffa Added git.add({ cwd: '/cwd/path' }) option to ReadMe ([Snyk] Security upgrade mocha from 8.4.0 to 10.1.0 #169)
• 0d49cbf 2.4.1
• 71ba307 fix all double callback errors - closes [Snyk] Fix for 3 vulnerabilities #166
• 4578bed 2.4.0
• 2aeb295 Updated push.js, default branch to push will be current branch with this fix ([Snyk] Security upgrade mocha from 5.2.0 to 10.1.0 #163)
• 8e4ecd9 2.3.2
• 167d083 fix double callbacks + missing cb check - closes [Snyk] Fix for 12 vulnerabilities #162 closes [Snyk] Security upgrade mocha from 5.2.0 to 10.1.0 #159
• 968f95d 2.3.1
• de6fb9a Update require-dir for node v8 - closes [Snyk] Fix for 43 vulnerabilities #164
• 3afb0cd 2.3.0
• fa10a51 support git branch --contains ([Snyk] Security upgrade nyc from 14.1.1 to 15.0.0 #160)
• 747a196 2.2.0
• ca63976 Fix pull with callback only ([Snyk] Fix for 4 vulnerabilities #158)
• aaac3c7 update title
• 7894cdd 2.1.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution