[Snyk] Fix for 19 vulnerabilities

[ryan-ally]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • managed/ui/package.json
  • managed/ui/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIHTML-1296849	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTMLMINIFIER-3091181	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASHTEMPLATE-1088054	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	No	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	579/1000 Why? Has a fix available, CVSS 7.3	Arbitrary Code Execution SNYK-JS-STATICEVAL-173693	No	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	794/1000 Why? Mature exploit, Has a fix available, CVSS 7.3	Arbitrary Code Execution npm:static-eval:20171016	No	Mature

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: node-sass

The new version differs by 90 commits.

• 3b556c1 7.0.2
• c716359 Bump sass-graph@^4.0.1 ([YW] Edit Universe did not pick the last 3 nodes in the list when downsizing yugabyte/yugabyte-db#3292)
• 24741b3 docs(readme): fix docpad plugin link
• 1523330 feat: Drop Node 12
• 365d357 update https://registry.npm.taobao.org to https://registry.npmmirror.com
• 1456114 build(deps): bump actions/upload-artifact from 2 to 3
• b465b69 chore: bump GitHub Actions to Windows 2019 ([docdb] QLTabletTest.OperationMemTracking is flaky yugabyte/yugabyte-db#3254)
• e6194b1 build(deps): bump make-fetch-happen from 9.1.0 to 10.0.4
• 4edf594 build(deps): bump node-gyp from 8.4.1 to 9.0.0
• 29e2344 build(deps): bump actions/checkout from 2 to 3
• 85b0d22 build(deps): bump actions/setup-node from 2 to 3
• 3bb51da Use make-fetch-happen instead of request ([yugabyted] Start takes a long time if yb-ctl cluster already running yugabyte/yugabyte-db#3193)
• adc2f8b build(deps): bump true-case-path from 1.0.3 to 2.2.1 (Fix k8s encryption itest yugabyte/yugabyte-db#3000)
• 77d12f0 chore: disable Apline for Node 16/17 builds
• 308d533 ci: use Python 3 for Node 12
• c818907 ci: unpin actions/setup-node to v2
• 99242d7 7.0.1
• 77049d1 build(deps): bump sass-graph from 2.2.5 to 4.0.0 (Add a timeout to itest run  yugabyte/yugabyte-db#3224)
• c929f25 build(deps): bump node-gyp from 7.1.2 to 8.4.1 ([docs] Update note on yugabyted reference page yugabyte/yugabyte-db#3209)
• 918dcb3 Lint fix
• 0a21792 Set rejectUnauthorized to true by default ([Platform] Charts repo should be deployable to a specified namespace yugabyte/yugabyte-db#3149)
• e80d4af chore: Drop EOL Node 15 (v2.0.7 fresh install won't run in Ubuntu yugabyte/yugabyte-db#3122)
• d753397 feat: Add Node 17 support ([yugabyted] Issues when running on a public cloud instance yugabyte/yugabyte-db#3195)
• dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0

See the full diff

Package name: plotly.js

The new version differs by 142 commits.

• 13947fc 1.54.4
• 32a352d update changelog for v1.54.4
• a3ee4f8 Merge pull request Add thread safety annotations to Transaction yugabyte/yugabyte-db#4934 from plotly/bump-dev-deps-June22-2020
• 72cb52c bump some dev deps
• 665cd7c Merge pull request [Index Backfill] Failing to update index permissions causes index to stuck yugabyte/yugabyte-db#4930 from plotly/surface-no-cwise
• db6f9e7 more optimization for invert and 2d case
• 9068017 no longer depend on cwise and optimize for 2d operations
• 6652273 Merge pull request Tablet splitting: cleanup split tablets yugabyte/yugabyte-db#4929 from plotly/no-cwise
• 43b9389 bump gl-plot2d and gl-plot3d versions
• 51788a4 no longer depend on ndarray-fill module that uses cwise with static-eval
• 3d5f311 Merge pull request Get rid of the schema lock altogether yugabyte/yugabyte-db#4904 from plotly/fix4852-template-tickwidth-tickcolor
• 24d1da9 remove unnecessary validation, also
• adc36cd validate input when calling from coerce2
• 2b911d1 make room for opts - rename opts to attr
• 634a93a 1.54.3
• fdf3506 update changelog v1.54.3
• ca04720 Merge pull request [docdb] Tool to turn on verbose logging across servers yugabyte/yugabyte-db#4925 from plotly/px-autosize
• d21c0bf only take container computed size in px
• 21b86cd add jasmine tests to cover invalid inputs in Lib.coerce2
• cf7c061 fixup Lib.coerce2 description and color test
• fbb5742 1.54.2
• 5b4dcb6 update changelog v1.54.2
• 1f62b1e Merge pull request [YSQL] 2x-to-2.5x slow down for 100k-row insert and create index in colocated vs regular database yugabyte/yugabyte-db#4910 from plotly/bump-ndarray-bigInt64
• caca1d2 Merge pull request QLTransactionTest.IntentsCleanupAfterRestart is flaky yugabyte/yugabyte-db#4909 from plotly/bump-dev-deps-Jun09-2020

