[Snyk] Fix for 1 vulnerabilities

[gvilarino]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gulp

The new version differs by 134 commits.

• 55eb23a Release: 4.0.0
• 173a532 Docs: Fix the installation instructions
• ec54d09 Docs: Improve note about out-of-date docs
• 03b7c98 Docs: Update recipes to install gulp@next
• 2eba29e Docs: Remove run-sequence from recipes
• 76eb4d6 Docs: Add installation instructions & update badges
• fbc162f Docs: Remove references to gulp-util
• 3011cf9 Scaffold: Normalize repository
• f27be05 Update: Remove graceful-fs from test suite
• 361ab63 Upgrade: Update glob-watcher
• 064d100 Build: Avoid broken node 9
• 057df59 Release: 4.0.0-alpha.3
• c1ba80c Breaking: Upgrade major versions of glob-watcher, gulp-cli & vinyl-fs
• 89acc5c Docs: Improve ES2015 task exporting examples (#1999)
• 0ac9e04 Docs: Add "Project structure" section to CONTRIBUTING.md (#1859)
• 723cbc4 Docs: Fix syntax in recipe example (KALAOK #1715)
• d420a6a Docs: Have gulp.lastRun take a function to avoid task registration (#1828)
• 29ece6f Upgrade: Update undertaker
• e931cb0 Docs: Fix changelog typos ([Snyk] Security upgrade victory from 0.26.1 to 36.0.0 #1696)
• 477db84 Docs: Add a "BrowserSync with Gulp 4" recipe ([Snyk] Fix for 2 vulnerable dependencies #1659)
• d4ed3c7 Docs: Add options.cwd for gulp.src API ([Snyk] Fix for 1 vulnerable dependencies #1645)
• 5dc3b07 Docs: Update gulp.watch API to align with glob-watcher
• 0c66069 Breaking: Replace chokidar as gulp.watch with glob-watcher wrapper
• c3dbc10 Docs: Clarify incremental builds example (Add preferred tags to user #1609)

See the full diff

Package name: passport-local-mongoose

The new version differs by 133 commits.

• 7ae942a chore(release): 6.0.0
• a5cc105 chore: switch to prettier and prettify
• e37894e chore: switch to latest 4x version on fastdl downloads
• 2c5d46d chore: renovate build matrix
• 6e5297e chore: remove cross-env and revert version to last released version
• b76a22e chore: remove default option for npm i
• 09d6c2b chore: bump dependencies in example package-lock.json
• 2e66b35 chore: bump dependencies in example
• feb196a chore: update dependencies
• 63ad94e chore: remove the never released 6.0.0 version from the changelog
• bc3122d chore: move updating from 1.0 to 2.0 near to end of readme
• 10f522a chore: remove codellama badge
• 1b74a3d chore: fix deprecated connect
• e190a3a chore: update drop-mongodb-collections
• c9b0a78 fix: make debug a dev dependency
• 83e5ad3 chore: add error messages to login form of example (Consolidate view/model/service intercom #284)
• 40a1fc2 chore: more descriptive customValidator docs in readme ([Safari] Sort dropdown broken #285)
• aa3d16f chore: Add convenient link to API documentation (Sort laws in sidebar by publishing date instead of creation date. #287)
• ff7d718 chore: switch example from jade to pug
• 8215074 chore: update dependencies, npm audit fix (Make all views extend a BaseView #282)
• 9ff1921 chore: update login example dependencies ([admin-tags-form] - I18n #281)
• faa856a chore(release): 6.0.0
• 37375b8 fix: use Buffer.from instead of new Buffer
• 807d9cf fix: update dependencies and specify server port in tests

See the full diff

Package name: stylus

The new version differs by 27 commits.

