[Snyk] Fix for 30 vulnerabilities

[rx007]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • build/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	679/1000 Why? Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962463	Yes	No Known Exploit
	706/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.7	Remote Memory Exposure SNYK-JS-BL-608877	No	Proof of Concept
	584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	No	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-JSBEAUTIFY-2311652	Yes	No Known Exploit
	641/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.4	Prototype Pollution SNYK-JS-JSON5-3182856	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
	541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASHMERGE-173732	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-LODASHMERGE-173733	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-MOUT-1014544	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-MOUT-2342654	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Improper Privilege Management SNYK-JS-SHELLJS-2332187	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	596/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.5	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:clean-css:20180306	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:eslint:20180222	Yes	Proof of Concept
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution npm:extend:20180424	Yes	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:hoek:20180212	No	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit
	414/1000 Why? Has a fix available, CVSS 4	Insecure use of Tmp files npm:sync-exec:20160124	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: asar

The new version differs by 152 commits.

• 2ec15c1 Merge pull request Clicking a tab should focus the tabs' editor/buffer atom/atom#165 from electron/cut-snapshot
• f567bcf chore: upgrade mocha to ^6.0.0
• 217c5c8 chore: upgrade electron to 4.0.5
• ceebeff feat: convert the public API to Promises
• f490a8b chore: convert Filesystem.insertFile to Promises
• 4e7b54d chore: rename/refactor isUnpackDir -> isUnpackedDir
• 54d0754 chore: better variable name
• c8e70f5 chore: convert to use tmp-promise
• d091430 chore: use Promise.all when crawling filesystem
• 1fbf562 chore: promisify glob usage
• f44fe4b chore: promisify tests
• 4a7df72 fix: typo in API docs
• ad89e46 chore: upgrade Electron dev-dependency to a recent version
• dd32750 chore: stick with Node 6 for now
• 6058a1c fix: Fix standard issues and deprecations
• 137901a chore: Update dependencies
• f574c9c fix: Use buffer.alloc
• 93fdf6e fix: Cut snapshot
• 108fab1 0.14.6
• b41c693 Update dependencies
• 2051b9c remove stat parameter from insertLink() (No more gutter highlight for selected lines atom/atom#161)
• c2d3d86 Merge pull request Hide hidden files from treeView atom/atom#159 from Appuls/Appuls/bugfix/createPackageFromFiles-regression
• b4eeb46 Windows-style paths are only unit tested on WIndows.
• 8026100 Normalized filepaths, added unit tests for windows path separators.

See the full diff

Package name: babel-eslint

The new version differs by 166 commits.

• a0fbd50 8.0.2
• 2004b91 require correct deps
• fa56d21 Always use unpad (Error launching Atom after rake install atom/atom#535)
• 295091d Allow ^ version for babel dependencies (Atom not quitting and also crashing atom/atom#534)
• d3b8519 fix(package): update babylon to version 7.0.0-beta.31 (Lessify remaining CSS files atom/atom#533)
• 54ab4ac 8.0.1
• c1a7882 Update README.md support (Clicking links in Markdown preview navigates whole frame atom/atom#531) [skip ci]
• 51100c9 chore(package): update mocha to version 4.0.0 (Atom freezing on github/github atom/atom#524)
• 5742b71 Adding optionalCatchBinding to plugins. (💄 all the things atom/atom#521)
• 905887c 8.0.0
• 49493e4 update to beta.0
• 42d0c5b Remove already fixed workaround (Async grammar includes atom/atom#508)
• 25bd208 8.0.0-alpha.17
• 1468905 alpha.17
• 57c133e 8.0.0-alpha.15
• 1e41162 update (Properly handle contentName in TextMate grammars atom/atom#504)
• c31b577 Readme update usage section (Cursor dances where header links should be in Markdown atom/atom#501) [skip ci]
• c2626f9 Update eslint to the latest version 🚀 (Crash parsing zip file atom/atom#500)
• 3c6b2de chore(package): update husky to version 0.14.0 (Add API documentation for src/app atom/atom#498)
• e052d5a Update install instructions to use latest stable release (Better cursor movement with line wrap behavior atom/atom#497) [skip ci]
• 8e3e088 8.0.0-alpha.13
• f757e22 Merge pull request Window state not being saved on quitting with command-q atom/atom#493 from danez/regression-test
• 5736be6 Update babylon
• 37f9242 Add Prettier (Can't load pathwatcher atom/atom#491)

See the full diff

Package name: github-releases

The new version differs by 8 commits.

• 950b7d0 0.4.2
• 3307791 Merge pull request [Snyk] Fix for 1 vulnerabilities #9 from roblourens/updateRequest
• f3ba8ce Remove package-lock.json
• dce6079 Update 'request' module for security
• f9d6c9e Fix downloading
• fc3b492 Fix error happend when converting CoffeeScript
• dbfb940 Convert CoffeeScript to JS
• 0ce3644 Update dependencies

See the full diff

Package name: grunt-babel

The new version differs by 16 commits.

• 3fee421 7.0.0
• 4c89e7e add missing peerDep
• 79450ee Merge pull request "Shell" mode atom/atom#79 from babel/b7-alpha
• 59ffa73 remove node 0.10/0.12 from travis
• 75bc67f fix readme [skip ci]
• 5e7fdd5 make peerDep on babel-core v7
• cf4f0c7 lock down XO
• 97120ca ES6 → ES2015
• 44e9762 meta tweaks
• a7874fd bump dev deps
• ce3bbc3 bump dev deps
• 766123a fix docs
• ff01c19 6.0.0
• 54c583e tweaks
• 9772e55 Merge pull request [Snyk] Security upgrade mocha from 2.5.1 to 11.0.1 #53 from underbyte/update-babel-core
• 9f3149c upgrade babel-core to 6.0.2

See the full diff

Package name: grunt-electron-installer

The new version differs by 23 commits.

• 10359a6 2.0.0
• b81fb98 Merge pull request Don't open the same project twice atom/atom#104 from atom/use-winstaller
• 4be5bc6 Merge remote-tracking branch 'origin/master' into use-winstaller
• fd815ea Merge pull request Official configuration facility atom/atom#107 from havenchyk/winstaller
• 59d5961 Bump electron-winstaller to 2.0.5
• 33d9f2a 1.2.3
• c0047d8 Merge pull request Support Open Recent in File menu atom/atom#106 from atom/squirrel-1-2-5
• 1f056aa Upgrade to Squirrel 1.2.5
• 661c574 ⬆️ electron-winstaller@2.0.4
• 92d1c23 Spawn jasmine directly from tests script
• 08321bc Remove unused tasks
• a8fb007 CoffeeScript -> JavaScript
• 51bb9b2 installer-spec.coffee -> installer-spec.js
• bf592f8 Move to tasks/ folder
• 317ce8f Remove coffee linting
• 86e7287 CoffeeScript -> JavaScript
• 75b56ba index.coffee -> index.js
• 0eee7cf Remove unused dependencies
• f7ba48a node 0.10 is ancient
• aa1081d Pin to an exact version of electron-winstaller
• a4be09c 🔥 stuff we don't need
• 0ac6f3f This is now a wrapper for electron-winstaller
• 91b817e Add electron-winstaller

See the full diff

Package name: grunt-standard

The new version differs by 9 commits.

• bfb47fa Merge pull request [Snyk] Fix for 1 vulnerabilities #18 from dxw/master
• e0b1936 Change build matrix to run against latest versions
• 00fd3a9 Merge pull request [Snyk] Security upgrade atom-package-manager from 1.10.0 to 2.0.0 #16 from robbiepaul/master
• f42f5e9 Fix new StandardJS version's style violations
• 1f16fe4 Bump StandardJS version to 12
• dd2232e Merge pull request [Snyk] Security upgrade less-cache from 0.23.0 to 0.24.0 #15 from EasyAsABC123/release-v3.0.1
• 65315d8 Release v3.1.0 moves to standard v10.0.0
• 13d6c77 Update README.md
• e4ae4e8 Update README.md

See the full diff

Package name: npm

The new version differs by 250 commits.

• bb8688d 6.6.0
• f277bce doc: update changelog for npm@6.6.0
• 46639ba chore: Update package-lock.json for https tarball URLs
• 6c89adb 6.6.0-next.1
• b9d4dcb update AUTHORS
• 371442f doc: update changelog for npm@6.6.0
• c665f35 chore: replace var with const/let in lib/repo.js (Vendor submodules atom/atom#119)
• 5d07635 doc: fix npm-prefix description (Track all commands run atom/atom#116)
• a5c9e6f cli,outdated: default homepage to an empty string (Auto-indent config atom/atom#124)
• f58b43e audit: report any errors above 400 as potentially not supporting audit (Merge dev into master atom/atom#128)
• c5b6056 Handle git branch references correctly (Load snippets from packages and TextMate bundles atom/atom#123)
• 41f1552 deps: updating semver docs
• 887e943 lru-cache@4.1.5
• 5777ea8 readable-stream@3.1.1
• a0a0ca9 pacote@9.3.0
• 4ffa8a8 query-string@6.2.0
• 3f40251 npm-pick-manifest@2.2.3
• 455476c require-inject@1.4.4
• 740e79e rimraf@2.6.3
• 09a5c2f semver@5.6.0
• e4ffc6a unique-filename@1.1.1
• 8213def npm-packlist@1.2.0
• 66d60e3 marked@0.6.0
• 2a59bfc libnpmhook@5.0.2

See the full diff

Package name: standard

The new version differs by 66 commits.

• 39a54d3 6.0.0
• 3afcc2c CHANGELOG.md for 6.0.0
• 0b71b07 eslint-plugin-promise@1.0.8
• 4b725bd lock to latest deps
• 0a9a77b eslint-config-standard@5.0.0
• 48fb60c add eslint-config-standard-jsx
• 8802ea7 run standard on ourselves
• 6fbd66d test: add --disabled flag to run disabled tests
• 910eaa5 depend on eslint-plugin-promise
• f0d1983 Remove React-specific rules (fixesafter quitting, cannot start atom due to missing executable atom/atom#351)
• 8a095f1 readme: add one more gotcha
• fbb66c4 package.json
• 44b551a remove one more usage of `win-spawn`
• f1ad085 eslint@^2.0.0-rc.0
• 1cdd9f5 clone test: ignore git output
• 22971ce use cross-spawn-async
• 3e2001d add standard-format instructions to --format
• 60d4a87 install babel in dev-deps for test repos that need it
• 134de73 use standard-packages@3
• f149307 cleanup
• 3c86923 remove standard-format. fixesRuby auto-indent prevents inserting spaces before certain closing tokens atom/atom#340
• 9b3a14d test: add --quiet option
• c59a55c test: test 500+ standard packages
• cb625b4 test: add command line --help test

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Server-side Request Forgery (SSRF)
🦉 More lessons are available in Snyk Learn