[Snyk] Fix for 1 vulnerabilities

[mikolajroszak]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: os-name

The new version differs by 4 commits.

• 3bd71d6 4.0.0
• a1adfb8 Require Node.js 10
• 6e18891 Tidelift tasks
• 4de9adc Create funding.yml

See the full diff

Package name: semver

The new version differs by 140 commits.

• e7b78de chore: release 7.5.2
• 58c791f fix: diff when detecting major change from prerelease (fix: fix broken snyk help snyk/cli#566)
• 5c8efbc fix: preserve build in raw after inc (fix: temporarily remove new Gradle configuration options from help snyk/cli#565)
• 717534e fix: better handling of whitespace (#564)
• 2f738e9 chore: bump @ npmcli/template-oss from 4.14.1 to 4.15.1 (feat: preparation for go modules support snyk/cli#558)
• aa016a6 chore: release 7.5.1
• d30d25a fix: show type on invalid semver error (fix: Improve dockerfile instruction parser snyk/cli#559)
• 09c69e2 chore: bump @ npmcli/template-oss from 4.13.0 to 4.14.1 (#555)
• 5b02ad7 chore: release 7.5.0
• e219bb4 fix: throw on bad version with correct error message (Revert "chore: refactor auth to async await" snyk/cli#552)
• 503a4e5 feat: allow identifierBase to be false (chore: refactor auth to async await snyk/cli#548)
• fc2f3df fix: incorrect results from diff sometimes with prerelease versions (#546)
• 2781767 fix: avoid re-instantiating SemVer during diff compare (chore: Convert help command handling to typescript snyk/cli#547)
• 82aa7f6 chore: release 7.4.0
• 731d896 chore: enable CD (refactor: add types to args parser, simplify the code snyk/cli#545)
• 940723d fix: intersects with v0.0.0 and v0.0.0-0 (#538)
• aa516b5 fix: faster parse options (chore: convert config to ts snyk/cli#535)
• 61e6ea1 fix: faster cache key factory for range (fix: oracle linux version detection snyk/cli#536)
• f8b8b61 fix: optimistic parse (fix: remove incorrect Gradle logging snyk/cli#541)
• 796cbe2 fix: semver.diff prerelease to release recognition (chore: drop console.logs snyk/cli#533)
• 3f222b1 fix: reuse comparators on subset (fix: Use actual package manager on test runs snyk/cli#537)
• 113f513 feat: identifierBase parameter for .inc (fix: bump python plugin to fix bug with urls in req.txt snyk/cli#532)
• ea689bc chore: basic type test for RELEASE_TYPES
• c5d29df docs: Add "Constants" section to README

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Pages

Latest commit:	c69b579
Status:	🚫  Build failed.

View logs

[secure-code-warrior-for-github]

Micro-Learning Topic: Regular expression denial of service (Detected by phrase)

Matched on "Regular Expression Denial of Service"

What is this? (2min video)

Denial of Service (DoS) attacks caused by Regular Expression which causes the system to hang or cause them to work very slowly when attacker sends a well-crafted input(exponentially related to input size).Denial of service attacks significantly degrade the service quality experienced by legitimate users. These attacks introduce large response delays, excessive losses, and service interruptions, resulting in direct impact on availability.

Try a challenge in Secure Code Warrior

Micro-Learning Topic: Denial of service (Detected by phrase)

Matched on "Denial of Service"

The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. Source: https://www.owasp.org/index.php/Denial_of_Service

Try a challenge in Secure Code Warrior