[Snyk] Security upgrade @nextcloud/upload from 1.0.0-beta.17 to 1.0.0

[yesiamdollar]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Cross-site Request Forgery (CSRF) SNYK-JS-AXIOS-6032459	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-6124857	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-AXIOS-6144788	Yes	No Known Exploit
	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	Yes	Proof of Concept
	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962463	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Improper Verification of Cryptographic Signature SNYK-JS-BROWSERIFYSIGN-6037026	Yes	No Known Exploit
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Template Injection SNYK-JS-DOMPURIFY-6474511	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Improper Input Validation SNYK-JS-FOLLOWREDIRECTS-6141137	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	Yes	Proof of Concept
	631/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @nextcloud/upload

The new version differs by 73 commits.

• f1fe61f Merge pull request Opening an invalid direct link triggers a error exception page nextcloud/server#952 from nextcloud-libraries/feat/1.0.0
• ebb3c8a fix(deps): remove uneeded devDependencies
• a3fa1a2 Merge pull request Theming does not longer show right Name and Slogan after upgrade to 10 RC1 nextcloud/server#949 from nextcloud-libraries/feat/label
• dc7d876 chore(deps): various upgrades before final
• c5efb1f 1.0.0
• 3e46dfb fix(tests): typo
• b19fc9f fix: always show upload `Add` label
• d809cd6 Merge pull request Address in mailbox given [https:\/\/spreed.me\/picloud] does not comply with RFC 2822, 3.6.2 nextcloud/server#951 from nextcloud-libraries/dependabot/npm_and_yarn/browserify-sign-4.2.2
• 947669e build(deps): Bump browserify-sign from 4.2.1 to 4.2.2
• ba4e4a3 Merge pull request "The supplied iCalendar datetime value is incorrect" nextcloud/server#950 from nextcloud-libraries/artonge/bump/1.0.0-beta.20
• 575ae0e Bump to 1.0.0-beta.19
• 5e1b3b2 fix: remove actor permission level check
• e56483a Merge pull request Remove internal tag routes nextcloud/server#947 from nextcloud-libraries/chore/deps
• bffe87f fix: adjust tests for new `@ nextcloud/files` update
• 552a198 fix: `@ nextcloud/webpack-vue-config` is needed for cypress
• d221200 fix: logger export
• b83085d fix: `vue-material-design-icons` is bundled
• 664e8a8 chore: make `@ nextcloud/vue` a peerDependencies
• 6f61c4d chore: update dependencies
• 7361ea2 Merge pull request Remove ownCloud reference from the list of supported backend for files external nextcloud/server#946 from nextcloud-libraries/artonge/fix/lastModified_usage
• a411988 Divide lastModified by 1000 to have seconds
• 04388fc Merge pull request Kill ajax/share.php nextcloud/server#945 from nextcloud-libraries/translations_e97a4efa01b14c2690e8c90e55db04f5
• 025fc09 Translate l10n/messages.pot in zh_HK
• 176484e Merge pull request Apps which need an update should be listed at the top nextcloud/server#944 from nextcloud-libraries/dependabot/npm_and_yarn/cypress/request-and-cypress-3.0.1

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Cross-site Request Forgery (CSRF)
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn