[Snyk] Fix for 13 vulnerabilities

[jmatsushita]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
	541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Directory Traversal SNYK-JS-MOMENT-2440688	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	Yes	Proof of Concept
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution npm:extend:20180424	Yes	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: metalsmith-layouts

The new version differs by 31 commits.

• d7b7863 2.3.1
• cdc12fa Prepare 2.3.1
• 69a3f52 Add test for filename prefix on rendering error message (#171)
• 6604a57 Prepend the current filename to the transformer error message. (#169)
• 0b71788 Update readme (#170)
• 891552e 2.3.0
• 4ef617f Prepare 2.3.0
• a17c50a Supporting async-only jstransformers; fixes #166 (#167)
• 1e633cb 2.2.0
• db47820 Prepare 2.2.0
• 5e805bb Align new feature with in-place
• 3525a5f Add suppressNoFilesError #160 (#163)
• 45800cf Update jest
• 084f132 Ignore dev dependencies for greenkeeper
• 70800f9 Update links to metalsmith org
• b697107 Remove shields.io badges (#158)
• 8b7ade0 Update eslint-airbnb-base (#157)
• 4a3072c Update to node 10 in .travis.yml (#155)
• c815ba9 Update license (#151)
• d683301 chore(package): update lint-staged to version 7.0.0 (#150)
• 128b5ab Prepare 2.1.0 (#149)
• fe65697 Add debug information (#148)
• 590429b Update other plugins (#145)
• 299c834 Update readme (#144)

See the full diff

Package name: metalsmith-permalinks

The new version differs by 60 commits.

• 94edea2 2.2.0
• e9edcbd Added ability to extend slugify; Docs added
• c74449b Packages updated: transliteration api changed - fixtures updated accordingly
• a3ff451 2.1.0
• 34044fc History Updated for release
• a92ba00 Merge pull request #87 from segmentio/duplicate-path-28
• 08186a5 Updated Travis with v10
• 4eb90a0 Adds functionality to make URIs unique and report when clashes occur
• 5a7e279 Tests: Removed boilerplate code where practical
• 295e38f 2.0.1
• 4e140b5 Updated history
• 2572aa0 Merge pull request #86 from segmentio/permalink-fix-81
• 3496d70 Fixes #81 - Permalink override frontmatter option
• bee779a Duplicated test: Removed
• 7e06551 2.0.0
• 1b33a81 History updated
• 4275c92 Merge pull request #84 from segmentio/add-test-for-paths
• 67e6af3 Add test for paths: Fixes #74
• 476460d Add test for paths: Fixes #74
• 2c6a0cc Merge pull request #83 from segmentio/migrate-to-slugify
• 8204751 Slug replaced with actively developed slugify: Fixes #82
• 925c9e1 1.0.0
• 7c44016 Merge branch 'gaggle-sibling-folder-strategy'
• edede6e Prettier applied

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Command Injection
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn