[Snyk] Fix for 13 vulnerabilities

[baby636]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	679/1000 Why? Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962463	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	Yes	Proof of Concept
	429/1000 Why? Has a fix available, CVSS 4.3	Reverse Tabnabbing SNYK-JS-ISTANBULREPORTS-2328088	Yes	No Known Exploit
	641/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.4	Prototype Pollution SNYK-JS-JSON5-3182856	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASHSET-1320032	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-MERGE-1040469	Yes	No Known Exploit
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-MERGE-1042987	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: fast-glob

The new version differs by 114 commits.

• 03201ed fix(settings): set the `concurrency` option to count of CPUs
• d777111 build(package): drop unused dependencies
• e62d2d1 build(package): bump version to 3.0.0
• caeeda9 Merge pull request meminta agar konten yang melanggar, segera diubah atau dihapus.  greenkeeperio/greenkeeper-lockfile#203 from mrmlnc/ISSUE-155_update_documentation
• 27ae4b2 docs(settings): update description of options
• 1f853bc docs(readme): update documentation
• 0ba6dc0 refactor(benchmark): update suites
• c1d686c refactor(index): export some userful types
• d64c24f build(benchmark): add suite for stream API
• 40a1096 Merge pull request Question: Why is lockfile semver locked to @1? greenkeeperio/greenkeeper-lockfile#202 from mrmlnc/ISSUE-181_async_method_as_default_method
• ccde25e refactor: set async method as default method
• 87ed886 Merge pull request Update dependencies to enable Greenkeeper 🌴 greenkeeperio/greenkeeper-lockfile#201 from mrmlnc/issue-199_match_base_fix
• 68133f8 fix: the `baseNameMatch` option now work
• f4c443a refactor: `matchBase` → `baseNameMatch`
• c58ba78 test(smoke): add some smoke tests
• f3642dc Merge pull request feat(security): update lodash & deps greenkeeperio/greenkeeper-lockfile#200 from mrmlnc/fix_some_issues
• b32842d fix: support AsyncIterator for stream API
• 9b04800 refactor(settings): simplify the `deep` option
• 2b5bc54 fix(settings): correct default value for `throwErrorOnBrokenSymbolicLink`
• 9ab065b refactor: change some types
• 09f0107 feat: infer type of the output values
• a505273 feat: introduce `objectMode` option
• 111dbf1 refactor: drop `transform` option
• 2af2623 fix(providers): enable "posix" micromatch option

See the full diff

Package name: semantic-release

The new version differs by 203 commits.

• 45695b9 fix(package): update @ semantic-release/commit-analyzer to version 8.0.0
• 3c7b114 fix(package): update @ semantic-release/release-notes-generator to version 9.0.0
• f2b5826 fix(package): update @ semantic-release/npm to version 7.0.0
• c48bd3a fix(package): update @ semantic-release/github to version 7.0.0
• bc97537 test: fix copy/paste typo in test titles
• c7e461d docs: add `@ saithodev/semantic-release-gitea` to community plugins
• ef1b8a0 chore(package): update ava to version 3.1.0
• bec57cd chore: require Node.js >=10.18
• c6b1076 fix: correct error when remote repository has no branches
• b54b20d fix: use `--no-verify` when testing the Git permissions
• 88fe819 docs: fix typo
• 559c152 docs(README): update minimal required Node version / FAQ link (#1422)
• 31e7876 docs(travis): build on all branches by default
• 8c0490d docs: replacing firefox plugin in the list (#1416)
• 6b5b02e fix: fetch tags on repo cached by the CI
• 28b5480 docs: correct plugin execution order
• 3739ab5 fix(package): update env-ci to version 5.0.0
• 11665b2 chore(package): update dependencies
• 0785a84 fix: update plugin versions
• 152bf45 Merge remote-tracking branch 'origin/beta'
• 3ba8f2a Merge remote-tracking branch 'origin/master' into beta
• a8c747d feat: pass `envi-ci` values to plugins context
• fc70726 chore: add Mockserver generated file to gitignore
• fc7205d fix: correctly display command that errored out in logs

See the full diff

Package name: standard

The new version differs by 197 commits.

• 9c505a9 13.0.0
• 7f3dd5d [email protected]
• 8cfb0ee [email protected]
• e235cb5 changelog 13.0.0
• f125f0c add link to security disclosure policy
• bd44694 add nodejs logo; change logos to 4 per row
• f7f98bf Update CHANGELOG.md
• 5e6315c remove badge
• e3862be Update AUTHORS.md
• f796995 13.0.0-0
• 16ffaef Update CHANGELOG.md
• c1f817e bump deps
• ffb0b8e travis: drop node 6, add node 12
• d5565b5 Update CHANGELOG.md
• 4dcd00a add Nuxt.js logo
• ee3104d compress logos
• 6e077d7 standard
• d33bfe9 Merge pull request #1308 from munierujp/update_japanese_documents
• dd8fe00 Create FUNDING.yml
• 318bfac readme/changelog: global installation changes
• 329a2e0 readme: fix typescript instructions
• db61e3f Update CHANGELOG.md
• 7c661eb Automatically pass on Node 6 or earlier
• 0cfc932 Update Japanese document for 40d1d5e

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn