[Snyk] Fix for 6 vulnerabilities

[Glavin001]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	No	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	No	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	No	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: csscomb

The new version differs by 17 commits.

• 5c69a07 v4.3.0
• 842e9f9 Fix sort-order-fallback keep order
• db0946f Perform npm audit fix
• 08afce5 Update package-lock
• d7f40ee Fix line-between broking when file start with comment
• 38cd55e Fix sort-order test
• 565a16f Update versions of dependencies
• 3e029fc Fix ast.remove is not a function error
• 55d58f4 Duplicate Tab length for indent is being ignored #576 without dependencies
• 15a5459 Update list of support Node versions
• db14fce Update GPE version
• 19b9799 [cli] TTY-option type set to boolean
• adcfc01 Ignore leading combinators
• 269e854 Merge pull request SCSS - new lines are added regardless of preference #531 from romanlex/patch-1
• 9b31811 Merge pull request Support for QML #541 from Yurickh/fix-contributing-guide-markdown
• a8e3be8 Fix CONTRIBUTING.md markdown
• a60cb60 Update core.js

See the full diff

Package name: eslint

The new version differs by 250 commits.

• a7985a6 6.0.0
• be74dd9 Build: changelog update for 6.0.0
• 81aa06b Upgrade: [email protected] (#11869)
• 5f022bc Fix: no-else-return autofix produces name collisions (fixes #11069) (#11867)
• ded9548 Fix: multiline-comment-style incorrect message (#11864)
• cad074d Docs: Add JSHint W047 compat to no-floating-decimal (#11861)
• 41f6304 Upgrade: sinon (#11855)
• 167ce87 Chore: remove unuseable profile command (#11854)
• c844c6f Fix: max-len properly ignore trailing comments (fixes #11838) (#11841)
• 1b5661a Fix: no-var should not fix variables named 'let' (fixes #11830) (#11832)
• 4d75956 Build: CI with Azure Pipelines (#11845)
• 1db3462 Chore: rm superfluous argument & fix perf-multifiles-targets (#11834)
• c57a4a4 Upgrade: @ babel/polyfill => core-js v3 (#11833)
• 65faa04 Docs: Clarify prefer-destructuring array/object difference (fixes #9970) (#11851)
• 81c3823 Fix: require-atomic-updates reports parameters (fixes #11723) (#11774)
• aef8ea1 Sponsors: Sync README with website
• 4f48f5a 6.0.0-rc.0
• 6bad650 Build: changelog update for 6.0.0-rc.0
• f403b07 Update: introduce minKeys option to sort-keys rule (fixes #11624) (#11625)
• 87451f4 Fix: no-octal should report NonOctalDecimalIntegerLiteral (fixes #11794) (#11805)
• e4ab053 Update: support "bigint" in valid-typeof rule (#11802)
• e0fafc8 Chore: removes unnecessary assignment in loop (#11780)
• 20908a3 Docs: removed '>' prefix from from docs/working-with-rules (#11818)
• 1c43eef Sponsors: Sync README with website

See the full diff

Package name: handlebars

The new version differs by 140 commits.

• 7adc19a v4.7.4
• 9dd8d10 Update release notes
• 4671c4b Use tmp directory for files written during tests
• e46baa1 tasks/test-bin.js: Delete duplicate test
• c491b4e Revert "Update release-notes.md"
• 738391a Update release-notes.md
• 80c4516 chore: add unit tests for cli options (Uncaught Error: tunneling socket could not be established, cause=socket hang up #1666)
• d79212a fix: migrate from optimist to yargs (Uncaught Error: tunneling socket could not be established, cause=socket hang up #1666)
• b440c38 chore: ignore external @ types in tests
• 2dba7ee docs: fix comparison link
• c978969 v4.7.3
• 9278f21 Update release notes
• d78cc73 Fixes spelling and punctuation
• 4de51fe Add Type Definition for Handlebars.VERSION, Fixes 'atom-beautify.yaml.padding' could not set the default #1647
• a32d05f Include Type Definition for runtime.js in Package
• ad63f51 chore: add missing "await" in aws-s3 publishing code
• 586e672 v4.7.2
• f0c6c4c Update release notes
• a4fd391 chore: execute saucelabs-task only if access-key exists
• 9d5aa36 fix: don't wrap helpers that are not functions
• 14ba3d0 v4.7.1
• 4cddfe7 Update release notes
• f152dfc fix: fix log output in case of illegal property access
• 3c1e252 fix: log error for illegal property access only once per property

See the full diff

Package name: universal-analytics

The new version differs by 17 commits.

• bb7abdd Version 0.4.21
• aa8a790 Merge pull request Support for JSX syntax (ReactJS) #144 from beeman/beeman/dependencies
• fe696ff Upgrade request to native-request
• 859bc37 Upgrade package versions
• e534517 Version 0.4.20
• 127aa72 Version 0.4.19
• 0846ead Version 0.4.18
• e676a15 Merge pull request Failed to load Package on Windows: 'unsafe-eval' error caused by Analytics-Node library #113 from pioug/package-lock
• 8ba84c9 Merge pull request Not activated on ubuntu: 'unsafe-eval' error caused by Analytics-Node library #115 from atkit/master
• a39f75f Updated README.md about supported uid parameter that is used internally for User ID
• e0c9762 Install latest [email protected]
• 1a98a24 Regenerate package-lock.json
• e13640c Merge pull request CRLF vs LF with SCSS #108 from XanderLuciano/documentation-update
• 63c5514 Merge pull request Do not remove last line-feed from file. #109 from XanderLuciano/history-update
• 00c9317 Updated repo history for version 0.4.17
• 0e86f08 Typo Fix
• 47a55a0 Update README.md

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Server-side Request Forgery (SSRF)