[Snyk] Fix for 3 vulnerabilities

[pyoner]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution npm:extend:20180424	No	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Override Protection Bypass npm:qs:20170213	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: extend

The new version differs by 31 commits.

• 8d106d2 v3.0.2
• e97091f [Dev Deps] update `tape`
• e841aac [Tests] up to `node` `v10.7`
• 0e68e71 [Fix] Prevent merging __proto__ property
• a689700 Only apps should have lockfiles
• f13c1c4 [Dev Deps] update `eslint`, `@ ljharb/eslint-config`, `tape`
• f3570fe [Tests] up to `node` `v10.0`, `v9.11`, `v8.11`, `v7.10`, `v6.14`, `v4.9`; use `nvm install-latest-npm`
• 138b515 v3.0.1
• 7e19a6f [Tests] up to `node` `v7.9`, `v6.10`, `v4.8`; improve matrix
• 0191e27 [Dev Deps] update `tape`, `eslint`, `@ ljharb/eslint-config`
• eee260c [Fix] deep extending should work with a non-object.
• fd71078 [Tests] up to `node` `v6.3`, `v5.12`, `v4.4`
• 760d6be [Dev Deps] update `tape`, `jscs`, `eslint`, `@ ljharb/eslint-config`
• 888f153 Add note about ES6 Object.assign
• fd728a5 [Dev Deps] update `tape`, `jscs`, `eslint`, `@ ljharb/eslint-config`
• 9fd4c58 [Tests] fix npm upgrades on older nodes
• 8e05946 [Tests] up to `node` `v5.3`
• 8bae195 [Dev Deps] update `jscs`, `eslint`, `@ ljharb/eslint-config`
• 8b9a054 [Tests] up to `io.js` `v3.3`, `node` `v4.1`
• 5c45029 [Dev Deps] update `tape`
• 812e0cc [Dev Deps] update `tape`, `jscs`
• 906bd5d Switch from vb.teelaun.ch to versionbadg.es for the npm version badge SVG.
• f0ead35 Update `tape`, `eslint`
• ec017d5 Update `tape`

See the full diff

Package name: mime

The new version differs by 23 commits.

• eb24bae 1.4.1
• 855d0c4 Fix emit error on failed CORS request ladjs/superagent#167
• 1f0af63 1.4.0
• 8d02be2 update to mime-db@v1.30.0
• 78aa9df bump version
• 93caa32 fixup tests
• 29f5a46 Revert "Use facets to prioritize when resolving type conflicts" (Fix node .abort() ladjs/superagent#157)
• f7ccb94 Merge pull request Make res.error / res.err an Error object ladjs/superagent#156 from broofa/facets
• fb02668 Merge pull request Improve the docs for res.body ladjs/superagent#148 from edi9999/patch-1
• d33f801 Merge pull request Failed To Alias Superagent Error ladjs/superagent#133 from xiaody/master
• 902ec07 Use facets to prioritize when resolving type conflicts
• 19a4b97 Merge branch 'master' of github.com:broofa/node-mime
• 89d499e Merge pull request add Accept-Encoding by default ladjs/superagent#155 from WORMSS/patch-1
• 2f1f6a0 debug fix
• 76e8766 update types from latest version of mime-db
• 9515cda Merge pull request request.accept('json') ladjs/superagent#150 from taylorhutchison/master
• 691da1d Removing duplicate scripts property.
• dba7e01 Update LICENSE
• a5c1455 Merge pull request Use new exports.Request instead of new Request in node/index.js ladjs/superagent#142 from billymoon/patch-1
• 9695770 Update package.json
• aa327fe js/json should be utf-8 charset
• 6c3d324 Merge pull request utils.unzip function does not set a decoder ladjs/superagent#125 from pgilad/patch-1
• d0715f3 update license attribute

See the full diff

Package name: qs

The new version differs by 125 commits.

• 10233c9 v6.0.4
• 2e1c659 [Tests] up to `node` `v7.7`, `v6.10`,` v4.8`; disable osx builds since they block linux builds.
• c709f6e [Fix] support keys starting with brackets.
• 65270af [Fix] chmod a-x
• 4d8ed03 [Fix] follow `allowPrototypes` option during merge
• be1c421 v6.0.3
• 938f24e [Fix] Restore `dist` directory; will be removed in v7.
• ca844c5 [Fix] ensure that `allowPrototypes: false` does not ever shadow Object.prototype properties.
• 47dfbd6 v6.0.2
• d89b173 [Docs] Add `evalmd`, fix broken examples in README, and ensure all examples have assertions.
• 807c310 [Tests] add `npm run lint`
• 3efbba4 [Refactor] Don’t reassign function parameters.
• bc0c1cb [Refactor] clean up whitespace.
• d6412f7 [Refactor] Use `module.exports` instead of `exports`.
• 5cc3728 [Fix] use `String(foo)` instead of `foo + ‘’` to correctly cast to a string.
• 4503717 [Refactor] remove unnecessary internal object lookup.
• f1a50c0 Add `npm run dist` to `prepublish`.
• ece0655 Remove compiled files from the git repo.
• 4c78294 Revert "Delete CHANGELOG.md" and update URLs.
• 7872213 [Tests] use my standard `travis.yml` file.
• ce56459 [Tests] convert tests to `tape` so they no longer require ES6 features.
• 224c8af [Refactor] use `var` instead of `const` and `let`.
• e4cf648 [Docs] add myself to package.json as a contributor
• bfe4582 [Dev Deps] update `browserify`, `code`, `lab`

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution