[Snyk] Fix for 17 vulnerabilities

[aliscco]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • test/fixtures/qs-package/node_modules/boom/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	631/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
	541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASHMERGE-173732	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-LODASHMERGE-173733	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Improper Privilege Management SNYK-JS-SHELLJS-2332187	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:eslint:20180222	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:hoek:20180212	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: code

The new version differs by 94 commits.

• e3d110f v5.2.4
• b49b01b - Fixed unnamed functions error reporting
• 0fc756c update to lab 18
• 57c974c 5.2.3
• ef8eccf Remove engines. Closes [Snyk] Security upgrade snyk from 1.101.1 to 1.230.7 #130
• 6d87669 5.2.2
• 1e2fefd Update hoek. Closes [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #129
• b458d13 v5.2.1
• 03d7b92 update deps and test on node 11
• 0dfe00e Add the correct thrownAt() location when using expect().to.reject()
• 40e5271 Merge branch 'master' of github.com:hapijs/code
• 506b432 5.2.0
• 7417485 Return error when asserting for thrown. Closes [Snyk] Security upgrade django from 1.6.1 to 2.2.25 #123
• 6bf9d1d Invalidates rejection with wrong type or message arguments ([Snyk] Security upgrade django from 2.0.1 to 2.2.25 #121)
• 18cd84c 5.1.2
• 5d533ff merge
• bece7c3 Merge branch 'master' of github.com:hapijs/code
• d2af62a 5.1.1
• 85fcb25 Update deps. Closes [Snyk] Security upgrade sanitize from 4.6.2 to 5.2.1 #117
• 7cf8a2d Fix broken API.md anchor ([Snyk] Security upgrade aiohttp from 2.2.2 to 3.8.0 #116)
• 70c82c7 fix(length): throw decent error on length check of `null` ([Snyk] Security upgrade lodash from 4.17.13 to 4.17.21 #111)
• a878e86 Return rejection error. Closes [Snyk] Security upgrade sanitize from 4.6.2 to 4.6.2 #106
• 50faff7 Update docs
• bb37cc5 add test to identify async functions

See the full diff

Package name: hoek

The new version differs by 141 commits.

• 47d6306 6.1.3
• eef9740 cleanup
• fc934af Cleanup
• f2eb7fd Clone without prototype. Closes [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #290
• 5bfe5b6 6.1.2
• 17fe9a1 Revert all symbol handlings to false by default. Closes [Snyk] Security upgrade python from 3.6-slim to 3.10-slim #283
• 542939b 6.1.1
• 947a326 Ignore symbols in deepEqual() by default. Closes [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #281
• 27ac630 6.1.0
• b3b5134 Merge pull request [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #281 from kanongil/symbol-support
• bec8b86 Update docs
• b159f54 Support symbol properties and keys in cloneWithShallow()
• 9fa34af Support symbol properties for reach(). Closes [Snyk] Security upgrade django from 1.6.1 to 2.2.28 #267
• ea1ee6a Support symbol properties in contain()
• b6907ac Support symbol properties in clone()
• c123e61 Merge pull request [Snyk] Security upgrade nconf from 0.7.2 to 0.11.4 #279 from Nargonath/changelog
• f15fd25 Add changelog.md
• 56f4849 Support enumerable symbol properties in merge()
• 96ab1bc Support enumerable symbol properties in deepEqual()
• 6350261 6.0.4
• 6f02157 Fix clone() for redefined properties. Closes [Snyk] Security upgrade snyk from 1.101.1 to 1.465.0 #278
• 73c35e8 Expand tests for exotic objects
• 927974e Update lab 18
• bcfa947 6.0.3

See the full diff

Package name: lab

The new version differs by 250 commits.

• 8387d6b 18.0.2
• 93d6b38 Update deps. Closes [Snyk] Fix for 1 vulnerabilities #905
• a2b8b52 version 18.0.1
• 5c11479 Merge pull request [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #898 from secretcowlevel/master
• a9c6b7a Explicitly test for color output on supporting consoles.
• 3a2486e Do not run "Leaks ignores Counter globals" on Windows Node >= 11.
• b169b65 Update dependencies.
• 4b12c69 Fix lint and switch to use regex matching instead of endsWith/Os.EOL in output tests.
• 072c02e Support limited consoles in test/reporters.js.
• f0e2f4e Linter tests should use Os.EOL.
• e003fff Update .gitattributes
• 0b6f26e Create .gitattributes
• c0d8bb1 Add Windows and MacOS X to Travis.
• 47e8181 Merge pull request [Snyk] Security upgrade django from 1.6.1 to 1.8.16 #899 from Nargonath/changelog
• 13d1574 Add changelog.md
• e060ace Switch back to Hoek.clone from lodash.deepClone.
• da9c89d Merge pull request [Snyk] Fix for 1 vulnerabilities #895 from secretcowlevel/master
• c877a18 Use lodash.deepClone in place of Hoek.clone until it's fixed.
• 9db5dee Fix coverage with sourcemaps inlined via Transform API.
• 246d25d version 18.0.0
• d5c6976 Merge pull request [Snyk] Security upgrade django from 1.6.1 to 1.6.3 #894 from geek/master
• 4ef5bc4 Have correct exit code with multiple reporters
• 6dbb48c Merge pull request [Snyk] Fix for 1 vulnerabilities #893 from geek/tests
• 495dd4f Properly propagate term sig to child lab process

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Command Injection
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn