[Snyk] Fix for 5 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/salesforcedx-vscode-lightning/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	429/1000 Why? Has a fix available, CVSS 4.3	Reverse Tabnabbing SNYK-JS-ISTANBULREPORTS-2328088	Yes	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOCHA-561476	Yes	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: mocha

The new version differs by 250 commits.

• eb781e2 Release v6.2.3
• 10dbe94 update CHANGELOG for v6.2.3 [ci skip]
• 848d6fb security: update mkdirp, yargs, yargs-parser
• 843a322 6.2.2
• aec8b02 update CHANGELOG for v6.2.2 [ci skip]
• 7a8b95a npm audit fixes
• cebddf2 Improve reporter documentation for mocha in browser. (Update java-setup.md forcedotcom/salesforcedx-vscode#4026)
• 3f7b987 uncaughtException: report more than one exception per test (fix: changed version of types/chai to 4.3.0 forcedotcom/salesforcedx-vscode#4033)
• ee82d38 modify alt text of image from Backers to Sponsors inside Sponsors section in Readme (chore(deps-dev): bump @types/node from 17.0.23 to 17.0.25 forcedotcom/salesforcedx-vscode#4046)
• e9c036c special-case parsing of "require" in unparseNodeArgs(); closes chore(deps-dev): bump @types/chai from 4.3.0 to 4.3.1 forcedotcom/salesforcedx-vscode#4035 (chore(deps-dev): bump @types/node from 17.0.23 to 17.0.29 forcedotcom/salesforcedx-vscode#4063)
• 954cf0b Fix HTMLCollection iteration to make unhide function work as expected (Removing all checkpoints doesn't update them in the connected org forcedotcom/salesforcedx-vscode#4051)
• 816dc27 uncaughtException: fix double EVENT_RUN_END events (fix: add ability to stop containerless function forcedotcom/salesforcedx-vscode#4025)
• 9650d3f add OpenJS Foundation logo to website (Org Browser - retrieve or metadata is not working forcedotcom/salesforcedx-vscode#4008)
• f04b81d Adopt the OpenJSF Code of Conduct (chore(deps): bump vscode-extension-telemetry from 0.0.17 to 0.4.5 forcedotcom/salesforcedx-vscode#3971)
• aca8895 Add link checking to docs build step (chore(deps-dev): bump rimraf from 2.6.3 to 2.7.1 forcedotcom/salesforcedx-vscode#3972)
• ef6c820 Release v6.2.1
• 9524978 updated CHANGELOG for v6.2.1 [ci skip]
• dfdb8b3 Update yargs to v13.3.0 (chore(deps): bump @salesforce/source-deploy-retrieve from 5.12.2 to 5.12.6 forcedotcom/salesforcedx-vscode#3986)
• 18ad1c1 treat '--require esm' as Node option (Unexpected error message when cancelling out of create LWC test command forcedotcom/salesforcedx-vscode#3983)
• fcffd5a Update yargs-unparser to v1.6.0 (chore(deps-dev): bump snyk from 1.859.0 to 1.889.0 forcedotcom/salesforcedx-vscode#3984)
• ad4860e Remove extraGlobals() (chore(deps): bump jest-editor-support from 28.2.0 to 30.0.2 forcedotcom/salesforcedx-vscode#3970)
• b269ad0 Clarify effect of .skip() (chore: merge main to develop forcedotcom/salesforcedx-vscode#3947)
• 1e6cf3b Add Matomo to website (chore: add gusinfo to codeowners @W-9377468@ forcedotcom/salesforcedx-vscode#3765)
• 91b3a54 fix style on mochajs.org (Release/v54.4.0 forcedotcom/salesforcedx-vscode#3886)

See the full diff

Package name: mocha-junit-reporter

The new version differs by 23 commits.

• 8e0b9e4 Merge branch 'master' of https://github.com/michaelleeallen/mocha-junit-reporter
• 4a7cca4 Bump glob-parent from 5.1.1 to 5.1.2
• 2a321e3 Merge pull request [Snyk] Security upgrade @salesforce/core from 2.25.1 to 3.32.12 #152 from michaelleeallen/dependabot/npm_and_yarn/glob-parent-5.1.2
• 5403f63 Merge pull request [Snyk] Fix for 4 vulnerabilities #155 from pkuczynski/upgrade-strip-ansi
• 2222692 Upgrade [email protected]
• 1c3eb62 Bump glob-parent from 5.1.1 to 5.1.2
• 88388ee Merge pull request [Snyk] Security upgrade electron from 7.3.2 to 10.4.1 #104 from michaelleeallen/add-actions
• 2cd514a Merge pull request [Snyk] Fix for 25 vulnerabilities #133 from michaelleeallen/dependabot/npm_and_yarn/lodash-4.17.19
• 18ff0f4 Merge pull request [Snyk] Security upgrade electron from 7.3.2 to 17.4.11 #115 from gabegorelick/setup-teardown-time
• a3ec7b5 Bump lodash from 4.17.15 to 4.17.19
• d2770c2 Testsuite time should include setup and teardown
• 3d1909d Drop support for misspelled option `suiteTitleSeparatedBy`
• fababe6 tests: Actually invoke mocha instead of mocking it out
• 076aeab Run lint in GitHub Actions
• bcbfb2f Fix eslint
• fd6ed97 Build PRs too
• 671bc9e Update jenkins mode to use suiteTitleSeparatedBy and update documentation ([Snyk] Fix for 4 vulnerabilities #123)
• 3824381 Fix all `npm audit` issues ([Snyk] Security upgrade mocha from 5.2.0 to 6.2.3 #124)
• 29a1dd4 Fix strict mode declarations
• 9e2527c Support node 10, 12, 14 ([Snyk] Security upgrade electron from 7.3.2 to 17.4.11 #117)
• e2d8232 Turn on linting ([Snyk] Security upgrade electron from 7.3.2 to 17.4.9 #116)
• 663b967 Upgrade eslint
• 298d1a6 Create npmpublish.yml

See the full diff

Package name: nyc

The new version differs by 127 commits.

• bebf4d6 chore(release): 15.0.0
• 2931730 chore: Update to final releases of dependencies (Update LSP jar for NPE that happens during computing references forcedotcom/salesforcedx-vscode#1245)
• d44ff19 chore: Update node-preload and use process-on-spawn (Apex Tests should be grouped by Package forcedotcom/salesforcedx-vscode#1243)
• 5258e9f feat: Filenames relative to project cwd in coverage reports (Edit Prettier doc forcedotcom/salesforcedx-vscode#1212)
• 6039f29 chore: Unpin test-exclude, update to latest pre-releases (Extension causes high cpu load forcedotcom/salesforcedx-vscode#1240)
• f3c9e6c chore: Temporarily pin test-exclude (Extension causes high cpu load forcedotcom/salesforcedx-vscode#1239)
• 28ed746 chore: Lazy load modules that are rarely/never needed in test processes. (fix: misc aura/lwc lsp bug fixes, support lwc component methods in tree, unknown project types forcedotcom/salesforcedx-vscode#1232)
• 7307626 chore: Remove cp-file module (update request-light to 0.2.4 forcedotcom/salesforcedx-vscode#1230)
• dfd629d fix: Better error handling for main execution, reporting (Extension causes high cpu load forcedotcom/salesforcedx-vscode#1229)
• 549c953 chore: Update dependencies, pin find-cache-dir (Allow selection of multiple files/folders on Deploy/Retrieve source forcedotcom/salesforcedx-vscode#1228)
• a1dee03 chore: Update yargs (Update telemetry for dirType on command events forcedotcom/salesforcedx-vscode#1224)
• 8078a79 chore: Fix 404 in README.md. (Extension causes high cpu load forcedotcom/salesforcedx-vscode#1220)
• 7a02cb7 chore: Add enterprise language (Extension causes high cpu load forcedotcom/salesforcedx-vscode#1217)
• ea94c7f chore: Remove unused functions (Add missing dependencies.md forcedotcom/salesforcedx-vscode#1218)
• 53c66b9 docs: `npm home nyc` goes to github master branch README (update LSP to 2.0.11 (doc only changes) forcedotcom/salesforcedx-vscode#1201)
• cf5e5d3 chore: Update dependencies
• 8411a26 fix: Correct handling of source-maps for pre-instrumented files (#1216)
• f890360 docs: Fix URL to default excludes in README.md (add a close bracket to the runAs method forcedotcom/salesforcedx-vscode#1214)
• 3726bbb chore: Update to async version of istanbul-lib-source-maps (Extension causes high cpu load forcedotcom/salesforcedx-vscode#1199)
• 0efc6d1 chore: Tweak arguments for async coverage data readers (Port: Update lightning LSPs to 2.0.9 (#1197) forcedotcom/salesforcedx-vscode#1198)
• cc77e13 chore: Add `use strict` to all except fixtures (Update lightning LSPs to 2.0.9 forcedotcom/salesforcedx-vscode#1197)
• bcbe1df chore: Update dependencies (Context that shows/hides commands is not refreshed when switching orgs forcedotcom/salesforcedx-vscode#1196)
• 2735ee2 chore: 100% coverage (Extension causes high cpu load forcedotcom/salesforcedx-vscode#1195)
• fd40d49 feat: Use @ istanbuljs/schema for yargs setup (#1194)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic