[Snyk] Fix for 30 vulnerabilities

[CentralIntel]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • script/package.json
  • script/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Arbitrary File Overwrite SNYK-JS-BINLINKS-537608	Yes	Proof of Concept
	451/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 2.6	Unauthorized File Access SNYK-JS-BINLINKS-537609	Yes	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Arbitrary File Write SNYK-JS-BINLINKS-537610	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	Yes	Proof of Concept
	704/1000 Why? Has a fix available, CVSS 9.8	Arbitrary File Write via Archive Extraction (Zip Slip) SNYK-JS-DECOMPRESSZIP-73598	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Arbitrary File Overwrite SNYK-JS-FSTREAM-174725	Yes	No Known Exploit
	584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	Yes	Proof of Concept
	626/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.1	Man-in-the-Middle (MitM) SNYK-JS-HTTPSPROXYAGENT-469131	Yes	Proof of Concept
	703/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SSRI-1246392	Yes	Proof of Concept
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit
	410/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Arbitrary File Overwrite SNYK-JS-TAR-174125	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-Y18N-1021887	Yes	Proof of Concept
	434/1000 Why? Has a fix available, CVSS 4.4	Time of Check Time of Use (TOCTOU) npm:chownr:20180731	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution npm:extend:20180424	Yes	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:hoek:20180212	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: electron-chromedriver

The new version differs by 26 commits.

• 3807adb Merge pull request [Snyk] Security upgrade npm from 6.2.0 to 6.10.1 #62 from electron/9-x-y
• 5a726b8 v9.0.0
• 3d0e75f fix: install npm_config_platform=win32 ([Snyk] Security upgrade atom-package-manager from 2.4.3 to 2.6.1 #61)
• ab6cd41 Merge pull request [Snyk] Security upgrade npm from 6.2.0 to 6.6.0 #59 from erickzhao/chore/migrate-get
• b244950 chore: force node 10.12
• 1e4599b chore: upgrade extract-zip to v2.0.0
• 3c22216 refactor: migrate to @ electron/get
• d25a3ac Merge pull request [Snyk] Security upgrade atom-package-manager from 2.4.3 to 2.6.1 #57 from electron/dependabot/npm_and_yarn/acorn-6.4.1
• 2a0b450 Bump acorn from 6.2.1 to 6.4.1
• 0e494e4 Merge pull request [Snyk] Security upgrade npm from 6.2.0 to 6.10.1 #55 from electron/8-x-y
• 400df8e v8.0.0
• c3f66d6 chore: update for 8.0.0-beta.7 ([Snyk] Security upgrade atom-package-manager from 2.4.3 to 2.6.1 #54)
• 209fa2e chore: set @ wg-releases as CODEOWNERS ([Snyk] Security upgrade stylelint from 9.3.0 to 9.7.0 #53)
• ed80a77 Merge pull request [Snyk] Security upgrade postcss from 5.2.4 to 8.2.13 #50 from electron/7-0-x
• 5cba324 Update for v7.0.0
• 2ca0405 Merge pull request [Snyk] Security upgrade atom-package-manager from 2.4.3 to 2.5.0 #48 from electron/dependabot/npm_and_yarn/eslint-utils-1.4.2
• 0051436 chore: Update to 7.0.0-beta.5
• 4b48320 Bump eslint-utils from 1.4.0 to 1.4.2
• 2f4cca7 Merge pull request [Snyk] Security upgrade atom-package-manager from 2.4.3 to 2.5.0 #47 from electron/update-standard-mocha
• e3feaf5 chore: update standard and mocha
• 148292a Merge pull request [Snyk] Security upgrade yargs from 4.8.1 to 10.0.0 #46 from electron/update-stable-6
• bfb0ce6 chore: add support for Electron v6.0.0
• 8dc45bf Bump js-yaml from 3.12.0 to 3.13.1 ([Snyk] Fix for 1 vulnerabilities #43)
• 2a79a74 Bump handlebars from 4.0.12 to 4.1.2 ([Snyk] Security upgrade electron-packager from 12.2.0 to 13.0.0 #44)

See the full diff

Package name: electron-mksnapshot

The new version differs by 14 commits.

• 9b1abfa fix: Allow downloading of custom versions of mksnapshots ([Snyk] Security upgrade yargs from 4.8.1 to 16.0.0 #30)
• 4c31a01 chore: update to v9.0.0 ([Snyk] Fix for 2 vulnerabilities #28)
• fcba03d chore: update mksnapshot to work with arm*-x64 zips ([Snyk] Security upgrade babel-core from 5.8.38 to 6.9.0 #27)
• baeb2a2 Fix download on ARM ([Snyk] Security upgrade babel-core from 5.8.38 to 6.9.0 #26)
• dfc0cd1 Bump acorn from 7.1.0 to 7.1.1 ([Snyk] Security upgrade publish-release from 1.6.0 to 1.6.1 #25)
• 6d9510e 8.0.0 ([Snyk] Security upgrade babel-core from 5.8.38 to 6.9.0 #24)
• e77fd2c v7.0.0
• 3c4921f 6.0.0 ([Snyk] Security upgrade marked from 0.3.19 to 1.1.1 #21)
• cc99f15 Bump lodash from 4.17.11 to 4.17.14 ([Snyk] Security upgrade marked from 0.3.19 to 1.1.1 #20)
• 4d3798f Bump extend from 3.0.1 to 3.0.2 ([Snyk] Security upgrade request from 2.87.0 to 2.88.0 #19)
• 546c646 build: update for 6.0.0-beta.2 ([Snyk] Security upgrade babel-core from 5.8.38 to 6.9.0 #18)
• 66c95ca build: update for 6.0.0-beta.1 ([Snyk] Security upgrade babel-core from 5.8.38 to 6.9.0 #17)
• 199a6a7 build: update for 5.x.x ([Snyk] Security upgrade publish-release from 1.6.0 to 1.6.1 #16)
• 21a3ed0 build: update for 4.2.x ([Snyk] Security upgrade npm from 6.2.0 to 6.14.6 #15)

See the full diff

Package name: electron-packager

The new version differs by 250 commits.

• b56ea8a 17.0.0
• 34c3c4e docs: update NEWS.md for v17.0.0
• 21bb953 refactor: migrate from asar to @ electron/asar (Clean up atom.coffee atom/atom#1431)
• 274c686 feat!: upgrade electron-osx-sign to @ electron/osx-sign (atom.getVersion() is returning the wrong value atom/atom#1428)
• c02695f fix: remove ElectronAsarIntegrity when asar is disabled (Upload master builds to releases atom/atom#1281)
• f6e353a chore: Revert "chore: bump typedoc from 0.19.2 to 0.23.14 (Drop a basic model out from WorkspaceView atom/atom#1416)" (Shrink the build size atom/atom#1420)
• 713d425 fix(types): add "universal" as a valid arch (If I've selected a block of ruby that is indented and then paste it on a line that is blank (no with atom/atom#1407)
• 18749c7 chore: bump typedoc from 0.19.2 to 0.23.14 (Drop a basic model out from WorkspaceView atom/atom#1416)
• 9124e28 16.0.0
• 88e8173 docs: Update NEWS.md
• 5c0102a fix: properly import info logger (Handle EACCES errors when saving an editor atom/atom#1405)
• 0d692d7 feat!: upgrade Node.js to 14 LTS (Panes stick around when they shouldnt atom/atom#1399)
• a723fa8 build: bump got to 2.0.0 (Select an indented line of text by placing your cursor at the beginning of the line and pressing the atom/atom#1397)
• 8a86df2 15.5.2
• c7ecd1c docs: update NEWS.md
• 1baed70 chore: remove node 10 job (Speed up keymap loading atom/atom#1403)
• 7c01d6f revert: "feat!: upgrade Node.js to 14 LTS (text atom/atom#1393)" (Show low disk space errors when running CI atom/atom#1398)
• b0f27bc fix: ignore node_gyp_bins if it exists (pacman atom/atom#1391)
• a6db65f chore: bump fs-extra from 9.1.0 to 10.1.0 (If I right-click on an item in Atom that has a context menu (like a file in the tree view) I can atom/atom#1358)
• 7dcaf44 chore(deps): bump yargs-parser from 20.2.9 to 21.1.1 (pacman atom/atom#1395)
• c6b4c78 feat!: upgrade Node.js to 14 LTS (text atom/atom#1393)
• e147b5e docs: update SUPPORT.md
• a65eb75 fix: package should not log info on --quiet flag (Atom keeps freezing. When it does, atom renderer is at nearly 100% cpu in activity monitor. atom/atom#1361)
• 4c6c88f chore: bump sinon from 13.0.2 to 14.0.0 (who wants to live forever atom/atom#1364)

See the full diff

Package name: npm

The new version differs by 250 commits.

• 3b4ba65 7.0.0
• bbfc75d chore: fix weird .gitignore thing that happened somehow
• 8a2d375 docs: changelog for v7.0.0
• 365f2e7 read-package-json@3.0.0
• fafb348 npm-package-arg@8.1.0
• 9306c68 libnpmfund@1.0.1
• 569cd64 libnpmfund@1.0.0
• ac9fde7 Integration code for @ npmcli/arborist@1.0.0
• 704b9cd @ npmcli/arborist@1.0.0
• 3955bb9 hosted-git-info@3.0.6
• da240ef fix: patch config.js to remove duplicate values
• 9ae45a8 init-package-json@2.0.0
• 41ab36d eslint@7.11.0
• c474a15 npm-registry-fetch@8.1.5
• efc6786 fix: make sure publishConfig is passed through
• 1e4e6e9 docs: v7 using npm config refresh
• 5c1c2da fix: init config aliases
• 5bc7eb2 docs: v7 npm-install refresh
• 1a35d87 7.0.0-rc.4
• 7a5a557 docs: changelog for v7.0.0-rc.4
• f0cf859 chore: dedupe deps
• 0273745 make-fetch-happen@8.0.10
• 7bd47ca @ npmcli/arborist@0.0.33
• 9320b8e only escape arguments, not the command name

See the full diff

Package name: stylelint

The new version differs by 250 commits.