• fc2e630 chore: add url parse guard (#2600)
• 3329f5b deps: remove semver and mkdirp deps and add node17 test (#2641)
• e64ae7d feat: upgrade debug version from v3 to v4 (#2643)
• 33a5fd9 Fix: variable names beginning with a keyword and dash (#2634)
• d2cddcf Fix: `@ import` url() error in dependency resolver (#2632)
• 9cb7635 chore: add new npm ugnore config (#2631)
• dde9868 0.55.0 (#2630)
• fe5bde1 Replace dependency css-parse with css (#2554)
• 7334567 Add deg and fr as exceptions for 0 value unit omission (#2578)
• 57480a4 chore: update history.md and readme.md (#2628)
• f5a02e8 chore: add macos platform test (#2624)
• 1f7f419 fix yaml front matter (#2617)
• 6a96c0f [skip ci]chore: update reademe.md content (#2602)
• 99b05a9 chore: add issue and pull request template (#2606)
• ae9d267 chore: add github actions ci and improve test (#2601)
• 11a0735 Bump lodash from 4.17.19 to 4.17.21 (#2589)
• 7a8e777 Bump glob-parent from 5.1.1 to 5.1.2 (#2592)
• 23d3295 Merge pull request #2571 from dthadi3/ppc64le
• f546669 Travis-ci: Updated nodejs versions 10, 12, 14
• 5b90e45 Travis-ci: added support for ppc64le
• 59bc665 Merge pull request #2549 from mockee/dev
• 96c02de Bug fixes of encoding png image in `url` lib function.
• 8f42760 Merge pull request #2186 from royels/1567
• 775537b Create SECURITY.md

See the full diff

Package name: yargs

The new version differs by 69 commits.

• 8515e4f docs: nit in CHANGELOG
• 4b8cfa9 docs: slight tweaks to CHANGELOG
• c809cbe chore(release): 10.0.0
• fc13dcd chore: new translations for command API overhaul (After publishing a topic, it is not automatically seen on the frontend #976)
• 7269531 feat: .usage() can now be used to configure a default command ([emitter] - Remove lib/emitter module. Close #913 #975)
• 3757194 chore: add id translation to After publishing a topic, it is not automatically seen on the frontend #976 (Remove '/node_modules' from watchify #986)
• 47b3078 chore: update Dutch Translation (Move /lib/boot/boot.styl to /lib/layout/styles.styl #981)
• 20bb99b feat: replace /bin/bash with file basename (Add/segment #983)
• 5a9c986 feat(translation): Update pl-PL translations (Adapt sidebar to TopicStore and Forums #985)
• 02cc11d docs: whoops, forgot to call out a breaking change introduced into parse()
• 7e58453 fix: the positional argument parse was clobbering global flag arguments (Create democracyos.github.io #984)
• a06b67d chore: update tr.json ([xss] - Add forceSafeImageURLs config variable. Close #980 #982)
• b2d11b3 chore: add ja translations ([models:topic] - Remove unused attributes. Close #978 #979)
• 1598a7f docs: switch to using .positional() in example ([admin] - Add font-size on admin toolbar. Close #937 #973)
• 280d0d6 feat: hidden options are now explicitly indicated using "hidden" flag (Added Traditional Chinese language file #962)
• 8c1d7bf fix: less eager help command execution (added Polish translation #972)
• db77c53 chore: switch to find-up from read-pkg-up (Rename 'ley' to 'tema' in Spanish #970)
• cb16460 feat: introduce .positional() for configuring positional arguments (rename config.singleForum -> config.multiForum Closes #966 #967)
• 3bb8771 fix: config and normalise can be disabled with false (Add forum homepage #952)
• c649415 chore(release): 9.1.0
• 7b22203 fix(command): Run default cmd even if the only cmd (Add forum admin #950)
• 74a38b2 feat: multiple usage calls are now collected, not replaced (Consolidate available languages in a full-dynamic approach #958)
• d1b23f3 chore(release): 9.0.1
• ac8088b fix: implications fails only displayed once (instal en hot web ? #954)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)