[Snyk] Security upgrade update-notifier from 2.3.0 to 4.0.0

[magnologan]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: update-notifier

The new version differs by 31 commits.

• adf7803 4.0.0
• fb5161c Remove the `callback` option (Add code of conduct webhintio/hint#158)
• 39682de Rename `boxenOpts` option to `boxenOptions`
• bc1721a Avoid showing notification if current version is the latest (Add rule to check if opener was disowned webhintio/hint#174)
• ccaf686 Update dependencies
• b1525e6 Disable when `NODE_ENV` is `test` (Add SSL Labs rule webhintio/hint#173)
• bf73119 Fix install command for npm global (Update dependencies to enable Greenkeeper 🌴 webhintio/hint#165)
• 592b025 3.0.1
• f8b4e60 Update Travis matrix
• a6d6b49 Update URL to TTY (Update jsdom to new API webhintio/hint#163)
• f9d168a Remove object spread to support node >=8.0.0 <8.6.0 (Return the right value for rawResponse in CDP webhintio/hint#164)
• 1712928 Tidelift tasks
• 72f83d1 Create funding.yml
• a7bb3ee 3.0.0
• ad8ed1b Suggest yarn when installed with yarn (Add rule that alerts if you are writing bogus code with flexbox webhintio/hint#132)
• 5f06620 Exit the update check process if it does not respond after 30s (Implement OnLoadingFailed in CDP webhintio/hint#156)
• 79e89ad Fix failing test (Make all event interfaces implement another interface? webhintio/hint#155)
• c8faa84 Add `distTag` option (Add test to config-rule.ts webhintio/hint#151)
• 14632e4 Add failing test for Add code of conduct webhintio/hint#153 (Add test to sonar.ts webhintio/hint#154)
• aafd8a0 Require Node.js 8
• 0d49f51 Add Tidelift mention in the readme
• 8df01b3 Fix docs position of `shouldNotifyInNpmScript` (Add rules to check for common accessibility issues webhintio/hint#143)
• d371834 Docs: isGlobal option does not default to true (Add rule(s) to check for caching  webhintio/hint#142)
• 5cd6577 2.5.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[sonatype-lift]

Critical OSS Vulnerability:

pkg:npm/update-notifier@4.0.0

1 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components

pkg:npm/minimist@1.2.0

SEVERE Vulnerabilities (1)




[CVE-2020-7598] minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

CVSS Score: 5.6

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE: CWE-1321

pkg:npm/ini@1.3.4

CRITICAL Vulnerabilities (1)




[sonatype-2020-1214] CWE-471: Modification of Assumed-Immutable Data (MAID)

ini - Prototype Pollution [CVE-2020-7788]

The software does not properly protect an assumed-immutable element from being modified by an attacker.

CVSS Score: 7.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE: CWE-471

(at-me in a reply with help or ignore)

---

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]