[Snyk] Fix for 6 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • cli-ext/package.json
  • cli-ext/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	No	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	No	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	No	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	No	Proof of Concept
	469/1000 Why? Has a fix available, CVSS 5.1	Denial of Service (DoS) npm:mem:20180117	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: node-fetch

The new version differs by 19 commits.

• 1ef4b56 backport of Support for column presets in UPDATES hasura/graphql-engine#1449 (Does JSONB as array have relationship to ID? hasura/graphql-engine#1453)
• 8fe5c4e 2.x: Specify encoding as an optional peer dependency in package.json (document the relational insert feature hasura/graphql-engine#1310)
• f56b0c6 fix(URL): prefer built in URL version when available and fallback to whatwg (accept null for object and array relation insert input hasura/graphql-engine#1352)
• b5417ae fix: import whatwg-url in a way compatible with ESM Node (change hasura logo on access key prompt screen hasura/graphql-engine#1303)
• 18193c5 fix v2.6.3 that did not sending query params (https certificat of https://docs.hasura.io/ expires hasura/graphql-engine#1301)
• ace7536 fix: properly encode url with unicode characters (Could we have PRE event-trigger for customize data validation? hasura/graphql-engine#1291)
• 152214c Fix(package.json): Corrected main file path in package.json (delete mutation error can be unclear hasura/graphql-engine#1274)
• b5e2e41 update version number
• 2358a6c Honor the `size` option after following a redirect and revert data uri support
• 8c197f8 docs: Fix typos and grammatical errors in README.md ([Snyk] Security upgrade urllib3 from 1.26.4 to 1.26.19 #686)
• 1e99050 fix: Change error message thrown with redirect mode set to error ([Snyk] Security upgrade react-scripts from 3.4.1 to 4.0.0 #653)
• 244e6f6 docs: Show backers in README
• 6a5d192 fix: Properly parse meta tag when parameters are reversed ([Snyk] Security upgrade urllib3 from 1.25.9 to 1.26.19 #682)
• 47a24a0 chore: Add opencollective badge
• 7b13662 chore: Add funding link
• 5535c2e fix: Check for global.fetch before binding it ([Snyk] Security upgrade apollo-server-cloud-functions from 2.26.2 to 3.13.0 #674)
• 1d5778a docs: Add Discord badge
• eb3a572 feat: Data URI support ([Snyk] Security upgrade gatsby from 2.32.13 to 3.13.0 #659)
• 086be6f Remove --save option as it isn't required anymore ([Snyk] Security upgrade react-scripts from 2.1.5 to 4.0.0 #581)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Denial of Service
🦉 More lessons are available in Snyk Learn