[Snyk] Fix for 11 vulnerabilities

[awaisab172]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTMLMINIFIER-3091181	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASHSET-1320032	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASHTEMPLATE-1088054	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-USERAGENT-174737	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: globby

The new version differs by 12 commits.

• 878ef6e 10.0.0
• 3706920 Upgrade `fast-glob` package to v3 ([Snyk] Fix for 2 vulnerabilities #126)
• 8aadde8 Add `globby.stream` ([Snyk] Security upgrade mkdirp from 0.5.1 to 0.5.2 #113)
• 2dd76d2 Remove `**/bower_components/**` as a default ignore pattern
• 9f781ce Require Node.js 8
• 04d51bf Upgrade `ignore` package ([Snyk] Fix for 1 vulnerabilities #120)
• 2b61484 Readme tweaks
• ff3e1f9 Tidelift tasks
• 31f18ae Create funding.yml
• 33ca01c Fix using the `gitignore` and `stats` options together ([Snyk] Fix for 1 vulnerabilities #121)
• c737820 Minor TypeScript definition improvements
• 82db101 Add Node.js 12 to testing ([Snyk] Security upgrade webpack-bundle-analyzer from 3.5.0 to 4.0.0 #117)

See the full diff

Package name: html-loader

The new version differs by 55 commits.

• d7cccfa chore(release): 1.0.0
• 3c9a1d8 refactor: `attributes` option (i18nlint: add ignore Automattic/wp-calypso#265)
• 8c73761 feat: `preprocessor` option (Editor: Prevent Use of Editor from Core-Apps Webviews Automattic/wp-calypso#263)
• f2ce5b1 feat: improve errors
• 9923244 chore(deps): update (Purchases: Allow disabling input fields in credit card form Automattic/wp-calypso#260)
• 9835bde feat: supports `link:href` attribute for css (Purchases: Certain texts on expired upgrades are hard to read Automattic/wp-calypso#258)
• 7af2eff refactor: improve schema (Purchases: Verification screen for cancelled purchase Automattic/wp-calypso#257)
• 98412f9 docs: `filter` sources (Signup: Theme step should use ThemesList component Automattic/wp-calypso#256)
• ff0f44c feat: implement the `filter` option for filtering some of sources (NUX: account + site signup sends old version of the welcome email Automattic/wp-calypso#255)
• 1c24662 refactor: move the `root` option under the `attributes` option (Signup: Choose a display name rather than a username Automattic/wp-calypso#254)
• 888b8fe docs: add footnote for `-attributes` (Signup: Accessibility fixes Automattic/wp-calypso#252)
• 3d2907e refactor: remove the `interpolate` option
• bd979e2 refactor: remove the `interpolate` option
• fcba4ec fix: handle only valid srcset tags (Signup: List of all active flows Automattic/wp-calypso#253)
• 9e5ce56 perf: improve source parse (Signup: Plans: custom header text for /start/premium Automattic/wp-calypso#251)
• c9c8dad refactor: improve source parse (NUX: user-only version of the welcome email  Automattic/wp-calypso#250)
• 079d623 fix: respect `#hash` in sources
• a17df49 fix: reduce `import`/`require` count
• d0b0150 fix: adding quotes when necessary for unquoted sources (i18n: Add plural variant to strings using timeLapsed variable Automattic/wp-calypso#247)
• e3727ab test: minifier
• 0bbe29c feat: migrate on `htmlparse2`
• b7af031 fix: escape `\u2028` and `\u2029` characters (Editor: Notice z-index issue Automattic/wp-calypso#244)
• 24b0427 fix: parser tags and attributes according spec (Sidebar: visual issue when resizing from small to large viewport Automattic/wp-calypso#243)
• 3df909d feat: support `script:src` attributes

See the full diff

Package name: html-webpack-plugin

The new version differs by 139 commits.

• eb73905 chore(release): 4.0.0
• 42a6d4a Add typing for getHooks
• a1a37cf Release html-webpack-plugin 4.0.0-beta.14
• 97f9fb9 fix: load script files before style files files in defer script loading mode
• e97ce17 Release html-webpack-plugin 4.0.0-beta.13
• e448b5d Release html-webpack-plugin 4.0.0-beta.12
• de315eb feat: Add defer script loading
• 7df269f feat: Provide a verbose error message if html minification failed
• 1d66e53 feat: merge templateParameters with default template parameters
• dfb98e7 Fix typo in template option docts
• 096a760 Fix broken links in examples
• a195c34 docs: Update template-option documentation
• 40b410e docs: Update example for template parameters
• bf017f3 chore: Release 4.0.0-beta.11
• 2549557 test: Don't use minification for speed measurement
• de22fc2 test: Adjust measurment for node 6 on travis
• 24bf1b5 fix: Update references to html-minifier
• f4eafdc chore: Release 4.0.0-beta.10
• a2ad30a refactor: Use getAssetPath instead of calling the hook directly
• 2595a79 chore: Release 4.0.0-beta.9
• c66766c feat: Add support for minifying inline ES6 inside html templates
• 655cbcd Fix README typo
• 6de319b update lodash dependency for prototype polution vulnerability
• 35a1541 Properly encode file names emitted as part of URLs.

