[Snyk] Upgrade lockfile-lint from 3.0.5 to 4.6.2

[snyk-bot]

Snyk has created this PR to upgrade lockfile-lint from 3.0.5 to 4.6.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

Warning: This is a major version upgrade, and may be a breaking change.

• The recommended version is 27 versions ahead of your current version.
• The recommended version was released 2 months ago, on 2021-02-26.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Prototype Pollution SNYK-JS-Y18N-1021887	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Prototype Pollution SNYK-JS-Y18N-1021887	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Use After Free SNYK-JS-NODESASS-535497	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Prototype Pollution SNYK-JS-LODASH-608086	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-590103	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Command Injection SNYK-JS-LODASH-1040724	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Prototype Pollution SNYK-JS-INI-1048974	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Remote Memory Exposure SNYK-JS-BL-608877	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Remote Memory Exposure SNYK-JS-BL-608877	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ACORN-559469	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Prototype Pollution SNYK-JS-UNDEFSAFE-548940	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Denial of Service (DoS) SNYK-JS-NODESASS-542662	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Denial of Service SNYK-JS-NODEFETCH-674311	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Prototype Pollution SNYK-JS-LODASH-567746	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Denial of Service (DoS) SNYK-JS-HTTPPROXY-569139	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Prototype Pollution SNYK-JS-HANDLEBARS-567742	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Prototype Pollution SNYK-JS-HANDLEBARS-1279029	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Remote Code Execution (RCE) SNYK-JS-HANDLEBARS-1056767	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Prototype Pollution SNYK-JS-DOTPROP-543489	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Arbitrary File Write via Archive Extraction (Zip Slip) SNYK-JS-DECOMPRESS-557358	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BROWSERSLIST-1090194	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Validation Bypass SNYK-JS-KINDOF-537849	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: lockfile-lint

• 4.6.2 - 2021-02-26
  

  lockfile-lint@4.6.2

• 4.6.1 - 2021-02-20
  

  lockfile-lint@4.6.1

• 4.6.0 - 2021-02-19
  

  lockfile-lint@4.6.0

• 4.3.7 - 2020-06-24
  

  lockfile-lint@4.3.7

• 4.3.6 - 2020-05-14
  

  lockfile-lint@4.3.6

• 4.3.5 - 2020-05-14
  

  lockfile-lint@4.3.5

• 4.3.4 - 2020-05-13
• 4.3.3 - 2020-05-13
• 4.3.1 - 2020-05-13
• 4.2.2 - 2020-03-25
• 4.2.1 - 2020-03-24
• 4.2.0 - 2020-03-23
• 4.1.0 - 2020-03-09
• 4.0.0 - 2020-02-20
• 3.0.18 - 2020-02-10
• 3.0.17 - 2020-02-10
• 3.0.16 - 2020-02-10
• 3.0.15 - 2020-02-10
• 3.0.14 - 2020-02-10
• 3.0.13 - 2020-02-10
• 3.0.12 - 2020-02-04
• 3.0.11 - 2020-02-04
• 3.0.10 - 2020-02-03
• 3.0.9 - 2020-01-26
• 3.0.8 - 2020-01-17
• 3.0.7 - 2020-01-17
• 3.0.6 - 2020-01-16
• 3.0.5 - 2019-12-23

from lockfile-lint GitHub release notes

Commit messages

Package name: lockfile-lint

• 5a9baff chore(release): publish
• 1ab87a9 fix(parser): Fix exception on empty dependencies (.clearfix should add form prefix twbs/bootstrap#107)
• d7564f8 chore(release): publish
• 4a8df76 test: handle unknown validator function name (fix #105. Removed duplicate definition of table reset. twbs/bootstrap#106)
• 1a2af53 chore(release): publish
• cff42a3 chore(release): publish
• f874935 chore(release): publish
• 281c8ec feat: use log sysmbols for easier to read output ([Snyk] Upgrade hugo-bin from 0.50.0 to 0.70.0 #21) (Tabs don't display properly in fluid layout. twbs/bootstrap#104)
• 6f8e5a0 chore(release): publish
• ffe3192 fix(release): update top-level yarn.lock to fix publish fail (Selector optimization twbs/bootstrap#100)
• 2aed559 fix: packages/lockfile-lint/package.json to reduce vulnerabilities (Rename .topbar .fill to topbar .wrapper twbs/bootstrap#98)
• 940d34f chore(release): publish
• e763b99 fix(readme): update docs for allowed-schemes (Unnecessary .fill child for .topbar? twbs/bootstrap#97)
• b0914b6 chore(release): publish
• 6115d68 fix(windows): remove emoji from output not supported on windows (Added in some media queries for a more responsive flavor twbs/bootstrap#96)
• 9855701 chore(release): publish
• a86485b fix: all debug under lockfile-lint namespace (Improving Customization twbs/bootstrap#95)
• fe4290d chore(release): publish
• 37d8eef fix: support host:port syntax (fixed background-color for disabled links in pagination twbs/bootstrap#94)
• a9bf211 chore(release): publish
• 7d239ca fix: bump package ver that skipped releases
• 4e41761 chore(release): publish
• 828868c fix(readme): update example 3 remove invalid argument (Forcing h3 within topbar is bad practice twbs/bootstrap#90)
• a939b5f chore(release): publish

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs