[Snyk] Fix for 6 vulnerabilities

[freezy]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	761/1000 Why? Mature exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-DICER-2311764	Yes	Mature
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASHSET-1320032	No	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	No	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-ZXCVBN-3257741	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: nodegit

The new version differs by 17 commits.

• 0327c08 Bump to v0.27.0
• 7f24632 Merge pull request #1785 from nodegit/node-14
• e71eea7 Upgrade build environments
• b7c1259 Merge pull request #1784 from themadtitanmathos/fix/remote-callbacks-pointer-cleanup
• d5ad62c Remote needs to REALLY persist the callback/proxyOpts/headers
• 69b010a Use a different folder for ssh test keys
• 8a59c1c Bump to 0.27.0-alpha.1
• dcb94e9 Merge pull request #1772 from implausible/get-rid-of-promisify-node
• 5d008e0 Remove promisify-node and remove old callback api remnants
• be55439 Merge pull request #1771 from implausible/replace-request-with-got
• 6398d90 Replace deprecated package request with got
• 65b4350 Merge pull request #1770 from implausible/bump/openssl
• c007bb7 Bump OpenSSL prebuilt to 1.1.1c
• f267826 Merge pull request #1767 from implausible/feature/git_remote_rename
• dd6aa63 Expose git_remote_rename
• 1018e32 Merge pull request #1766 from implausible/dedupe-fetch
• 1507003 Dedupe Remote.prototype.fetch

See the full diff

Package name: pngquant

The new version differs by 70 commits.

• c476a31 4.2.0
• 48f9674 Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path #105 from ubermanu/esm-fix
• 39ad5dd chore: format with prettier
• 4f949c4 fix: type declarations
• 3be526f fix: import pngquant-bin correctly if not found
• b8f81fa Merge pull request Return 400 instead of 500 with weird decades #101 from toufali/fix-vulnerability-mocha
• 9f09480 Update pngquant-bin to ^6.0.1
• 2eeb2ff update `mocha` to 10.1.0
• 88ee9ae Revert "Bump pngquant-bin to ^8.0.1"
• f3e0fae Try ubuntu-latest
• b7a6973 Try upgrading to a newer Ubuntu to unbreak CI with node.js 18
• f5bb214 Update offline-github-changelog to ^3.0.0
• fe66592 Drop node.js 12 support, add 18
• 97a171e Bump pngquant-bin to ^8.0.1
• 1bae17c Remove jshint cruft
• 89028fc 4.1.0
• b5b8756 Merge pull request Fix thumbs when listing releases and there are both orientations #98 from ubermanu/master
• af54da8 add ts types
• 2bd66da update readme
• 57c5574 fix tests
• 3f36226 add support for es modules
• 69182b2 Fix CHANGELOG generation in preversion script now that an npm env var changed
• 1ef4314 npm i --save-dev eslint-config-standard@latest eslint-plugin-n eslint-plugin-import@latest
• b95cb3d Merge remote-tracking branch 'origin/depfu/update/npm/eslint-8.6.0'

See the full diff

Package name: snyk

The new version differs by 250 commits.

• 4cc1a94 Merge pull request #2105 from snyk/feat/webpack
• 7737f75 Merge pull request #2181 from snyk/test/migrate-old-snyk-format
• 418e6ad Merge pull request #2180 from snyk/test/migrate-is-docker
• 95631e7 test: migrate is-docker to jest
• babe22a test: migrate old-snyk-format to jest
• e22e94f feat: Snyk CLI is bundled with Webpack
• dd46c19 Merge pull request #2175 from snyk/fix/snyk-protect-multiple
• e7c314f Merge pull request #2178 from snyk/test/server-close
• 5e824c0 fix(protect): skip previously patched files
• ca2177a fix(protect): catch and log unexpected errors
• c9ddb44 chore(protect): move api url warnings to stderr
• e8fed38 refactor(protect): move stdout logs to top level
• 55e88f9 Merge pull request #2177 from snyk/test/set-jest-acceptance-timeout
• 1522c5f test: server.close uses callbacks, not promises
• 13dce51 test: increase timeout for slow oauth test
• 65c35be Merge pull request #2172 from snyk/chore/no-run-test-on-master
• a1e3992 chore: don't run tests on master
• 20feb67 Merge pull request #2165 from snyk/chore/dont-wait-for-regression-tests
• f50bca7 Merge pull request #2167 from snyk/refactor/replace-cc-parser-with-split-functions
• 1ed7d11 refactor: replace cc parser with split functions
• 707801d Merge pull request #2166 from snyk/fix/support_quotes_in_poetry_toml
• dc6b784 Merge pull request #2163 from snyk/chore/remove-store-test-results
• 7973015 fix: support quoted keys in inline tables
• 18f0d2a Merge pull request #2164 from snyk/chore/upgrade-snyk-nuget-plugin

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution