[Snyk] Fix for 14 vulnerabilities

[Exnadella]

User description

Snyk has created this PR to fix 14 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• packages/web-component-tester/package.json
• packages/web-component-tester/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-LODASH-567746	731
	Improper Input Validation SNYK-JS-SOCKETIOPARSER-3091012	704
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	696
	Prototype Pollution SNYK-JS-LODASH-6139239	696
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	696
	Denial of Service (DoS) SNYK-JS-WS-7266574	696
	Prototype Pollution SNYK-JS-LODASH-450202	686
	Prototype Pollution SNYK-JS-LODASH-608086	686
	Code Injection SNYK-JS-LODASH-1040724	681
	Prototype Pollution SNYK-JS-DOTPROP-543489	636
	Prototype Pollution SNYK-JS-MINIMIST-559764	601
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	586
	Validation Bypass SNYK-JS-KINDOF-537849	506
	Prototype Pollution SNYK-JS-MINIMIST-2429795	506

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Validation Bypass
🦉 More lessons are available in Snyk Learn

---

PR Type

Bug fix, Enhancement

---

Description

• Upgraded several npm dependencies in package.json to address vulnerabilities:
  • async from 2.4.1 to 3.0.0
  • findup-sync from 2.0.0 to 4.0.0
  • socket.io from 2.0.3 to 3.0.0
  • wd from 1.2.0 to 1.11.3
• Updated package-lock.json to reflect these changes and ensure consistency.
• Fixed vulnerabilities including Prototype Pollution, Improper Input Validation, and Regular Expression Denial of Service (ReDoS).

---

Changes walkthrough 📝

	Relevant files
Dependencies	package.json Upgrade dependencies to fix vulnerabilities                            packages/web-component-tester/package.json Updated async dependency from version 2.4.1 to 3.0.0. Updated findup-sync dependency from version 2.0.0 to 4.0.0. Updated socket.io dependency from version 2.0.3 to 3.0.0. Updated wd dependency from version 1.2.0 to 1.11.3. +4/-4      package-lock.json Update package-lock.json for dependency upgrades                  packages/web-component-tester/package-lock.json Updated lock file to reflect changes in package.json. Resolved vulnerabilities by upgrading dependencies. +11836/-11896
Additional files (token-limit)	package-lock.json ...                                                                                                            packages/web-component-tester/package-lock.json ... +11836/-11896

---

💡 PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[qodo-merge-pro]

PR Reviewer Guide 🔍

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Key issues to review Dependency Updates Multiple dependencies have been updated to newer versions, which may introduce breaking changes or require additional testing.

[qodo-merge-pro]

PR Code Suggestions ✨

Category	Suggestion	Score
Dependency update	Update the socket.io package to a newer major version Update the socket.io package to version 3.0.0 or later to take advantage of potential security fixes, performance improvements, and new features. packages/web-component-tester/package.json [78] -"socket.io": "^2.0.3", +"socket.io": "^3.0.0", Apply this suggestion Suggestion importance[1-10]: 10 Why: The suggestion correctly identifies the update of the socket.io package to a newer major version, which is crucial for benefiting from security fixes, performance improvements, and new features. This is a highly important update for the package's security and performance.	10
	Update the async package to a newer major version Update the async package to version 3.0.0 or later to benefit from potential bug fixes, performance improvements, and new features. packages/web-component-tester/package.json [60] -"async": "^2.4.1", +"async": "^3.0.0", Apply this suggestion Suggestion importance[1-10]: 9 Why: The suggestion correctly identifies the update of the async package to a newer major version, which can bring significant improvements and potential bug fixes. This is a crucial update for maintaining the package's functionality and security.	9
	Update the findup-sync package to a newer major version Update the findup-sync package to version 4.0.0 or later for potential improvements and bug fixes. packages/web-component-tester/package.json [66] -"findup-sync": "^2.0.0", +"findup-sync": "^4.0.0", Apply this suggestion Suggestion importance[1-10]: 9 Why: The suggestion accurately reflects the update of the findup-sync package to a newer major version, which can provide important enhancements and bug fixes. This update is important for ensuring the package remains up-to-date and functional.	9
	Update the wd package to a newer minor version Update the wd package to version 1.11.3 or later for potential bug fixes and improvements in the WebDriver client. packages/web-component-tester/package.json [80] -"wd": "^1.2.0" +"wd": "^1.11.3" Apply this suggestion Suggestion importance[1-10]: 8 Why: The suggestion correctly reflects the update of the wd package to a newer minor version, which can bring bug fixes and improvements. While not as critical as major updates, it is still beneficial for maintaining the package's reliability.	8

[qodo-merge-pro]

CI Failure Feedback 🧐

(Checks updated until commit 76d8c8e)

Action: test (ubuntu-latest)

Failed stage: Run npm run bootstrap [❌]

Failure summary: The action failed due to an error during the npm ci command execution: The command npm ci exited with code 1 in the wct-mocha package. Multiple deprecated packages were used, which might have contributed to the failure. The specific error details are not provided in the log, but a complete log is available for further investigation.

Relevant error logs: 1: ##[group]Operating System 2: Ubuntu ... 556: npm WARN deprecated [email protected]: This module is no longer supported. 557: npm WARN deprecated [email protected]: This package is no longer supported. 558: npm WARN deprecated [email protected]: This package is no longer supported. 559: npm WARN deprecated [email protected]: This package is no longer supported. 560: npm WARN deprecated [email protected]: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. 561: npm WARN deprecated [email protected]: This package is no longer supported. 562: npm WARN deprecated @lerna/[email protected]: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. 563: npm WARN deprecated @lerna/[email protected]: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. 564: npm WARN deprecated @lerna/[email protected]: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. ... 739: npm ERR! 740: npm ERR! aliases: clean-install, ic, install-clean, isntall-clean 741: npm ERR! 742: npm ERR! Run "npm help ci" for more info 743: npm ERR! A complete log of this run can be found in: 744: npm ERR! /home/runner/.npm/_logs/2024-09-05T17_02_40_022Z-debug-0.log 745: lerna ERR! npm ci exited 1 in 'wct-mocha' 746: lerna WARN complete Waiting for 1 child process to exit. CTRL-C to exit immediately. 747: ##[error]Process completed with exit code 1.

---

✨ CI feedback usage guide:

---

The CI feedback tool (/checks) automatically triggers when a PR has a failed check.
The tool analyzes the failed checks and provides several feedbacks:

• Failed stage
• Failed test name
• Failure summary
• Relevant error logs

In addition to being automatically triggered, the tool can also be invoked manually by commenting on a PR:

/checks "https://github.com/{repo_name}/actions/runs/{run_number}/job/{job_number}"

where {repo_name} is the name of the repository, {run_number} is the run number of the failed check, and {job_number} is the job number of the failed check.

Configuration options

• enable_auto_checks_feedback - if set to true, the tool will automatically provide feedback when a check is failed. Default is true.
• excluded_checks_list - a list of checks to exclude from the feedback, for example: ["check1", "check2"]. Default is an empty list.
• enable_help_text - if set to true, the tool will provide a help message with the feedback. Default is true.
• persistent_comment - if set to true, the tool will overwrite a previous checks comment with the new feedback. Default is true.
• final_update_message - if persistent_comment is true and updating a previous checks message, the tool will also create a new message: "Persistent checks updated to latest commit". Default is true.

See more information about the checks tool in the docs.