[Snyk] Fix for 5 vulnerabilities

[rish2497]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • app/package.json
  • app/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Denial of Service (DoS) SNYK-JS-JOSE-3018688	No	No Known Exploit
	671/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7	Prototype Pollution SNYK-JS-MONGOOSE-2961688	No	Proof of Concept
	454/1000 Why? Has a fix available, CVSS 4.8	Session Fixation SNYK-JS-PASSPORT-2840631	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-SQLITE3-2388645	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: jose

The new version differs by 5 commits.

• a38040d chore(release): 3.20.4
• 1895f9e chore: lock down build deps
• d530c30 fix: limit default PBES2 alg's computational expense
• 5309e00 ci: full-ci triggers all actions on PRs
• 82105d6 ci: update release to make to tag on npm and not push to main

See the full diff

Package name: mongoose

The new version differs by 250 commits.

• 5449ab9 chore: release 6.4.6
• b8c99cf Merge pull request #11892 from Automattic/netlify-functions-example
• 2751883 fix tests
• eced2c7 Merge branch 'master' into netlify-functions-example
• 92cb6fb Merge branch 'master' into vkarpov15/gh-12085
• 422f9da test(schema): add coverage for calling `plugin()` with options
• 2262a77 fix(document): avoid mutating original object passed to $set() when applying defaults to nested properties
• 2e6b064 made requested changes
• b70a0dc Merge pull request #12123 from LokeshKanumoori/patch-1
• 086bd9f fix(query): apply lean transform option to top-level document
• 1344214 Update migrating_to_6.md
• a45cfb6 fix(schema): disallow setting __proto__ when creating schema with dotted properties
• bc302f4 chore: release 6.4.5
• 44530a6 Merge pull request #12116 from Automattic/revert-12103-upgrade-mongo-driver
• 80b7d53 Revert "chore: upgrade mongodb driver to 4.8.0"
• 0156d5e style: fix lint
• 9524f89 fix(types): make `$addToSet` fields mutable to allow programatically constructing $addToSet
• 201071b fix(types): allow any value for AddFields
• 5301deb fix: cleanup and various updates
• 118c97a Merge branch 'master' into netlify-functions-example
• 1306d00 Merge pull request #12086 from hasezoey/modelJSDOCTouchup
• f95373d Merge pull request #12110 from skrtheboss/fix/is-atlas-check
• 1445c20 Merge pull request #12112 from pathei-kosmos/master
• 250b01b fix(types): avoid treating `| undefined` types as `any` in `Require_id` to better support `_id: String` with auto-typed schemas

See the full diff

Package name: oidc-provider

The new version differs by 102 commits.

• 286b8d8 chore(release): 7.0.0
• 238786b docs: update readme
• 5efbf9b chore: move package json fields to rc files
• ee74dcf feat: control whether underlying Grant gets destroyed during logout and revocation
• 9dc7921 feat: allow pre-existing Grants to be loaded during authorization
• efd3dab feat: The key used to asymmetrically sign PASETO Access Tokens can now be chosen based on its Key ID.
• 2e78582 feat: PASETO Access Tokens can now be encrypted with a symmetric secret shared with the recipient using v1.local
• dff2a72 feat: PASETO Access Tokens now support both v1.public and v2.public
• 4efe741 feat: PASETO Access Tokens are now just issued and not stored anymore
• d1ee6b7 feat: JWT Access Tokens are now just issued and not stored anymore
• 8b32707 feat: The key used to asymmetrically sign JWT Access Tokens can now be chosen based on its Key ID.
• d2a63b7 feat: JWT Access Tokens can now be encrypted with an asymmetric public key of the recipient
• 0f76c65 feat: JWT Access Tokens can now be encrypted with a symmetric secret shared with the recipient
• 5041158 feat: JWT Access Tokens can now be HMAC-signed with a symmetric secret shared with the recipient
• f48a44e ci: only download failed certification html results
• ceb3cd1 fix: remap `invalid_redirect_uri` as `invalid_request` in PAR
• d1d9421 refactor: idToken.issue() now requires the `use` option
• 5572e0e refactor: use jose@3 instead of jose@2
• bf8abdb refactor: use private class fields in favour of weakmap where possible
• 72058a5 feat: helper function to decide whether to validate client.sector_identifier_uri
• 202e4c5 feat: sector_identifier_uri can be used without pairwise subject_type
• 59d6c52 ci: continue on lint errors
• 33f3a83 feat: PAR no longer requires otherwise enabled `features.requestObjects`
• a1f7466 refactor: use clearer allow/block list definitions

See the full diff

Package name: passport

The new version differs by 100 commits.

• c33067b 0.6.0
• 3052bb4 Update changelog.
• 42630cb Merge pull request #900 from jaredhanson/fix-fixation
• 8dd79fe Use utils-merge rather than Object.assign for compatibility.
• 4f6bd5b Change keepSessionData to keepSessionData.
• 46756e5 Silence verbose logging.
• 987b191 Add tests.
• f8a175f Add tests.
• 29a90d6 No need to guard callback existence.
• bfba8a1 Add tests.
• 17111d7 Add option to keep session data on logout.
• a349c2b Add option to keep session data.
• e69834e Add optional options to login and logout.
• 8825a9a Add tests.
• c1991cf Add tests.
• 294f22c Better session detection and exceptions.
• 80cc4e3 Add tests.
• 3001654 Add tests.
• b395106 Clean up tests.
• cfa8259 Add tests.
• ee0bf81 Add tests.
• cc7606c Add tests.
• 71c54f6 Add test.
• 88c1f1b Handle logout without session manager.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Prototype Pollution
🦉 Denial of Service (DoS)
🦉 More lessons are available in Snyk Learn