[Snyk] Fix for 3 vulnerabilities

[midnightcrisis]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
• package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Uncontrolled resource consumption SNYK-JS-BRACES-6838727	No	Proof of Concept
	858/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 9.3	Authentication Bypass SNYK-JS-HAWK-6969142	No	Proof of Concept
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: http-proxy-middleware

The new version differs by 31 commits.

• 3b97308 fix(ws): internal server upgrade (#357)
• 616f60f Dependencies update (#352)
• c70200e fix(ws): fix concurrent ws requests (#344)
• 021b03f chore(dependencies): update micromatch@4 and dev dependencies (#342)
• 0347c43 ci(travis): use xenial (#341)
• b13302c refactor: remove options `proxyHost` and `proxyTable` (BREAKING CHANGE) (#332)
• a30a74b Merge pull request #328 from chimurai/ts
• 5dd8971 ci(travis-ci): build stages
• caa2017 refactor: migrate to typescript
• 721dc63 ci(coverage): replace istanbul with nyc (#325)
• 80fc9e8 ci(node): drop node v4 and v5
• 9f8a292 chore: housekeeping
• 6422977 chore(package.json): bump 0.19.1
• 357c58f chore(dependencies): update dependencies
• a7a2346 style(prettier): add prettier config
• 58548ef style(prettier): use prettier
• 9b9d080 ci: node 10 and 11
• 1f9bd21 docs: context matching note (#142)
• ab485dd fix(log): Handle case when error code is missing (#303)
• 029c99d docs: fix headings & syntax highlighting (#313)
• bb59c66 chore(package.json): bump 0.19.0 (#294)
• 0497805 Bump http-proxy version to 1.17.0 (#261)
• 7a5bf5e docs: update github templates
• 952c1af chore(package.json): bump v0.18.0

See the full diff

Package name: node-sass

The new version differs by 30 commits.

• 476e11c 4.9.4
• 746759c Upgrade request package to v.2.88
• cdf24f2 4.9.3
• ff64b09 fix: bump node-gyp for hoek fix
• 33e8b36 Typo: verion -> version
• 60d9ae9 chore: Remove Travis Gitter hook (#2453)
• ecfcab0 4.9.2
• 57c8b59 Stop telling people to run npm rebuild with --force
• cba089d Remove custom issue template
• 240e8da 4.9.1
• cc6ff42 Restore old node to CI
• ef713a7 Bump request@2.87.0
• 62fd84a chore: Add info for "Pinned" label
• d3aebe7 Create CODE_OF_CONDUCT.md
• 18d198e typo: node-sas -> node-sass
• 64fdacf chore: Add link to 2355 on PR template
• 8040cb7 docs: add more 404 binding install info
• a3ac021 Clean out duplicate ISSUE template
• e0a92f6 docs: Cleanup issue templates
• 94ce852 Be even more explicit that Node 10 needs 4.9
• 91973ed chore: Add compile issue details to bug template
• e23531d Update issue templates using builder
• 8878118 docs: Add Feature request issue template
• 043e2bc docs: Move and update Installation template

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Note: This is a default PR template raised by Snyk. Find out more about how you can customise Snyk PRs in our documentation.

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled resource consumption
🦉 Authentication Bypass

[secure-code-warrior-for-github]

Micro-Learning Topic: Authentication bypass (Detected by phrase)

Matched on "Authentication Bypass"

What is this? (2min video)

Improper authentication happens when mechanisms intended to identify the user are flawed (easily tamperable or insufficient). This would allow an attacker to bypass access controls or to easily impersonate a user.

Try a challenge in Secure Code Warrior

Helpful references

• OWASP Improper Authentication prevention cheat sheet - This article is focused on providing clear, simple, actionable guidance for preventing improper authentication flaws in your applications.

Micro-Learning Topic: Inefficient regular expression (Detected by phrase)

Matched on "Inefficient Regular Expression"

What is this? (2min video)

A regular expression that requires exponential time to match certain inputs can be a performance bottleneck, and may be vulnerable to denial-of-service attacks.

Try a challenge in Secure Code Warrior