[Snyk] Fix for 1 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • project-skeletons/sails/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	758/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: grunt

The new version differs by 37 commits.

• 9ba3a99 1.0.3
• eee4c33 Changelog v1.0.3
• 46da7f2 Merge pull request #1636 from gruntjs/upt
• 00f4d8a Drop support for Node 0.10 and 0.12
• e852727 util update
• 56d702e Update deps
• 0105524 Fix race condition with file.mkdir and make it operate more similarily to mkdir -p (#1627) r=@vladikoff
• 303d445 https links (#1629)
• d969132 Merge pull request #1624 from gruntjs/rm-bump-deps
• 289ff91 Remove old bump task and deps
• ccc3163 v1.0.2
• e7795dc Remove iojs from test matrix (#1622)
• a6a133b Remove deprecation warning for coffeescript (#1621) r=@vladikoff
• 06b377e https links to webchat.freenode.net and gruntjs.com (#1610)
• 7c5242f Use node executable for local grunt bin for Windows support
• f6cbb63 Oh right, Windows isnt bash
• a9a20da Try and debug why appveyor is failing on npm
• 48bba6c Move to the test script to avoid npm was unexpected at this time.
• 6b97ac0 Try to fix appveyor script
• 19003ba For appveyor, check node version to decide whether to install npm@3
• 3fcf921 Install npm@3 if npm version is npm 1 or 2
• 77fc157 Use the local version of grunt to run tests
• 400601a Updating devDependencies
• 6592ad1 Update travis/appveyor to node versions we support

See the full diff

Package name: grunt-contrib-coffee

The new version differs by 9 commits.

• 40bfa6b add back internal ci (What are you guys using for validation? swagger-api/swagger-node#198)
• f9eec6e updating to coffeescript 2 (Swagger-node-express and swagger-socket swagger-api/swagger-node#196)
• 72e1818 Merge pull request Can we have a multiple swagger UI? swagger-api/swagger-node#193 from Florian-R/coffee-1.11.1
• 634e41f Bump coffee-script to 1.11.1
• c643075 Remove trailing spaces.
• 9bcddc1 Update grunt-contrib-internal to v1.1.0.
• bdc062c Update grunt to 1.0.0
• dbb494f Update CHANGELOG.
• bd39fc5 Update dependencies.

See the full diff

Package name: grunt-contrib-watch

The new version differs by 16 commits.

• 6ec71e9 v1.0.1
• 7d20933 Update copyright year
• e3d19df Update ci configs
• d117574 Updating ci configs
• 99410a7 README.md: Fixed typos (Support a default controller swagger-api/swagger-node#536)
• 7f8cf80 Add local grunt-cli
• ab6771e Drop back to grunt@0.4.5 until the bad test helper can be sorted
• 2e2daa5 Update to gaze@1.1.0
• 3d7fa3a Avoid timing issue in tests because of the bad test helper
• 0130a16 Merge pull request npm warning of deprecated packages when installing swagger swagger-api/swagger-node#500 from gruntjs/deps
• 5289845 Update devDependencies.
• fd3ed7a Lint tweaks.
• e42386a Merge pull request Customize Swagger UI swagger-api/swagger-node#501 from cepko33/master
• 8c93077 Updated lodash and changed outdated 'contains' to 'includes'
• 986b8a9 Update CHANGELOG.
• 5e155ec Add AppVeyor for Windows testing.

See the full diff

Package name: grunt-sync

The new version differs by 1 commits.

• ca10eb6 Bumping deps

See the full diff

Package name: include-all

The new version differs by 12 commits.

• b74f353 3.0.0
• 6c877b0 Merge pull request [Snyk] Security upgrade nodemon from 1.19.4 to 2.0.3 #19 from balderdashy/use-sailshq-lodash
• 80834c3 Replace "lodash" with "sailshq/lodash"
• 4c34bd3 Merge pull request [Snyk] Security upgrade mocha from 3.5.3 to 6.0.0 #18 from balderdashy/use-merge-dictionary-module
• d2f8bb7 Merge branch 'master' into use-merge-dictionary-module
• ffc1185 Fix nesting test to work on Windows
• ff0a21d Added test for merging arrays, and reorganized tests into "edge cases" suite
• 5f5f423 Add some comments just to remind ourselves what this test is doing.
• 4369f5e Use the `merge-dictionaries` module to safely merge modules in `.aggregate()`
• 4a40680 Update README.md
• d21d8c4 2.0.0
• 3314bc1 Don't clear ".node" files when deep-cleaning the cache

See the full diff

Package name: sails

The new version differs by 250 commits.

