[Snyk] Fix for 7 vulnerabilities

[aliscco]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	Yes	No Known Exploit
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: ecmarkup

The new version differs by 88 commits.

• 016c0bb Version 10.0.1
• 5ce4e28 Version 10.0.0 (Remove interoperability between TypedArrays and DataView instances tc39/ecma262#411)
• a7ebc3c fix build-spec (Remove unnecessary step on %ArrayIteratorPrototype%.next tc39/ecma262#412)
• 92a4e60 drop changelog (Allow non-HTML-encoded entities tc39/ecma262#404)
• e919955 completion-record local typechecking (Editorial: Correct typo tc39/ecma262#408)
• b0cc87e rename some cli flags (Editorial: Minor ReturnIfAbrupt cleanup tc39/ecma262#406)
• 5b19588 various tweaks to the biblio (Normative: account for possible abrupt completion tc39/ecma262#405)
• 33de657 Bump various dependencies (B.1.4 AtomEscape production syntax incomplete tc39/ecma262#378)
• a5f95e9 remove runtime dependency on eslint by depending on the codeframe formatter directly (Behavior of for-in on null or undefined tc39/ecma262#377)
• 8471723 switch from nomnom to command-line-args (editorial: tweak recent commit tc39/ecma262#376)
• 8e577d8 ecmascript spelling (Editorial: Start all fields and slots with an uppercase code point tc39/ecma262#407)
• 6b5838b Version 9.8.1
• ce4a276 Fix header parser (RegExp fixes tc39/ecma262#403)
• 74db0e9 Version 9.8.0
• b971460 Add shortcuts help dialog (Normative: Fix Annex B FiB to only assign function Objects out of blocks and allow redeclarations. tc39/ecma262#400)
• f34a045 Version 9.7.1
• da3f316 Ensure emu-meta tags are fenced by the same mechanisms that xrefs are (Built-in Modules tc39/ecma262#395)
• 7f9c84c fix test broken in last commit, oops
• 2e7e5f2 stop trying to use the ecmarkdown parse tree from the linting phase (Make Realm's field records start with an uppercase code point tc39/ecma262#393)
• 57cf9cb Version 9.7.0
• ff18989 Add [fence-effects=""] to stop effect propagation (PropertyName doesn't inherit Yield in AssignmentProperty tc39/ecma262#388)
• 67b40a0 bump ecmarkdown and support arbitrary attributes for steps (NewPromiseCapability & GetCapabilitiesExecutor Functions tc39/ecma262#392)
• da9b7e9 Rename Xref#canHaveEffect to Xref#shouldPropagateEffect (Typo: "must be true so, let" should be "must be true, so let" tc39/ecma262#389)
• d457b66 Version 9.6.5

See the full diff

Package name: jsdom

The new version differs by 188 commits.

• 74a8d1e Version 16.6.0
• f51f2ec Remove the dependency on request
• 2b6d5ae Update dependencies
• b72b33b Disable now-crashing canvas test
• 39b7972 Handle null and undefined thrown as exceptions
• 04f6c13 Add ParentNode.replaceChildren() (Normative: add Object.groupBy and Map.groupBy tc39/ecma262#3176)
• e4c4004 Version 16.5.3
• 2f41466 Fix MutationObserver infinite loop bugs (Editorial: remove unused isLittleEndian parameter of GetModifySetValueInBuffer tc39/ecma262#3173)
• b232f2a Run partially-failing WPTs in the custom-elements directory
• 35e103e Run partially-failing WPTs in the cors directory
• 77b660a Run partially-failing WPTs in the FileAPI directory
• d8a245f Use `InnerHTML` mixin for `innerHTML` definition (@domenic there is disagreement on that: tc39/ecma262#2981)
• bd50bbe Version 16.5.2
• d5cfd69 Fix event handler ObjectEnvironment instantiation
• 93e3d4a Remove vestigial concurrentNodeIterators option-passing
• c92f9c1 Check all associated elements for form validity
• 2202703 Fix failing WPTs calculation
• 21c7671 Upgrade dependencies
• c1b9ea1 Port skipped "test_body_event_handler_inline" to WPT
• a13d854 Use WeakRefs for NodeIterator tracking when supported
• fdf97d8 Fix radio/checkbox to not fire events when disconnected
• 761d8cc Refactor <output>
• b36d418 Make customElements.whenDefined() resolve with the constructor
• c5d13bb Remove a variety of redundant to-port tests

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Command Injection