[Snyk] Fix for 2 vulnerabilities

[L04DB4L4NC3R]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • server/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	753/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: grunt

The new version differs by 37 commits.

• 9ba3a99 1.0.3
• eee4c33 Changelog v1.0.3
• 46da7f2 Merge pull request #1636 from gruntjs/upt
• 00f4d8a Drop support for Node 0.10 and 0.12
• e852727 util update
• 56d702e Update deps
• 0105524 Fix race condition with file.mkdir and make it operate more similarily to mkdir -p (#1627) r=@ vladikoff
• 303d445 https links (#1629)
• d969132 Merge pull request #1624 from gruntjs/rm-bump-deps
• 289ff91 Remove old bump task and deps
• ccc3163 v1.0.2
• e7795dc Remove iojs from test matrix (#1622)
• a6a133b Remove deprecation warning for coffeescript (#1621) r=@ vladikoff
• 06b377e https links to webchat.freenode.net and gruntjs.com (#1610)
• 7c5242f Use node executable for local grunt bin for Windows support
• f6cbb63 Oh right, Windows isnt bash
• a9a20da Try and debug why appveyor is failing on npm
• 48bba6c Move to the test script to avoid npm was unexpected at this time.
• 6b97ac0 Try to fix appveyor script
• 19003ba For appveyor, check node version to decide whether to install npm@3
• 3fcf921 Install npm@3 if npm version is npm 1 or 2
• 77fc157 Use the local version of grunt to run tests
• 400601a Updating devDependencies
• 6592ad1 Update travis/appveyor to node versions we support

See the full diff

Package name: grunt-contrib-coffee

The new version differs by 9 commits.

• 40bfa6b add back internal ci (#198)
• f9eec6e updating to coffeescript 2 (#196)
• 72e1818 Merge pull request #193 from Florian-R/coffee-1.11.1
• 634e41f Bump coffee-script to 1.11.1
• c643075 Remove trailing spaces.
• 9bcddc1 Update grunt-contrib-internal to v1.1.0.
• bdc062c Update grunt to 1.0.0
• dbb494f Update CHANGELOG.
• bd39fc5 Update dependencies.

See the full diff

Package name: grunt-contrib-jst

The new version differs by 11 commits.

• 376f0d0 fix up the line endings on windows
• ed88af9 v2.0.0
• 1bd3d2a Merge pull request #65 from shailesh-kanzariya/upgrade_lodash_to_4.17.20
• 0d595c2 updated ci script
• e659f27 modified engine prop to nodejs 4.x
• af22b11 bumped lodash, modified jst and test cases to work with latest lodash version
• 719a961 Normalize line endings.
• 285f3ec Trying to fix Windows tests; one is left broken.
• 806ddbe Minor lint tweaks.
• adb8c04 Add AppVeyor support.
• c8bf51f Update grunt-contrib-internal

See the full diff

Package name: grunt-contrib-watch

The new version differs by 16 commits.

• 6ec71e9 v1.0.1
• 7d20933 Update copyright year
• e3d19df Update ci configs
• d117574 Updating ci configs
• 99410a7 README.md: Fixed typos (#536)
• 7f8cf80 Add local grunt-cli
• ab6771e Drop back to grunt@0.4.5 until the bad test helper can be sorted
• 2e2daa5 Update to gaze@1.1.0
• 3d7fa3a Avoid timing issue in tests because of the bad test helper
• 0130a16 Merge pull request #500 from gruntjs/deps
• 5289845 Update devDependencies.
• fd3ed7a Lint tweaks.
• e42386a Merge pull request #501 from cepko33/master
• 8c93077 Updated lodash and changed outdated 'contains' to 'includes'
• 986b8a9 Update CHANGELOG.
• 5e155ec Add AppVeyor for Windows testing.

See the full diff

Package name: grunt-sync

The new version differs by 1 commits.

• ca10eb6 Bumping deps

See the full diff

Package name: sails

The new version differs by 250 commits.

• 6e73a65 1.0.0
• 5f1d8b3 1.0.0-49
• 616e4e1 Insist on the latest sails-generate.
• 6ab0a5a 1.0.0-48
• 1e28823 Lifting with --redis now sets @ sailshq/connect-redis and @ sailshq/socket.io-redis.
• 9f29a03 Change approach from what was begun in 520a3c8cac5db1d9698c50efff82e476ec64fca8 so that we maintain the correct package name for the purpose of require().
• 520a3c8 Tolerate '@ sailshq/connect-redis' as session adapter.
• e2813f5 1.0.0-47
• 6768743 Tweak warning message.
• ce95c84 Update comments to reflect that req.setLocale() is fully supported as of Sails v1.0 and beyond.
• 0753a99 Trivial
• 3bdd786 Tweak troubleshooting tips.
• e8f9bee Check dev-dependencies for sails-hook-grunt
• e8493a6 1.0.0-46
• d1b6061 run tests on Node 9
• b3afed7 Fix issue with CSRF black/whitelists and routes containing optional params when the requested URL contains a querystring but NOT the optional param (whew!)
• 663527f Fix test error output
• 69ead96 Revert 35ae3ccba472bf4a8edb8ffd7d579d18391d1ba0 in favor of clarifying some of the wording.
• 35ae3cc Experiment with customizable www path
• a89d7a4 extrapolate www path
• a2a0789 Tolerate sails-hook-grunt specified in devDependencies when running sails www
• 0b42c59 Don't attempt to create a Redis connection if "client" is provided.
• 1700788 Update LICENSE.md
• 9c532dc Merge pull request #4267 from luislobo/patch-3

See the full diff

Package name: sails-disk

The new version differs by 85 commits.

• 15faa44 1.0.0
• a2b7ee6 1.0.0-12
• 9d7118c Only set footprint keys for uniqueness violations.
• a2c2261 Add some assertions.
• a222824 Update gitignore and scripts
• 3b3c334 1.0.0-11
• cef95b4 Support updating the primary key value, as long as it's not using _id as the column.
• aad2a15 Set _id column to value of primary key when creating records.
• 333e2d1 1.0.0-10
• c8a26c5 Add shim to replicate MongoDB's behavior w/ `{ $ne: null }` and empty arrays.
• bf92cb8 1.0.0-9
• af97943 Workaround issue with projections including only `_id`
• b5b985b Relax restrictions on using `_id` column in sails disk.
• f4adfd7 Add an entry in the `refCols` dictionary for every model, so we don't have to short-circuit checks for it later
• b494fd9 In `find`, deserialize Buffer objects into `ref` attributes where possible.
• 7aaaaa4 Merge pull request #58 from balderdashy/expose-lib
• 70ead96 (whoops) Add back 0.10 and 0.12 in appveyor.yml
• beabe7a Merge pull request #57 from balderdashy/expose-lib
• 9c80187 1.0.0-8
• f7a349d Actually, don't expose the static lib. (No reason to do so, and better to not introduce something experimental if there's any chance it could make an app dependent on random stuff in a dev-only adapter)
• 2d4d97e 1.0.0-7
• f2dd761 Rename afterwards function to avoid perceived scope conflict (whether or not it'd ever actually be a big deal, this avoids any potential future scope issues from refactoring, etc).
• 4051e5e 1.0.0-6
• 250c32e Handle stray error (and a couple of other trivial changes just from when I was reading through the code)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic