[Snyk] Fix for 9 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-HANDLEBARS-567742	No	Proof of Concept
	584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-ISSVG-1085627	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-ISSVG-1243891	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-JQUERY-174006	Yes	Proof of Concept
	701/1000 Why? Mature exploit, Has a fix available, CVSS 6.3	Cross-site Scripting (XSS) SNYK-JS-JQUERY-565129	Yes	Mature
	711/1000 Why? Mature exploit, Has a fix available, CVSS 6.5	Cross-site Scripting (XSS) SNYK-JS-JQUERY-567880	Yes	Mature
	641/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.4	Prototype Pollution SNYK-JS-JSON5-3182856	Yes	Proof of Concept
	484/1000 Why? Has a fix available, CVSS 5.4	Cross-site Scripting (XSS) npm:jquery:20150627	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: css-loader

The new version differs by 27 commits.

• 43179a8 chore(release): 1.0.0
• 3d53968 Merge remote-tracking branch 'origin/master'
• 240db53 version 1.0 (Fix for #741. add no zero filling option to histogram elastic/kibana#742)
• 1b7acf7 Merge remote-tracking branch 'origin/master'
• 1703721 docs(README): add more context to `localIdentName` (error field "message" was indexed without position data elastic/kibana#711)
• 1c51265 docs(README): fix malformed emoji (Derived Search on text field with space creates two search terms. elastic/kibana#701)
• 50f8ec0 Merge remote-tracking branch 'origin/master'
• 07444ad tests: css custom variables (Timepicker wrong date when opening the dialog elastic/kibana#709)
• 3de8aa7 tests: css custom variables (Timepicker wrong date when opening the dialog elastic/kibana#709)
• df497db chore(release): 0.28.11
• c788450 fix(lib/processCss): don't check `mode` for `url` handling (`options.modules`) (Improve the bool filter construction in filterSrv elastic/kibana#698)
• c35d8bd chore(release): 0.28.10
• 9f876d2 fix(getLocalIdent): add `rootContext` support (`webpack >= v4.0.0`) (Inline-block for .histogram-legend-item elastic/kibana#681)
• 0452f26 test: hashes inside `@ font-face` url (Panel that shows the latest value of a field  elastic/kibana#678)
• 630579d chore(release): 0.28.9
• 604bd4b chore(package): update dependencies
• d1d8221 fix: ignore invalid URLs (`url()`) (Extra blank field in "Fields Selector" elastic/kibana#663)
• 0fc46c7 chore(release): 0.28.8
• 333a2ce chore(package): update `dependencies`
• 39773aa ci(travis): use `npm`
• 8897d44 fix: proper URL escaping and wrapping (`url()`) (Do not show empty load/save dropdowns elastic/kibana#627)
• 0dccfa9 fix(loader): correctly check if source map is `undefined` (topN splits values incorrectly elastic/kibana#641)
• d999f4a docs: Update importLoaders documentation (Donut Diagram shows a maximum of 16 Entries - should be a user-setting elastic/kibana#646)
• 05c36db test: removed redundant `modules` argument (Query panel cannot be added elastic/kibana#599)

See the full diff

Package name: handlebars

The new version differs by 230 commits.

• 91a1b5d v4.6.0
• 770d746 Update release notes
• d7f0dcf refactor: fix typo in private test method
• 187d611 test: add path to nodeJs when running test:bin
• d337f40 test: show diff when test:bin fails
• d03b6ec feat: access control to prototype properties via whitelist
• 164b7ff chore: ignore .nyc_output
• ac4655e chore: disable "dot-notation" rule
• 14b621c test/style: remove or hide unused code in git.js, add tests
• 1ec1737 test/style: refactor remaining grunt tasks to use promises instead of callbacks
• 1ebce2b test/style: use nyc instead of istanbul, npm audit fix
• 3a5b65e test/style: refactor parser task
• dde108e test/style: refactor test-task to make it more readable
• dc54952 chore: change eslint-rules for tasks/
• d1fb07b Update (C) year in the LICENSE file
• 04b1984 chore: try to fix saucelabs credentials (Fix saved objects elastic/kibana#1627)
• c40d9f3 chore: active linting and formatting on commit
• 8901c28 chore: fix task name in build
• e97685e style: reformat all files using prettier
• e913dc5 chore: restructure build commands
• 1f61f21 chore: configure prettier and eslint
• 587e7a3 remove yarn.lock
• edcc84f Update readme.md with updated links (Kibana less tolerant than Elasticsearch elastic/kibana#1620)
• 23d58e7 fix(runtime.js): partials compile not caching (Global timezone support elastic/kibana#1600)

See the full diff

Package name: request

The new version differs by 250 commits.

• 02fc5b1 Update changelog
• de1ed5a 2.87.0
• a6741d4 Replace hawk dependency with a local implemenation (Better handling of multiple types elastic/kibana#2943)
• a7f0a36 2.86.1
• 8f2fd4d Update changelog
• 386c7d8 2.86.0
• 76a6e5b Merge pull request Refactor Proxy Authentication and Error Handling elastic/kibana#2885 from ChALkeR/patch-1
• db76838 Merge branch 'patch-1' of github.com:ChALkeR/request
• fb7aeb3 Merge pull request [Lens] Time series only for weekdays elastic/kibana#2942 from simov/fix-tests
• e47ce95 Add Node v10 build target explicitly
• 0c5db42 Skip status code 105 on Node > v10
• d555bd7 Generate server certificates for Node > v10
• 81f8cb5 Remove redundant code
• db17497 Use Buffer.from and Buffer.alloc in tests
• 0d29635 Merge pull request saving should generate short pemalinlks elastic/kibana#2923 from gareth-robinson/cifixes
• 3745cec Correction for Windows OS identification
• 219a298 Alterations for failing CI tests
• bbb3a0b 2.85.1
• 21ef363 Update changelog
• 5dad86e 2.85.0
• 5ba8eb4 Revert "Update hawk to 7.0.7 (Hourly bars only 45 mins wide elastic/kibana#2880)"
• b191514 2.84.1
• d77c839 Update changelog
• 4b46a13 2.84.0

See the full diff

Package name: webpack

The new version differs by 250 commits.

• 213226e 4.0.0
• fde0183 Merge pull request Syntax error when using "/" in filter aggregations. elastic/kibana#6081 from webpack/formating/prettier
• b6396e7 update stats
• f32bd41 fix linting
• 5238159 run prettier on existing code
• 518d1e0 replace js-beautify with prettier
• 4c25bfb 4.0.0-beta.3
• dd93716 Merge pull request Bug/fix visState title when saving a new visualization elastic/kibana#6296 from shellscape/fix/hmr-before-node-stuff
• 7a07901 Merge pull request Add default field format based on field name elastic/kibana#6563 from webpack/performance/assign-depth
• c7eb895 Merge pull request Updates kibana.yml docs to include logging filters. elastic/kibana#6452 from webpack/update_acorn
• 9179980 Merge pull request Update CONTRIBUTING.md elastic/kibana#6551 from nveenjain/fix/templatemd
• e52f323 optimize performance of assignDepth
• 6bf5df5 Fixed template.md
• 90ab23a Merge branch 'master' into fix/hmr-before-node-stuff
• b0949cb add integration test for spread operator
• 39438c7 unittest now also walks the ast
• 15ab027 Merge pull request Resolves functional tests for K5 redesign elastic/kibana#6536 from jevan0307/sideEffects-selectors
• 1611ce1 Merge pull request Impossible to search for documents containing "??" in a property elastic/kibana#6561 from joshunger/patch-1
• 6e175bc Merge pull request Kibana 4.5.0 docs / release notes elastic/kibana#6549 from webpack/md4_hash
• 0637531 Add a hyperlink to create a new issue
• 0e1f9c6 Merge pull request Implement plugin config prefix elastic/kibana#6554 from webpack/deps/end-of-beta
• 72477f4 upgrade versions to stable versions
• ed30285 Merge pull request [uiExports] add uiExport type "injectDefaultVars" elastic/kibana#6546 from webpack/bot/review-permission
• 40ee8c7 Use MD4 for hashing

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Cross-site Scripting (XSS)