[Snyk] Fix for 1 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • assets/static/theme/vendor/chartist/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-ASYNC-2441827	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: grunt-assemble

The new version differs by 32 commits.

• aec2a33 run grunt docs
• 37ba398 typos
• 0801195 0.6.0
• 03c1b4c include migrations section in readme and generate new readme documentation
• 9559859 run grunt assemble after migration
• 180d54b migrate templates to be compatible with changes made in assemble-handlebars 0.4.0
• 5d92e19 migration docs update
• 2021365 include handlebars-helper-eachitems
• 0766a24 include markdown helpers
• 3a0df4e start adding docs about the differences between v5 and v6
• bd118d8 add inspect helper since that was removed from handlebars-helpers
• 483cdce update to latest assemble-handlebars
• 6776d53 Merge pull request [Snyk] Security upgrade grunt from 0.4.5 to 1.5.0 #58 from LaurentGoderre/fix-57
• a5f51a0 Create a copy of the page collection for rendering purpose
• a5dbf26 0.5.0
• 9adbe1f Merge branch 'master' of https://github.com/munim/grunt-assemble into munim-master
• 0700e4a Merge branch 'master' of https://github.com/evil-shrike/grunt-assemble into evil-shrike-master
• cb833ce Merge branch 'dvera123-update_lib'
• e990c12 Merge branch 'update_lib' of https://github.com/dvera123/grunt-assemble into dvera123-update_lib
• aff988f formatting
• 6ed5533 Merge branch 'master' of https://github.com/matti142/grunt-assemble into matti142-master
• 76e0603 Merge branch 'master' into justinph-master
• 36989de run `grunt assemble` after updating to Handlebars 3.0.1. Whitespace changes.
• 35a191a fix whitespace

See the full diff

Package name: grunt-concurrent

The new version differs by 5 commits.

• 8c7183c 3.0.0
• 2c8a189 Upgrade dependencies
• f8e1fd9 Add `indent` option ([Snyk] Security upgrade commitplease from 2.3.1 to 2.7.0 #101)
• 468aec3 Require Node.js 8 and Grunt 1
• a672f19 Create funding.yml

See the full diff

Package name: grunt-contrib-connect

The new version differs by 24 commits.

• 5c3d0e7 v3.0.0
• 0df44c9 Merge pull request bean/ch-254_cache_timeout_env_var gitcoinco/codefund#262 from gruntjs/upt-depxa
• caa1331 Update dependencies
• ace8bd8 Merge pull request Convert CodeFund logo to artwork gitcoinco/codefund#260 from gruntjs/dependabot/npm_and_yarn/lodash-4.17.19
• eb4496c Bump lodash from 4.17.15 to 4.17.19
• 4f3954d Merge pull request [ch248] Add chatlio gitcoinco/codefund#261 from gruntjs/add-actions
• 434ecd6 Add actions
• 15b3a28 Merge pull request Bean/ch 221 campaign date picker gitcoinco/codefund#257 from gruntjs/dependabot/npm_and_yarn/lodash-4.17.15
• 801dcda Bump lodash from 4.17.10 to 4.17.15
• b6e703d v2.1.0
• 399dd5f Merge pull request [ch224] Only show user selection for admin gitcoinco/codefund#256 from TheGreatRefrigerator/master
• f93c287 Fix the gitignore change
• 71fcea9 Upgrade morgan to v1.9.1
• d5390ff Allow all configuration options of livereload to be passed through. (bean/ch-204_update_user_on_campaign gitcoinco/codefund#246)
• 9da2f37 v2.0.0.
• 122398b pass directory options to serve-index
• 19924f8 Fixed: options.open.{appName, callback} (bean/ch-103_exclude-advertiser-from-a-property gitcoinco/codefund#230)
• b218f7a Update all dependencies.
• c5a7091 Use https.
• d1cfd54 No need to be verbose now.
• 6289a8a Replace http2 with node-http2.
• 42703e0 Added secureProtocol property in httpsOptions
• 216c5e9 Drop Node.js < 6 support and update devDependencies.
• 6f96a55 Fix a broken test.

See the full diff

Package name: grunt-contrib-htmlmin

The new version differs by 13 commits.

• ce5d713 Update html-minifier to v3.4.0.
• 7e79402 v2.2.0.
• 16e092d Update html-minifier to v3.3.0.
• 4ad1943 v2.1.0.
• 165adf2 Update CI configs.
• 556c63d Update docs.
• a3ab8d5 Merge pull request [Snyk] Fix for 1 vulnerabilities #136 from fassetar/patch-1
• fc0c121 forget cwd example
• 94d4897 example for [Snyk] Security upgrade grunt-contrib-uglify from 1.0.1 to 3.4.0 #134 in docs
• d41bf39 v.2.0.0.
• b8db17a Merge pull request [Snyk] Fix for 1 vulnerabilities #131 from gruntjs/deps
• 69f06f4 Update dependencies.
• 43c64f9 Fix typo in CHANGELOG.

See the full diff

Package name: grunt-contrib-imagemin

The new version differs by 4 commits.

• 413d304 2.0.0
• c8a2752 Remove `changelog` in favor of releases page
• 65ff84e ES2015ify and remove support for Node.js versions older than v4 (Bean/gh 376 fallback campaign boolean gitcoinco/codefund#379)
• 1f245ac Add XO and AVA (Use stats from UserImpressions on the home page gitcoinco/codefund#378)

See the full diff

Package name: grunt-contrib-uglify

The new version differs by 16 commits.

• a34af0d Merge pull request #453 from gruntjs/update-uglify
• 48247f6 v2.2.0.
• 0f638cf Update uglify-js to v2.8.3.
• 463d4d3 Update docs.
• d85adc7 Update uglify-examples.md (#449)
• 90db406 2.1.0.
• 3736268 Minor lint tweaks.
• 0511085 Add one more test for `preserveComments` option.
• cc846ac Update documentation comment options (#444)
• 60824c1 Switch to object.assign since lodash.assign is deprecated.
• aaa5cc9 Update docs.
• fdef3a8 Merge pull request #428 from gruntjs/revert-419-master
• dc7c015 Revert "Used grunt.verbose to show detailed logging"
• 2d04f24 Update uglify to v2.7.0. (Проблемма с кодом gitcoinco/codefund#416)
• 48285c9 Reduce lodash usage. (#422)
• 0d2f331 Used grunt.verbose to show detailed logging (iiccionsss gitcoinco/codefund#419) r=vladikoff

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution