[Snyk] Security upgrade @babel/preset-env from 7.12.13 to 7.22.6

[dotam99]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[guardrails]

⚠️ We detected 99 security issues in this pull request:

Mode: paranoid | Total findings: 99 | Considered vulnerability: 99

Insecure Access Control (6)

Severity	Details	Docs
Medium	Title: Tainted input passed to an open redirect (express) docs/middleware/redirects/external.js Line 6 in f966dfb returnres.redirect(301,externalSites[req.path])	📚
Medium	Title: Tainted input passed to an open redirect (express) docs/middleware/redirects/handle-redirects.js Line 50 in f966dfb returnres.redirect(301,redirect)	📚
Medium	Title: Tainted input passed to an open redirect (express) docs/middleware/contextualizers/enterprise-release-notes.js Line 94 in f966dfb returnres.redirect(`https://enterprise.github.com/releases/${requestedVersion}.0/notes`)	📚
Medium	Title: Tainted input passed to an open redirect (express) docs/middleware/archived-enterprise-versions.js Line 24 in f966dfb returnres.redirect(301,req.baseUrl+req.path.replace(/^\/en/,''))	📚
Medium	Title: Tainted input passed to an open redirect (express) docs/middleware/archived-enterprise-versions.js Line 33 in f966dfb returnres.redirect(301,redirect)	📚
Medium	Title: Tainted input passed to an open redirect (express) docs/middleware/redirects/language-code-redirects.js Line 15 in f966dfb returnres.redirect(301,req.path.replace(redirectPattern,`/${language.code}`))	📚

More info on how to fix Insecure Access Control in JavaScript.

---

Insecure File Management (11)

Severity	Details	Docs
High	Title: Path Traversal from user input docs/middleware/contextualizers/rest.js Line 14 in f966dfb '/developers/apps'	📚
High	Title: Path Traversal from user input docs/lib/rewrite-local-links.js Line 40 in f966dfb newHref=path.join('/',languageCode,href)	📚
High	Title: Path Traversal from user input docs/lib/rewrite-local-links.js Line 47 in f966dfb newHref=path.join('/',languageCode,href)	📚
High	Title: Path Traversal from user input docs/middleware/early-access-breadcrumbs.js Line 63 in f966dfb constmapTopicOrArticlePath=path.posix.join(categoryPath,pathParts[2])	📚
High	Title: Path Traversal from user input docs/middleware/early-access-breadcrumbs.js Line 50 in f966dfb constcategoryPath=removeFPTFromPath(path.posix.join('/','en',req.context.currentVersion,'early-access',pathParts[0],pathParts[1]))	📚
High	Title: Path Traversal from user input docs/middleware/breadcrumbs.js Line 35 in f966dfb title: product.title	📚
High	Title: Path Traversal from user input docs/middleware/breadcrumbs.js Line 49 in f966dfb constcategoryPath=removeFPTFromPath(path.posix.join('/',req.context.currentLanguage,req.context.currentVersion,productPath,pathParts[1]))	📚
High	Title: Path Traversal from user input docs/middleware/breadcrumbs.js Line 21 in f966dfb constproductPath=path.posix.join('/',req.context.currentProduct)	📚
High	Title: Path Traversal from user input docs/middleware/breadcrumbs.js Line 34 in f966dfb href: removeFPTFromPath(path.posix.join('/',req.context.currentLanguage,req.context.currentVersion,productPath)),	📚
High	Title: Path Traversal from user input docs/middleware/archived-enterprise-versions-assets.js Line 22 in f966dfb constproxyPath=path.join('/',requestedVersion,assetPath)	📚
High	Title: Path Traversal from user input docs/lib/get-link-data.js Line 37 in f966dfb consthref=removeFPTFromPath(path.join('/',context.currentLanguage,version,linkPath))	📚

More info on how to fix Insecure File Management in JavaScript.

---

Insecure Processing of Data (6)

Severity	Details	Docs
High	Title: Insecure Deserialization (js-yaml) docs/tests/unit/actions-workflows.js Line 11 in f966dfb constdata=yaml.load(fs.readFileSync(fullpath,'utf8'),{ fullpath })	📚
High	Title: Insecure Deserialization (js-yaml) docs/tests/helpers/crowdin-config.js Line 7 in f966dfb returnyaml.load(fs.readFileSync(filename,'utf8'),{ filename })	📚
Medium	Title: Tainted input passed to Express response docs/middleware/dev-toc.js Line 8 in f966dfb returnres.send(awaitliquid.parseAndRender(layouts['dev-toc'],req.context))	📚
Medium	Title: Tainted input passed to Express response docs/middleware/loaderio-verification.js Line 5 in f966dfb returnres.send(req.path.replace(/\//g,''))	📚
Medium	Title: Tainted input passed to Express response docs/middleware/enterprise-server-releases.js Line 12 in f966dfb returnres.send(awaitliquid.parseAndRender(layouts['enterprise-server-releases'],req.context))	📚
Medium	Title: Tainted input passed to Express response docs/middleware/render-page.js Line 144 in f966dfb res.send(addCsrf(req,output))	📚

More info on how to fix Insecure Processing of Data in JavaScript.

---

Insecure Use of Language/Framework API (42)

Severity	Details	Docs
Medium	Title: User Controlled Method Invocation docs/script/graphql/utils/remove-hidden-schema-members.rb Line 99 in f966dfb schema.send(:own_orphan_types).clear	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/tests/content/lint-files.js Line 203 in f966dfb constchangedFilesRelPaths=execSync('git diff --name-only origin/main | egrep "^translations/.*/.+.(yml|md)$"',{maxBuffer: 1024*1024*100}).toString().split('\n')	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/update-crowdin-issue.js Line 26 in f966dfb constfixable=execSync(`cat ${fixableErrorsLog} | egrep "^translations/.*/(.+.md|.+.yml)$" | sed -e 's/^/- [ ] /' | uniq`).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/update-crowdin-issue.js Line 29 in f966dfb constfilesToAdd=execSync(`cat ${parsingErrorsLog}${renderingErrorsLog} | egrep "^translations/.*/(.+.md|.+.yml)$" | sed -e 's/^/- [ ] /' | uniq`).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/update-crowdin-issue.js Line 32 in f966dfb constallErrors=execSync('cat ~/docs-*').toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/reset-translated-file.js Line 56 in f966dfb execSync(`git checkout main -- ${relativePath}`,{stdio: 'pipe'})	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/rest/update-files.js Line 48 in f966dfb constgithubBranch=execSync('git rev-parse --abbrev-ref HEAD',{cwd: githubRepoDir}).toString().trim()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/rest/update-files.js Line 53 in f966dfb execSync('git pull',{cwd: githubRepoDir})	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/rest/update-files.js Line 62 in f966dfb execSync(`${path.join(githubRepoDir,'bin/openapi')} bundle -o ${tempDocsDir} --include_unpublished`,{stdio: 'inherit'})	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/rest/update-files.js Line 69 in f966dfb execSync(`find ${tempDocsDir} -type f -name "*deref.json" -exec mv '{}' ${dereferencedPath} ';'`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/reconcile-filenames-with-ids.js Line 62 in f966dfb constgitStatusOfFile=execSync(`git status --porcelain ${oldContentPath}`).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/reconcile-filenames-with-ids.js Line 66 in f966dfb execSync(`mv ${oldContentPath}${newContentPath}`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/reconcile-filenames-with-ids.js Line 68 in f966dfb execSync(`git mv ${oldContentPath}${newContentPath}`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/reset-known-broken-translation-files.js Line 44 in f966dfb awaitexec(`script/reset-translated-file.js --prefer-main ${file}`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/prevent-pushes-to-main.js Line 13 in f966dfb constcurrentBranch=execSync('git symbolic-ref --short HEAD',{encoding: 'utf8'}).trim()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/prevent-translation-commits.js Line 20 in f966dfb constfilenames=execSync('git diff --cached --name-only').toString().trim().split('\n')	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/purge-fastly-by-url.js Line 74 in f966dfb constresult=execSync(`${purgeCommand}${localizedUrl}`).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/purge-fastly-by-url.js Line 78 in f966dfb constsecondResult=execSync(`${purgeCommand}${localizedUrl}`).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/lint-translation-files.js Line 16 in f966dfb execSync(`TEST_TRANSLATION=true npx jest content/lint-files > ${parsingErrorsLog}`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/lint-translation-files.js Line 19 in f966dfb execSync(`script/test-render-translation.js > ${renderErrorsLog}`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/lint-translation-files.js Line 22 in f966dfb execSync(`cat ${parsingErrorsLog}${renderErrorsLog} | egrep "^translations/.*/(.+.md|.+.yml)$" | uniq | xargs -L1 script/reset-translated-file.js --prefer-main`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/move-category-to-product.js Line 51 in f966dfb execSync(`mkdir ${productDir}`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/move-category-to-product.js Line 56 in f966dfb execSync(`git mv ${oldCategoryDir}${productDir}`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/helpers/find-unused-assets.js Line 89 in f966dfb constgrepResults=execSync(grepCmd).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/fix-translation-errors.js Line 50 in f966dfb constchangedFilesRelPaths=execSync(cmd).toString().split('\n')	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/get-new-dotcom-path.js Line 39 in f966dfb constnewPath=execSync(`find ${newDotcomDir} -name ${filename}`).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/graphql/update-files.js Line 29 in f966dfb execSync('gem which graphql')	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/graphql/update-files.js Line 123 in f966dfb execSync('npx prettier -w "**/*.{yml,yaml}"')	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/graphql/update-files.js Line 205 in f966dfb constremoteClean=execSync(`${removeHiddenMembersScript}${tempSchemaFilePath}`).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/enterprise-server-deprecations/archive-version.js Line 110 in f966dfb execSync('npm run build',{stdio: 'inherit'})	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/early-access/clone-for-build.js Line 36 in f966dfb currentBranch=execSync('git branch --show-current').toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/early-access/clone-for-build.js Line 74 in f966dfb letbranchExists=execSync(`git ls-remote --heads ${earlyAccessFullRepo}${earlyAccessBranch}`).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/early-access/clone-for-build.js Line 82 in f966dfb branchExists=execSync(`git ls-remote --heads ${earlyAccessFullRepo}${earlyAccessBranch}`).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/early-access/clone-for-build.js Line 100 in f966dfb cwd: earlyAccessCloningParentDir	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/anonymize-branch.js Line 27 in f966dfb exec(`git reset $(git merge-base ${base} HEAD)`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/anonymize-branch.js Line 28 in f966dfb exec('git add -A')	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/anonymize-branch.js Line 29 in f966dfb exec(`git commit -m "${message}"`)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/lib/liquid-tags/octicon.js Line 34 in f966dfb while((optionsMatch=OptionsSyntax.exec(match.groups.options))){	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/.github/actions-scripts/openapi-schema-branch.js Line 31 in f966dfb constchangedFiles=execSync('git diff --name-only HEAD').toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/test-render-translation.js Line 36 in f966dfb constchangedFilesRelPaths=execSync('git diff --name-only origin/main | egrep "^translations/.*/.+.md$"',{maxBuffer: 1024*1024*100})	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/script/content-migrations/remove-unused-assets.js Line 137 in f966dfb constgrepResults=execSync(grepCmd).toString()	📚
High	Title: Child process (child_process) methods accept untrusted data to execute docs/lib/liquid-tags/link.js Line 61 in f966dfb constmatch=liquidVariableSyntax.exec(this.param)	📚

More info on how to fix Insecure Use of Language/Framework API in Ruby and JavaScript.

---

Insecure Use of Regular Expressions (1)

Severity	Details	Docs
Medium	Title: Tainted input passed to Regular Expression docs/middleware/find-page.js Line 8 in f966dfb constenglishPath=req.path.replace(newRegExp(`^/${req.language}`),'/en')	📚

More info on how to fix Insecure Use of Regular Expressions in JavaScript.

---

Vulnerable Libraries (33)

Severity	Details
High	pkg:npm/throng@5.0.0 (t) upgrade to: 4.17.21
High	pkg:npm/remark-rehype@5.0.0 (t) upgrade to: 0.0.3
High	pkg:npm/rimraf@3.0.0 (t) upgrade to: 3.0.5
High	pkg:npm/got@9.6.0 (t) upgrade to: 4.1.1, 10.2.7
Critical	pkg:npm/babel-loader@8.1.0 (t) upgrade to: 2.0.3, 1.4.2, 2.0.4, 3.2.1, 2.2.2, 1.2.6
Critical	pkg:npm/copy-webpack-plugin@6.4.1 (t) upgrade to: 4.4.16, 5.0.8, 6.1.7, 1.2.6, 2.2.2, 3.2.2, 6.1.1, 4.4.15, 4.4.18, 2.0.4, 3.2.1, 4.4.14, 6.1.2, 5.0.10, 5.0.6, 3.2.3, 5.0.7, 6.1.9, 2.0.3, 1.4.2, 3.0.5
Medium	pkg:npm/webpack@5.30.0 (t) upgrade to: 4.8.1, 5.14.2, 4.16.5
High	pkg:npm/lodash@4.17.20 (t) upgrade to: 4.17.21,4.17.21
Critical	pkg:npm/linkinator@2.13.1 (t) upgrade to: 6.0.1, 2.0.1, 3.0.5, 12.1.0, 2.6.7, 4.0.10, 3.0.1, 3.0.8, 4.0.1, 5.0.1, 1.0.7, 2.8.9, 10.2.7, 1.2.6, 4.1.1, 3.1.1, 2.0.0, 11.8.5
High	pkg:npm/express@4.17.1 (t) upgrade to: 4.17.3,6.10.3,6.9.7,6.8.3,6.7.3,6.6.1,6.5.3,6.4.1,6.3.3,6.2.4
High	pkg:npm/walk-sync@1.1.4 (t) upgrade to: 3.0.5
Informational	pkg:npm/morgan@1.9.1 (t) upgrade to: 3.1.0
High	pkg:npm/sass@1.32.8 (t) upgrade to: 6.0.1, 5.1.2
High	pkg:npm/rss-parser@3.12.0 (t) - no patch available
Critical	pkg:npm/browser-date-formatter@3.0.3 (t) upgrade to: 1.2.6, 1.0.7
High	pkg:npm/babel-preset-env@1.7.0 (t) upgrade to: 4.17.21, 3.1.0
High	pkg:npm/node-fetch@2.6.1 (t) upgrade to: 3.1.1,2.6.7
Informational	pkg:npm/algoliasearch@3.35.1 (t) upgrade to: 3.1.0
High	pkg:npm/hast-util-select@4.0.2 (t) upgrade to: 2.0.1
Critical	pkg:npm/mini-css-extract-plugin@1.4.1 (t) upgrade to: 2.0.4, 3.2.1, 1.2.6, 2.2.2, 2.0.3, 1.4.2
High	pkg:npm/remark-parse@7.0.2 (t) upgrade to: 0.0.3
Informational	pkg:npm/compression@1.7.4 (t) upgrade to: 3.1.0
Critical	pkg:npm/sass-loader@9.0.2 (t) upgrade to: 1.4.2, 2.0.4, 3.2.1, 1.2.6, 2.2.2, 2.0.3
High	pkg:npm/@babel/preset-env@7.22.6 (t) upgrade to: 4.17.21
Informational	pkg:npm/rehype-highlight@3.1.0 (t) upgrade to: 10.4.1
Critical	pkg:npm/css-loader@5.0.0 (t) upgrade to: 1.4.2, 2.0.4, 3.2.1, 3.1.31, 1.2.6, 2.2.2, 2.0.3
High	pkg:npm/cheerio@1.0.0-rc.3 (t) upgrade to: 4.17.21, 2.0.1
N/A	pkg:npm/flat@5.0.0 (t) upgrade to: 5.0.1
Medium	pkg:npm/liquidjs@9.22.1 (t) upgrade to: 10.0.0
Medium	pkg:npm/webpack-cli@4.6.0 (t) upgrade to: 1.0.7
Critical	pkg:npm/resolve-url-loader@4.0.0 (t) upgrade to: 1.4.2, 2.0.4, 3.2.1, 1.2.6, 2.2.2, 2.0.3
Critical	pkg:npm/style-loader@1.2.1 (t) upgrade to: 1.2.6, 2.0.3, 1.4.2, 2.0.4, 3.2.1, 2.2.2
High	pkg:npm/@babel/plugin-transform-runtime@7.11.0 (t) upgrade to: 1.0.7, 4.17.21

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.