See the full diff

Package name: react-scripts

The new version differs by 250 commits.

• 221e511 Publish
• 6a3315b Update CONTRIBUTING.md
• 5614c87 Add support for Tailwind ([flaky test] org.yb.pgsql.TestPgRegressTypesUDT.testPgRegressTypesUDT yugabyte/yugabyte-db#11717)
• 657739f chore(test): make all tests install with `npm ci` ([DocDB] Tserver hits soft limit and not reclaiming back memory | Rejecting Write request: Soft memory limit exceeded yugabyte/yugabyte-db#11723)
• 20edab4 fix(webpackDevServer): disable overlay for warnings (Docker pull on pgloader doesn't work yugabyte/yugabyte-db#11413)
• 69321b0 Remove cached lockfile (Deploy Yugabyte using Azure ARM  yugabyte/yugabyte-db#11706)
• 3afbbc0 Update all dependencies ([Docs] Fix broken links in docs.yugabyte.com yugabyte/yugabyte-db#11624)
• f5467d5 feat(eslint-config-react-app): support ESLint 8.x ([Platform] Updated the azcopy and node-exporter version yugabyte/yugabyte-db#11375)
• e8319da [WIP] Fix integration test teardown / cleanup and missing yarn installation ([YCQL] Statements doesn't run serially by default in YCQL transaction block yugabyte/yugabyte-db#11686)
• c7627ce Update webpack and dev server ([Docs] [YSQL] Added a limitation for READ COMMITTED isolation level yugabyte/yugabyte-db#11646)
• f85b064 The default port used by `serve` has changed ([docs] [explore] changed order for left nav under Horizontal scalability. yugabyte/yugabyte-db#11619)
• 544befe Update package.json ([YSQL] Master UI: Users should be able to find the tablegroup ID from the tablegroup name yugabyte/yugabyte-db#11597)
• 9d0369b Fix ESLint Babel preset resolution ([Core-YSQL] Performance on graviton instances is slower possible due to "__pread call from yb::PosixRandomAccessFile::Read" yugabyte/yugabyte-db#11547)
• d7b23c8 test(create-react-app): assert for exit code ([YSQL] Import SQL expression tests yugabyte/yugabyte-db#10973)
• 1465357 Prepare 5.0.0 alpha release
• 3880ba6 Remove dependency pinning ([docs] [#11472] Removed manual transaction table creation from geo-partioning example yugabyte/yugabyte-db#11474)
• 8b9fbee Update CODEOWNERS
• cacf590 Bump template dependency version ([Phase 1][colocation][DocDB][SQLsmith] Colocated table corruption after crash loop yugabyte/yugabyte-db#11415)
• 5cedfe4 Bump browserslist from 4.14.2 to 4.16.5 ([YSQL] Pre-split multi-tablet range tables SPLIT AT VALUES clause split rows ordering issue yugabyte/yugabyte-db#11476)
• 50ea5ad allow CORS on webpack-dev-server ([YSQL][PostGIS] Segmentation fault in ST_ShapeGrid() yugabyte/yugabyte-db#11325)
• 63bba07 Upgrade jest and related packages from 26.6.0 to 27.1.0 ([Doc] PR for Rename YugabytePlatformRole to yugabytePlatformRole yugabyte/yugabyte-db#11338)
• 960b21e Bump immer from 8.0.4 to 9.0.6 ([Docs] PR for Helm install: document how to specify a static load balancer IP yugabyte/yugabyte-db#11364)
• 134cd3c Resolve dependency issues in v5 alpha ([DocDB] Allow Traces to use finer MonoClock yugabyte/yugabyte-db#11294)
• b45ae3c Update CONTRIBUTING.md

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Open Redirect
🦉 More lessons are available in Snyk Learn