[Snyk] Fix for 14 vulnerabilities #84

snyk-bot · 2022-10-09T23:54:31Z

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	No	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-INI-1048974	No	Proof of Concept
479/1000 Why? Has a fix available, CVSS 5.3	Insertion of Sensitive Information into Log File SNYK-JS-NPMREGISTRYFETCH-575432	No	No Known Exploit
589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-NPMUSERVALIDATE-1019352	No	No Known Exploit
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SSRI-1246392	No	Proof of Concept
624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	No	No Known Exploit
624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	No	No Known Exploit
410/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	No	No Known Exploit
639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	No	No Known Exploit
639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	No	No Known Exploit
639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	No	No Known Exploit
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: cli-columns

The new version differs by 4 commits.

89eaa84 drop travis and coveralls from readme
5da2489 upgrade deps, drop heavy dev deps, github actions, node 10+
b9e986b Update readme.md
ed6df24 Update copyright info

See the full diff

Package name: columnify

The new version differs by 34 commits.

a532ca1 Release 1.6.0
92fdab6 Clean up readme badges, update stats.
a350bf2 Add npm cache to CI.
aae8411 Actually install & test in CI.
b2fe72f Use github actions.
4b54106 Update node version in travis.yml.
c820951 Update packages.
10ea59d Update packages.
e768ed8 Revert "Merge pull request [Snyk] Security upgrade libnpx from 10.2.3 to 10.2.4 #59 from njhoffman/master"
1cf9287 Merge pull request [Snyk] Security upgrade libnpx from 10.2.3 to 10.2.4 #59 from njhoffman/master
091ddb0 Merge pull request 🚨 [security] Update ini: 1.3.5 → 1.3.7 (patch) #60 from sreekanth370/master
bece43f Merge pull request Update read-package-json: 2.1.1 → 2.1.2 (patch) #49 from tdmalone/patch-1
4b72760 Merge branch 'master' into master
e7c082a Merge pull request 🚨 [security] Update ini: 1.3.5 → 1.3.8 (patch) #62 from viceice/patch-1
db4ee97 chore: bump version
0bd797f chore: require node v8
ea15deb fix: update strip-ansi to v6.0.1
33c942e compatibility updates
5cb6515 fixed transipiling errors
a27ddb8 version bump
95d9a8e extract strip-ansi dependency
4895ec1 version bump
64c77f5 version bump
1d3ef4b add modules key and main eky to package.json

See the full diff

Package name: hosted-git-info

The new version differs by 2 commits.

8d4b369 chore(release): 2.8.9
29adfe5 fix: backport regex fix from [Snyk] Security upgrade tar from 4.4.13 to 4.4.18 #76

See the full diff

Package name: ini

The new version differs by 3 commits.

2da9039 1.3.6
cfea636 better git push script, before publish instead of after
56d2805 do not allow invalid hazardous string as section name

See the full diff

Package name: libnpx

The new version differs by 3 commits.

84eeb54 chore(release): 10.2.4
7a03da5 test: patch child.js test
122ed5c deps: update yargs

See the full diff

Package name: node-gyp

The new version differs by 250 commits.

f5fa6b8 chore: release 8.4.1
cc37b88 fix: windows command missing space ([BUG] peer-dependency conflict when having "greater than or equal to" range >= npm/cli#2553)
8083f6b deps: [email protected]
787cf7f docs: fix typo in powershell node-gyp update
7073c65 chore: release 8.4.0
a27dc08 feat: build with config.gypi from node headers
5a00387 feat: support vs2022 ([BUG] <title>npm ERR! cb() never called! npm/cli#2533)
fb85fb2 chore: release 8.3.0
5585792 feat(gyp): update gyp to v0.10.0 ([BUG] missing docs around package-lock.json inside the /node_modules/ dir npm/cli#2521)
b05b4fe chore(deps): bump make-fetch-happen from 8.0.14 to 9.1.0
0a67dcd test: Python 3.10 was release on Oct. 4th ([BUG] npm install --force fails for peerOptional conflicts npm/cli#2504)
f2ad87f chore: refactor the creation of config.gypi file
bc47cd6 chore: release 8.2.0
ed9a9ed feat(gyp): update gyp to v0.9.6 ([BUG] <title>Unable to add my password npm/cli#2481)
660dd7b doc: correct link to "binding.gyp files out in the wild" ([BUG] shows outdated support contact npm/cli#2483)
ec15a3e chore(deps): bump tar from 6.1.0 to 6.1.2 (fix(docs): clean up npm unpublish docs npm/cli#2474)
78361b3 ISSUE_TEMPLATE.md: Instructions for old versions (V6 npm/cli#2470)
f0882b1 fix: missing spaces
c8c0af7 fix: doc how to update node-gyp independently from npm
b6e1cc7 Add title to node-gyp version document ([BUG] Broken link in npm v7 series beta re. $npm_package_* environment variables (now gone) npm/cli#2452)
b7bccdb ci: GitHub Actions Test on node: [12.x, 14.x, 16.x] ([BUG] User-defined run script overwritten by shell command npm/cli#2439)
161c235 doc(wiki): safer doc names, remove unnecessary TypedArray doc
b52e487 doc(wiki): link to docs/ from README
f0a4835 doc(wiki): move wiki docs into doc/

See the full diff

Package name: npm-registry-fetch

The new version differs by 2 commits.

62ce833 chore(release): 4.0.5
43a5d84 chore: remove basic auth data from logs

See the full diff

Package name: npm-user-validate

The new version differs by 2 commits.

5c5471c 1.0.1
c8a87da fix: update email validation

See the full diff

Package name: npmlog

The new version differs by 7 commits.

15366fb 5.0.0
d81ce11 docs: changelog for v5.0.0
e420957 BREAKING CHANGE: update deps, lint, test coverage ([Snyk] Security upgrade update-notifier from 2.5.0 to 3.0.0 #79)
f0454b0 deps: bump tap
c989a1c chore: update CI for current Node LTS
5414070 Appease standard
c9ed17d package-lock@1

See the full diff

Package name: ssri

The new version differs by 2 commits.

b7c8c7c chore(release): 6.0.2
b30dfdb fix: backport regex change from 8.0.1

See the full diff

Package name: tar

The new version differs by 27 commits.

3e35515 4.4.18
52b09e3 fix: prevent path escape using drive-relative paths
bb93ba2 fix: reserve paths properly for unicode, windows
2f1bca0 fix: prune dirCache properly for unicode, windows
9bf70a8 4.4.17
6aafff0 fix: skip extract if linkpath is stripped entirely
5c5059a fix: reserve paths case-insensitively
fd6accb 4.4.16
53cea6e tests: run (and pass) on windows
166cfc0 fix: refactoring to pass tests on Windows
ce5148e fix: refactoring to pass tests on Windows
3f2e2da fix: normalize paths on Windows systems
e29a665 fix: properly prefix hard links
fd2a38d chore: WriteEntry cleaner write() handling
7b2acc5 update deps
83bb22c WriteEntry backpressure
0dcc5b2 chore: track fs state on WriteEntry class, not in arguments
adf3511 Avoid an unlikely but theoretically possible redos
d688cad fix: properly handle top-level files when using strip
ea6f254 unpack: keep path reservations longer
b2a97e1 Address unpack race conditions using path reservations
f0fe3aa basic path reservation system
843c897 4.4.15
46fe350 Remove paths from dirCache when no longer dirs

See the full diff

Package name: update-notifier

The new version differs by 42 commits.

311557e 6.0.0
9183541 Require Node.js 14 and move to ESM
3fdb218 5.1.0
73c391b Upgrade dependencies
0a6027e Move to GitHub Actions
d8fa601 Rename `master` branch to `main`
f63b2eb 5.0.1
9e2b772 Update dependencies
da7c464 5.0.0
5b440c2 Require Node.js 10
3dfe42d Don't suggest to upgrade to lower version (Clarify usage of bundledDependencies npm/cli#192)
132b7ce Remove a project from "Users" section (Canary npm/cli#191)
c9d2166 4.1.1
f42fc8f Improve vertical alignment of the notifier output ([email protected] npm/cli#183)
71a3f19 Use HTTPS links
64c5236 Fix Travis
9d9f4ff 4.1.0
4062f12 Update dependencies
adbeb6e Add template support for the `message` option (token: fix otp for create and remove npm/cli#175)
adf7803 4.0.0
fb5161c Remove the `callback` option (stars: Fix typo in error message npm/cli#158)
39682de Rename `boxenOpts` option to `boxenOptions`
bc1721a Avoid showing notification if current version is the latest (Ask to make an issue if there is an error npm/cli#174)
ccaf686 Update dependencies