See the full diff

Package name: lerna

The new version differs by 250 commits.

• 45ff346 chore(release): v5.1.2
• e519f43 fix(conventional-commits): remove pinned lodash.template (People: First pass at disabling the invite form until invitee added Automattic/wp-calypso#3172)
• d242b06 chore(e2e): Add e2e tests for lerna init options (Themes: Sheet live preview Automattic/wp-calypso#3162)
• 56eaa15 fix: update all transitive inclusions of ansi-regex (Remove Plugins page for non-Jetpack sites (cleanup of #3079) Automattic/wp-calypso#3166)
• cb47e7a chore: switch readme image based on dark mode and pin node version (Themes: Related themes Automattic/wp-calypso#3164)
• eb7da85 chore(release): v5.1.1
• 21ce2bf chore: remove broken postversion in root package.json
• 72305e4 fix: allow maintenance LTS node 14 engines starting at 14.15.0 (Themes: Sheet details view Automattic/wp-calypso#3161)
• 6cf9be8 chore: initial e2e spec for lerna init (Export: Automatically fetch advanced settings when switching to exporter Automattic/wp-calypso#3158)
• 479bf4c chore: update CHANGELOG.md
• 6b9c375 chore(release): v5.1.0
• 7e69e9e fix(utils): orphaned child process on Windows (Domain Management: add unlimited email forwarding Automattic/wp-calypso#3156)
• 897caee chore: fix typos (Domains: Purchases: Refactor domains and purchases tests Automattic/wp-calypso#2732)
• c6808fc feat: handle the edge cases in the lerna-nx integration
• ff27ccb chore(release): v5.1.0-alpha.0
• bf7daa6 chore: remove references to git.io (Purchases: No way to re-enable Auto Renew Automattic/wp-calypso#3153)
• c363ec4 chore: restore CI workflow
• 4464787 chore: remove update-historical workflow as no longer needed
• 7caf43b chore: update historical (Domains: Site Redirect: Add placeholder Automattic/wp-calypso#3148)
• 1022919 chore: update historical
• a9f3ba4 chore: update historical (Domains: Add notice for changing contact information prevents transfers for 60 days Automattic/wp-calypso#3147)
• 780cc89 chore: update contributing notes
• 9f32d4e chore: update issue templates and contributing notes
• 1c35828 feat: add experimental support to run tasks via Nx

See the full diff

Package name: postcss-cli

The new version differs by 20 commits.

• 745ad2c 7.0.0
• cf6ea09 Update eslint config
• ea1cec4 Update eslint-config-problems to version 3.1.0 (Editor: Add spellcheck / proofreading feature Automattic/wp-calypso#306)
• 1519430 Update globby to version 10.0.1 (Editor: Add "link to existing content" feature Automattic/wp-calypso#303)
• 5b47456 Update eslint to version 6.8.0 (Framework: replace wpcom-private by wpcom-unpublished Automattic/wp-calypso#305)
• e241672 Update nyc to version 15.0.0 (Purchases: Deploy /purchases to production Automattic/wp-calypso#297)
• 4a87ff1 Update chalk to version 3.0.0 (Fix typo in the readme Automattic/wp-calypso#294)
• e666505 Update prettier to version 1.19.1 (Plugins: Show disabled autoupdate info Automattic/wp-calypso#304)
• 0d3591a Update ava to version 2.4.0 (Framework: Allow for a sans-sidebar layout and adjust accordingly  Automattic/wp-calypso#302)
• cb9f451 Update fs-extra to version 8.1.0 (Don't allow private registration to be removed from the cart Automattic/wp-calypso#301)
• 4f68a46 Update chokidar to version 3.3.0 (Editor: Add word count Automattic/wp-calypso#300)
• 5c22ddb Update yargs to version 15.0.2 (Editor: Fix iOS 8.4 Focus Issues Automattic/wp-calypso#298)
• 79eb0ac Update get-stdin to version 7.0.0 (Purchases: Domain renewals: Removing private registration Automattic/wp-calypso#273)
• 71384c6 Update Travis config; remove AppVeyor
• 6b92df3 BREAKING: Drop Node 6 & 8; test on new Node versions
• 7091819 6.1.3
• 0de7ccf Fix map file path creation (Purchases: Renewals: Use a temporary cart Automattic/wp-calypso#286)
• f1c7352 Update prettier to version 1.18.0 (Purchases: Manage: Implement Use This Card feature Automattic/wp-calypso#281)
• 035bab8 Update nyc to version 14.0.0 (Server Side Rendering: Bundle localization json files Automattic/wp-calypso#274)
• 541048e Update prettier to version 1.17.0 (Purchases: style issues for PayPal in Edit Payment Method Automattic/wp-calypso#272)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Server-side Request Forgery (SSRF)