• 6e73a65 1.0.0
• 5f1d8b3 1.0.0-49
• 616e4e1 Insist on the latest sails-generate.
• 6ab0a5a 1.0.0-48
• 1e28823 Lifting with --redis now sets @sailshq/connect-redis and @sailshq/socket.io-redis.
• 9f29a03 Change approach from what was begun in 520a3c8cac5db1d9698c50efff82e476ec64fca8 so that we maintain the correct package name for the purpose of require().
• 520a3c8 Tolerate '@sailshq/connect-redis' as session adapter.
• e2813f5 1.0.0-47
• 6768743 Tweak warning message.
• ce95c84 Update comments to reflect that req.setLocale() is fully supported as of Sails v1.0 and beyond.
• 0753a99 Trivial
• 3bdd786 Tweak troubleshooting tips.
• e8f9bee Check dev-dependencies for sails-hook-grunt
• e8493a6 1.0.0-46
• d1b6061 run tests on Node 9
• b3afed7 Fix issue with CSRF black/whitelists and routes containing optional params when the requested URL contains a querystring but NOT the optional param (whew!)
• 663527f Fix test error output
• 69ead96 Revert 35ae3ccba472bf4a8edb8ffd7d579d18391d1ba0 in favor of clarifying some of the wording.
• 35ae3cc Experiment with customizable www path
• a89d7a4 extrapolate www path
• a2a0789 Tolerate sails-hook-grunt specified in devDependencies when running sails www
• 0b42c59 Don't attempt to create a Redis connection if "client" is provided.
• 1700788 Update LICENSE.md
• 9c532dc Merge pull request #4267 from luislobo/patch-3

See the full diff

Package name: sails-disk

The new version differs by 85 commits.

• 15faa44 1.0.0
• a2b7ee6 1.0.0-12
• 9d7118c Only set footprint keys for uniqueness violations.
• a2c2261 Add some assertions.
• a222824 Update gitignore and scripts
• 3b3c334 1.0.0-11
• cef95b4 Support updating the primary key value, as long as it's not using _id as the column.
• aad2a15 Set _id column to value of primary key when creating records.
• 333e2d1 1.0.0-10
• c8a26c5 Add shim to replicate MongoDB's behavior w/ `{ $ne: null }` and empty arrays.
• bf92cb8 1.0.0-9
• af97943 Workaround issue with projections including only `_id`
• b5b985b Relax restrictions on using `_id` column in sails disk.
• f4adfd7 Add an entry in the `refCols` dictionary for every model, so we don't have to short-circuit checks for it later
• b494fd9 In `find`, deserialize Buffer objects into `ref` attributes where possible.
• 7aaaaa4 Merge pull request Response Class empty when integrating with swagger-ui swagger-api/swagger-node#58 from balderdashy/expose-lib
• 70ead96 (whoops) Add back 0.10 and 0.12 in appveyor.yml
• beabe7a Merge pull request Add explicit support for consumes and produces parameters in spec swagger-api/swagger-node#57 from balderdashy/expose-lib
• 9c80187 1.0.0-8
• f7a349d Actually, don't expose the static lib. (No reason to do so, and better to not introduce something experimental if there's any chance it could make an app dependent on random stuff in a dev-only adapter)
• 2d4d97e 1.0.0-7
• f2dd761 Rename afterwards function to avoid perceived scope conflict (whether or not it'd ever actually be a big deal, this avoids any potential future scope issues from refactoring, etc).
• 4051e5e 1.0.0-6
• 250c32e Handle stray error (and a couple of other trivial changes just from when I was reading through the code)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic