[Snyk] Fix for 1 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • deps/npm/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: hosted-git-info

The new version differs by 66 commits.

• a810463 chore(release): 3.0.8
• bede0dc fix: simplify the regular expression for shortcut matching
• afe2808 chore(release): 3.0.7
• eb5bd5a fix: correctly filter out urls for tarballs in gitlab
• d30f96e chore(release): 3.0.6
• c067102 fix: support to github gist legacy hash length
• c53c6ab chore(release): 3.0.5
• 167cef2 chore: properly advertise version support
• 47c931e update lru-cache to latest
• 8e0b0ec chore(release): 3.0.4
• 0835306 fix: Do not pass scp-style URLs to the WhatWG url.URL
• 6f39e93 chore(release): 3.0.3
• 31140a7 Ensure passwords in hosted Git URLs are correctly escaped
• 4636ac9 chore(release): 3.0.2
• 3e5fbec fix: do not encodeURIComponent the domain
• 97c8caa chore(release): 3.0.1
• e3e3054 fix: update pathmatch for gitlab
• af4835c test: added script to get coverage report
• d04239b test: removed unused testing structure
• 4693b9c test: moved all github url tests together
• a03d51e test: added refactered tests for bitbucket
• 0aea712 test: added ignore; for 100% testing (this seems wonky)
• b473c55 test: added basic test for ._fill() method
• fa87af7 fix: updated pathmatch for gitlab

See the full diff

Package name: init-package-json

The new version differs by 21 commits.

• 1703339 2.0.1
• a99f769 [email protected]
• 434ecd4 [email protected]
• 5ac9b2a 2.0.0
• 6396ea8 chore: changelog for v2.0.0
• f4c67c5 BREAKING: requires node10+
• 35b18fc chore: update to auto-bump on npm version system
• 786e88b chore: bump transitive deps
• 32012d9 [email protected]
• 5deeae9 [email protected]
• 56477ed [email protected]
• 68f5b77 [email protected]
• 6b865ec [email protected]
• 9a05ee4 chore: remove standard-version dev dep
• 16c52cb test: removes dev dep in npm
• c0ace81 fix: accounts dot vs dash version/license config
• b20020b [email protected]
• 4c22248 [email protected]
• 3e772e9 Updated package-lock to v2
• 2b5d21e chore: updating package-lock.json
• 8515942 chore: update CI for current Node LTS

See the full diff

Package name: normalize-package-data

The new version differs by 12 commits.

• e584704 3.0.0
• 6899b0c fix: broken tests w/ latest hosted-git-info
• 40d07df [email protected]
• e938119 chore: update engines
• 7e70f63 [email protected]
• 0ba7f91 [email protected]
• 30afb71 chore: remove async dev dep
• db9c672 [email protected]
• cc89759 chore: remove underscore dev dep
• b224ba1 chore: update to package-lock v2
• dedb606 2.5.0
• f97372c deps: use `resolve.isCore` instead of `is-builtin-module` for better data and better node compat (How about an io.js podcast to help us keep up? nodejs/node#99)

See the full diff

Package name: npm-package-arg

The new version differs by 25 commits.

• bf86221 chore(release): 7.0.0
• 68a4fc3 deps: bump hosted-git-info to 3.0.2
• ee44e84 chore: update deps
• 1da5ca9 chore(release): 6.1.1
• 84a9569 chore: add node 12 to travis
• c5da1f4 chore: boost test coverage to 100%
• 3909203 fix: preserve drive letter on windows git file:// urls
• a5a18b3 chore: update CI for current Node LTS
• b2c1e0c deps: bump devDeps
• db7ca93 deps: bump deps
• 4760e1c chore(release): 6.1.0
• 7d0d957 deps: bump devDeps
• 4b62929 deps: bump deps
• adf41e8 docs(coc): updated CODE_OF_CONDUCT.md
• f446255 docs(contributing): updated CONTRIBUTING.md
• 861040c meta: standardise release process
• ab99f8e feat(alias): add `npm:` registry alias spec ([Snyk] Security upgrade eslint-plugin-markdown from 1.0.0-beta.7 to 2.2.0 #34)
• 647a0b3 fix(git): Fix gitRange for git+ssh for private git ([Snyk] Security upgrade pacote from 2.7.38 to 8.0.0 #33)
• 8425a96 6.0.0
• 8c60180 deps: bump hosted-git-info and semver
• cf55b3f deps: update package-lock to latest format
• 5b2a731 Stop defaulting git-branch, return null when unset ([Snyk] Security upgrade lodash from 4.17.4 to 4.17.20 #26)
• ba0ae6a handle case where arg is an object but not an npa instance ([Snyk] Fix for 1 vulnerabilities #29)
• 99c778e travis: test node 8 not 7

See the full diff

Package name: pacote

The new version differs by 250 commits.

• ed57e5c 10.1.2
• d9bce22 git: resolved should be a git+ssh:// url, not just ssh://
• 84535a3 git: Fall back from tgz to ssh on HTTP errors
• 7ee23c3 git: make 'from' and 'resolved' consistent and useful
• 10ff45f update deps to pull in newer hosted-git-info
• 88beaab Return the requested spec as the 'from' value
• e5b84f2 test: fix git configs for git 2.23 and above
• 5a3bfbd typo in bin usage text
• 04a0f0c Keep home dir out of snapshots
• ae7c912 10.1.1
• cb31be8 filter out .swp files from package
• 43e239d 10.1.0
• 3d4012a add pacote CLI
• 99a3f21 update tap
• dc10617 test: node 13 made errno a number again
• e516f96 add repository field to package
• 37f24b3 10.0.0
• ad72e94 test: use t.testdir() instead of manually creating test dirs
• a79846e fresh update all deps
• 2e4482a Improve integrity consistency and handling
• 9964c7b update tap and minipass-fetch
• 6460b02 Remove spurious top-level dep on make-fetch-happen
• 1f4473a Pack and unpack preserving exec perms on all package bins
• 347c563 Cache manifest as fetcher.package

See the full diff

Package name: read-package-json

The new version differs by 17 commits.

• 9f7049d chore(release): 3.0.0
• 19d9fbe fix: check-in updated lockfile
• eef46fa chore: add engines definition
• 36b7ef7 chore: remove old .travis.yml envs
• b3a8831 [email protected]
• fb3ceae [email protected]
• 78add03 [email protected]
• 7595d70 [email protected]
• 10175d8 chore(release): 2.1.2
• fdbf082 fix: even better json errors, remove graceful-fs
• e78afd6 chore(release): 2.1.1
• b8cb5fa fix: normalize and sanitize pkg bin entries
• 55382c2 chore(release): 2.1.0
• 0a176cc Add some tests and clean up error handling for non-string bins
• 76f6f42 feat: support bundleDependencies: true
• 4e1e4d2 some tests for index.js parsing
• 67f2d8d chore: update CI for current Node LTS

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic