[Snyk] Fix for 11 vulnerabilities

[Aarbel]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

  • package.json
  • package-lock.json

• Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
  Find out more.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	584/1000 Why? Has a fix available, CVSS 7.4	Directory Traversal SNYK-JS-ADMZIP-1065796	Yes	No Known Exploit
	671/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7	Prototype Pollution SNYK-JS-PLIST-2405644	Yes	Proof of Concept
	676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Improper Privilege Management SNYK-JS-SHELLJS-2332187	Yes	Proof of Concept
	484/1000 Why? Has a fix available, CVSS 5.4	XML External Entity (XXE) Injection SNYK-JS-XMLDOM-1084960	Yes	No Known Exploit
	676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Regular Expression Denial of Service (ReDoS) npm:plist:20180219	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: cordova-custom-config

The new version differs by 23 commits.

• 7e14f42 v5.0.3
• 8a1000b Switch to use [email protected] since https://github.com/Parsing a null-string and re-building that file results in incorrect structure TooTallNate/plist.js#79 is resolved by https://github.com/Harden test-cases and align with other implementations TooTallNate/plist.js#84. Resolves #151
• d71bcc8 Merge pull request #148 from SpiderNeo1/patch-1
• f26886e Update package.json
• b4d017d Merge pull request #143 from FatCandy/master
• a1bb1f9 Update README with usage instructions for #include statements in .xcconfig files
• eb96376 Added support for #include statements in xcconfig files.
• 92c3216 Add issue templates
• 3145ce6 v5.0.2
• 1b18450 Improve handling of errors caused by missing dependencies or during script running. Should help with diagnosing errors, for example #138.
• bab4d01 Update CHANGELOG.md
• b3266d2 Patch version: 5.0.1
• e7d0b58 Update TOC
• 103b457 Rework to support cordova-android@7. Resolves #135.
• 870377b Major version bump: 5.0.0
• e994344 Update docs regarding where this plugin is useful
• 03b417e Merge pull request #119 from eKazim/master
• 4c691ea Use latest xcode version for support new functions in xcodefunc preferences
• e196c1f Patch version bump: 4.0.2
• f417c82 Bug fix: if mode == delete for iOS, don't also check item exists in plist before deleting to avoid erroneously moving to next condition which raises an error
• a2a9b7c Patch version bump: 4.0.1 (enable publishing to latest tag over dev tag @ 4.0.0)
• aa3a441 Major version bump: 4.0.0
• 26086c0 Remove manual dependency resolution logic and document requirement of cordova-fetch for installation.

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:negotiator:20160616	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 More lessons are available in Snyk Learn