• 04af9e4 13.0.0
• 704f6a2 Prepare 13.0.0
• 50ba8a9 Reorder changelog
• 1666bba Update devDependencies (UTF-8 problems: characters mysteriously incorrectly encoded atom/atom#4542)
• 062d298 Reindent nodejs.yml (Uncaught Error: EACCES, open '/home/alex/.atom/compile-cache/cson/5af7724b023a6274b520f79f04fb798a67319ca7.json' atom/atom#4541)
• a24e44a Fix atypical rule README structure (Uncaught Error: spawn pep8 ENOENT atom/atom#4537)
• 616ad71 Bump husky from 4.0.3 to 4.0.6 (Uncaught Error: Minified exception occurred atom/atom#4536)
• 5e58ee7 Bump globby from 10.0.2 to 11.0.0 (FuzzyFinder is double displaying atom/atom#4528)
• eaee6a4 Refactor CLI options definition (Commandline behaviour changed moving from Chocolatey to Squirrl atom/atom#4530)
• 6a2ffbd Fix plugin path
• 644b713 Fix Windows path problem
• 1005cbd Add info about invalid syntax in FAQ (Fixed activateNow when no activation promise atom/atom#4535)
• 18b1f99 Fix help text indentation (Better BufferedProcess error handling atom/atom#4531)
• d3c4a9f Update CHANGELOG.md
• 32f67e7 Update CHANGELOG.md
• 04ec577 Bump globby from 10.0.1 to 11.0.0
• d9dbce2 Process multiple spaces in media-feature-parentheses-space-inside (Uncaught TypeError: Bad argument atom/atom#4513)
• 1dc203e Regenerate package-lock.json (Windows releases late again. atom/atom#4517)
• 36bf292 Bump husky from 3.1.0 to 4.0.3 (getting red notifications when saving keymap.cson with parse error atom/atom#4527)
• f5529d5 Bump @ types/micromatch from 3.1.1 to 4.0.0 (Update Chocolatey package to call the new Squirrel based installer atom/atom#4526)
• a254fd2 Bump got from 10.2.0 to 10.2.1 (Uncaught Error: spawn grunt ENOENT atom/atom#4525)
• f2e9f02 Bump remark-validate-links from 9.0.1 to 9.1.0 ("Reveal in Tree View" does not work when there is no folder selected. atom/atom#4524)
• 74d5233 Remove unneeded `@ types/meow` package (Uncaught TypeError: Cannot read property 'destroyItem' of undefined atom/atom#4523)
• cef0b95 Update CHANGELOG.md

See the full diff

Package name: webdriverio

The new version differs by 250 commits.

• ebe85f3 v6.0.0
• 5d53782 try to increase memory size for jest tests
• bc67054 update types
• 96852f4 Bump cucumber from 5.1.0 to 6.0.5 (Uncaught Error: ENOENT, open 'undefined//home/websites/shinatara-sample/project.json' atom/atom#5151)
• d41ee01 Bump @ octokit/rest from 16.43.1 to 17.1.3 (find not working atom/atom#5147)
• f9f1b59 Bump babel-jest from 24.9.0 to 25.2.1 (Make popover-list max-height relative to viewport atom/atom#5150)
• 4451792 restore process mocks
• 86d659c add name attribute selector docs again - closeCrash when using "Add File" or "Add Folder" atom/atom#4921
• 6a2c8ad log heap dump
• 947b323 try moduleNameMapper workaround
• 9ab7e07 run jest tests without cache
• f4c7bff remove workaround
• 4d2fa8b Revert "Revert "include e2e tests""
• ab607a6 Revert "include e2e tests"
• cc783f2 re-install node_modules as suggested in https://github.com/node asserts in node_contextify.cc:631 Assertion `args[1]->IsString()' failed nodejs/node#20325\#issuecomment-412086793
• a05a912 include e2e tests
• bb951a6 don't set nodejs version globally
• de3daab set stage
• c5a2dc6 more travis tweaks
• 64afa7f don't rebuild project in test step
• ec3650c tweak travis setup
• 1c8ce73 add readme to webdriverio package
• 383bbb7 update release date of blog post
• c913afc update list of services

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Arbitrary File Overwrite