[Snyk] Fix for 43 vulnerabilities

[SibuStephen]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	526/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.1	Arbitrary Code Injection SNYK-JS-EJS-1049328	Yes	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-EJS-2803307	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-ENGINEIO-1056749	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
	541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	661/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.8	Arbitrary Code Injection SNYK-JS-MORGAN-72579	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	No	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-1056752	Yes	Proof of Concept
	704/1000 Why? Has a fix available, CVSS 9.8	Improper Input Validation SNYK-JS-SOCKETIOPARSER-3091012	Yes	No Known Exploit
	/1000 Why?	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	/1000 Why?	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit
	/1000 Why?	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	Yes	No Known Exploit
	/1000 Why?	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	/1000 Why?	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	/1000 Why?	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	/1000 Why?	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	/1000 Why?	Regular Expression Denial of Service (ReDoS) SNYK-JS-TRIM-1017038	No	Proof of Concept
	/1000 Why?	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	Yes	Proof of Concept
	816/1000 Why? Mature exploit, Has a fix available, CVSS 8.6	Uninitialized Memory Exposure npm:base64-url:20180512	Yes	Mature
	741/1000 Why? Mature exploit, Has a fix available, CVSS 7.1	Uninitialized Memory Exposure npm:base64url:20180511	Yes	Mature
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:clean-css:20180306	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	No	Proof of Concept
	619/1000 Why? Has a fix available, CVSS 8.1	Arbitrary Code Execution npm:ejs:20161128	Yes	No Known Exploit
	509/1000 Why? Has a fix available, CVSS 5.9	Cross-site Scripting (XSS) npm:ejs:20161130	Yes	No Known Exploit
	509/1000 Why? Has a fix available, CVSS 5.9	Denial of Service (DoS) npm:ejs:20161130-1	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:fresh:20170908	No	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:negotiator:20160616	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:parsejson:20170908	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) npm:qs:20140806	No	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Denial of Service (DoS) npm:qs:20140806-1	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Override Protection Bypass npm:qs:20170213	No	No Known Exploit
	324/1000 Why? Has a fix available, CVSS 2.2	Uninitialized Memory Exposure npm:utile:20180614	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: googleapis

The new version differs by 227 commits.

• bfeae52 15.1.0 (Gladys Open API : Add a way to generate long-lived API token GladysAssistant/Gladys#690)
• f438584 Updates to scripts and dependencies. (Handle Xiaomi commands GladysAssistant/Gladys#689)
• 47dc788 15.0.0 (Send a message to the admin user when a sensor is offline GladysAssistant/Gladys#681)
• 5f8c16e 14.2.0 (Scenes : Add turnOn/Off the Switches function GladysAssistant/Gladys#670)
• 8ff026c 14.1.0 (fix #540 : handle mqtt connect error GladysAssistant/Gladys#662)
• 0fd222e chore(package): update async to version 2.1.0 (Improve scene view GladysAssistant/Gladys#649)
• 5551fdf Update README.md ([WIP] Arduino service GladysAssistant/Gladys#646)
• 5db75f4 14.0.0 (Handle Owntracks MQTT messages GladysAssistant/Gladys#642)
• 551c0e7 Fix bad link
• 548263f Bump version.
• 6bd1f34 13.0.0 (Translate Gladys 4 in French GladysAssistant/Gladys#634)
• 487f50b chore(package): update jsdoc to version 3.4.1 (Event on device creation / deletion GladysAssistant/Gladys#633)
• 585b2ef 12.4.0 (Fix #623 - Add LCA001 Hue color lamp model GladysAssistant/Gladys#624)
• bc2c108 Add support for overriding request options. (Ampoule Philips Hue E27 White and color ambiance GladysAssistant/Gladys#623)
• 769d760 Add Drive v3 API sample. (Import OpenZwave DB from Github GladysAssistant/Gladys#617)
• 69ce9af 12.3.0 (Add an information in the UI that an upgrade is currently running / an upgrade is available GladysAssistant/Gladys#616)
• acf67ca * Update doc gen to include schema info. (zWave Version discussion GladysAssistant/Gladys#614)
• c3750a8 12.1.0 (Fix OpenZwave in Alpine GladysAssistant/Gladys#613)
• 1586e6f Upgrade request dependency, fixes Some fixes: zWave device integration and BinaryDeviceFeature component GladysAssistant/Gladys#608 (Remove useless error log when deviceFeature does not exist yet in Gladys GladysAssistant/Gladys#612)
• d1af41b 12.0.0 (Telegram messaging doesn't answer to the correct conversation GladysAssistant/Gladys#607)
• 62a7c6c 11.0.0 (Fix zWave port listing and binding GladysAssistant/Gladys#602)
• a67adf7 10.0.0 (Uncommitted package-lock.json GladysAssistant/Gladys#599)
• f2eb11f 9.0.0 (Improve chat page UX GladysAssistant/Gladys#596)
• 32430ce 8.2.0 (Philips Hue UI fixes + compatibilities GladysAssistant/Gladys#594)

See the full diff

Package name: pushbullet

The new version differs by 63 commits.

• 1f8c1fd Update to version 3.0.0
• 9186bd9 Add `createChannel()`
• ac2fe7e Deprecate `sendSMS()`
• 9b7bcda Add support for the text API
• 5f501c5 Fix some comments
• 426de2b Remove old Travis CI yaml file
• 6a0076c Update ESLint rules and apply fixes
• ebdc39e Merge branch 'github-action-tests'
• ffd626d Add GitHub action to run tests
• f68187d Add tests using nock for mocking the API
• 45a657f Remove tests for now
• 72e856e Codestyle, modernisation, misc fixes
• a899190 Update dependencies to latest versions
• dca0e34 Merge branch 'node-fetch-migration'
• 3f89158 Update changelog
• 6508617 Update README
• 6a83ef9 Replace request with node-fetch
• 0f18e80 Switch CJS requires to ESM imports
• 8b5eaef Update to version 2.4.0
• c1581bb Update dependency requirements
• eadb250 Reconnect to websocket stream if disconnected
• 3ea3f0c Update version to 2.3.0
• e662e3c Add fullResponses option to return response object
• 7b78838 Switch to ws module for stream handling

See the full diff

Package name: sails

The new version differs by 250 commits.

• e46c83b 1.5.1
• 023319e Update version of prompt to 1.2.1 (#7202)
• ed349a1 Add note about supported versions of Postgres
• 15b43ff Merge pull request #7181 from balderdashy/update-upgrading-to-1.0-docs
• 39e34cd Update To1.0.md
• 9c821ec Add note about undefined attributes
• 799f2c0 Update README.md
• 2533f67 Fix broken link in docs
• ead0403 1.5.0
• 6199f96 Merge pull request #7172 from ElizabethForest/master
• 4bc6054 Merge pull request #7176 from sailscastshq/docs-typo-fix
• 71844d4 fix: correct misspelt waterline
• 780864e Merge pull request #7175 from jarodccrowe/master
• 72609ac going over this PR with @ mikermcneil
• b2bcf39 Add documentation regarding a breaking change in SSL connection syntax
• 384e796 Merge pull request #7174 from eltociear/patch-1
• 4a081c7 Fix typo in sails-run.js
• 8c9012c Restore Construction Type
• 869c0f3 disable no-unused-vars check
• 9747d06 add handleConstructingSessionStore to allow for more flexibility
• 0ad5947 Fix tests - avoid having mongo cause issues for later tests
• cc0820b support connect-mongo v4
• f399a2a Merge pull request #7158 from zsteinkamp/patch-1
• 1b1ca7c Small text correction

See the full diff

Package name: sails-disk

The new version differs by 85 commits.

• 15faa44 1.0.0
• a2b7ee6 1.0.0-12
• 9d7118c Only set footprint keys for uniqueness violations.
• a2c2261 Add some assertions.
• a222824 Update gitignore and scripts
• 3b3c334 1.0.0-11
• cef95b4 Support updating the primary key value, as long as it's not using _id as the column.
• aad2a15 Set _id column to value of primary key when creating records.
• 333e2d1 1.0.0-10
• c8a26c5 Add shim to replicate MongoDB's behavior w/ `{ $ne: null }` and empty arrays.
• bf92cb8 1.0.0-9
• af97943 Workaround issue with projections including only `_id`
• b5b985b Relax restrictions on using `_id` column in sails disk.
• f4adfd7 Add an entry in the `refCols` dictionary for every model, so we don't have to short-circuit checks for it later
• b494fd9 In `find`, deserialize Buffer objects into `ref` attributes where possible.
• 7aaaaa4 Merge pull request [Snyk] Security upgrade pushbullet from 1.4.3 to 3.0.0 #58 from balderdashy/expose-lib
• 70ead96 (whoops) Add back 0.10 and 0.12 in appveyor.yml
• beabe7a Merge pull request [Snyk] Security upgrade sails from 0.11.5 to 1.0.0 #57 from balderdashy/expose-lib
• 9c80187 1.0.0-8
• f7a349d Actually, don't expose the static lib. (No reason to do so, and better to not introduce something experimental if there's any chance it could make an app dependent on random stuff in a dev-only adapter)
• 2d4d97e 1.0.0-7
• f2dd761 Rename afterwards function to avoid perceived scope conflict (whether or not it'd ever actually be a big deal, this avoids any potential future scope issues from refactoring, etc).
• 4051e5e 1.0.0-6
• 250c32e Handle stray error (and a couple of other trivial changes just from when I was reading through the code)

See the full diff

Package name: sails-mysql

The new version differs by 250 commits.

• e9ca5d0 1.0.0
• 1c8eba9 1.0.0-17
• 2384285 Same as 2cc4850eb0fc3ff58eeaef044c2b14379af1be32 but for 2 other occurrences.
• 2cc4850 Apply fix from eslint to properly pass through compileStatement() errors
• ba40d9a Update eslint
• ed86ee1 1.0.0-16
• 227e9ba Bump versions of mariadb tests-- and explicitly test node 8
• 917db33 Use mp-mysql@3 (see https://github.com/Memory leak balderdashy/sails#4264#issuecomment-353152823)
• 5e8ed7e Follow-up to 075d7590dfb5fc51ee7c3084df87261b46ea5356
• 075d759 Update machine runner to v15. (refs https://github.com/Memory leak balderdashy/sails#4264)
• 0d0503c Even better
• 6186297 Update language in config errors
• d1f0791 1.0.0-15
• d511f24 Allow `ref` type attributes to represent any object, not just Buffers.
• 3a62cf5 1.0.0-14
• b8c74aa Merge pull request Function is it right time GladysAssistant/Gladys#349 from balderdashy/revert-utf8mb4-default
• b98a2f0 Revert code that defaults to the `utf8mb4` character set.
• 987f467 Merge pull request Empty room is still displayed in device dashboard view  GladysAssistant/Gladys#346 from balderdashy/support-emojis
• 3adc445 1.0.0-13
• 65aa28f lint fix
• 9fd09c9 1.0.0-12
• e9cbd78 Change default charset to support emojis. This also adds some comments and notes for the future.
• 6efdddc 1.0.0-11
• 056b12b use LONGTEXT by default because mysql truncates data silently

See the full diff

Package name: serialport

The new version differs by 250 commits.

• 6ed7b3b docs(README): fix api links
• a972686 docs: Collapse the beta changes in changelog and upgrade guide
• af97b09 Bump to v6.0.0
• 4ff9c67 feat(windows): Add ERROR_INVALID_PARAMETER to supported bindings errors (Fix python dependency GladysAssistant/Gladys#1354)
• dffa9d5 Bump to 6.0.0-beta3
• 530247a chore(package): update sinon to version 4.0.0 (Zigbee2mqtt: Add device TS0210 GladysAssistant/Gladys#1348)
• a5c01ff chore(package): update mocha to version 4.0.0 (Feature component GladysAssistant/Gladys#1352)
• bcb492f feat(parsers): Add cctalk parsers (Zwave js GladysAssistant/Gladys#1342)
• a3b8d35 feat(open): Throw on incorrect baudrate option (Zigbee2mqtt: Add device WRS-R02 GladysAssistant/Gladys#1347)
• c590021 chore(packages): upgrade eslint and sinon (Zigbee2mqtt lqi GladysAssistant/Gladys#1343)
• 4850901 Update publishing instructions
• 3faadac fix(docs): add missing parsers to properties list
• ad8abf6 6.0.0-beta2
• 69de595 fix(windows): Asynchronous callbacks for reading and writing ([BUG] Affichage de la présence "dans quelques secondes" GladysAssistant/Gladys#1328)
• c7a3be4 Revert "fix(windows): Asynchronous callbacks for reading and writing on Windows" (After editing a dashboard name, the dropdown list is not updated GladysAssistant/Gladys#1323)
• 2c2a8b6 fix(windows): Asynchronous callbacks for reading and writing on Windows (On trigger "device state changed" in scene, it's hard to differentiate devices as it's not the device feature name that is used GladysAssistant/Gladys#1313)
• bf251a9 fix: Fixed typo in upgrade guide (Create device feature "internal temperature" to avoid confusing device temp with ambiant temp GladysAssistant/Gladys#1321)
• 722d589 chore(package): update eslint to version 4.5.0 (Signal quality feature GladysAssistant/Gladys#1315)
• 1ee4e5a chore(package): update debug to version 3.0.1 (In action "turn on/off the light/switch", it should be a device feature selector, not a device selector GladysAssistant/Gladys#1314)
• 4e266e5 chore(package): update sinon to version 3.2.1 (Box "temperature in room" & "humidity in room" are not refreshing data with websockets GladysAssistant/Gladys#1316)
• 4987750 fix(package): update debug to version 3.0.0 (Zigbee2mqtt: Add device E2001/E2002 GladysAssistant/Gladys#1292)
• 76b7191 fix(docs): Add a note about windows support
• e83ec4e fix(docs): correct default highWaterMark to 65536 bytes
• 335ede9 6.0.0-beta1

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Arbitrary Code Injection
🦉 Cross-site Scripting (XSS)
🦉 More lessons are available in Snyk Learn