[Snyk] Security upgrade standard from 10.0.3 to 11.0.0

[dotam99]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • remix-simulator/package.json
  • remix-simulator/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: standard

The new version differs by 50 commits.

• a599426 authors
• 4b7fac5 11.0.0
• 76bf851 [email protected]
• 22673fc test: add --fix flag to attempt fixing packages before failing
• 50c466c remove hardcoded npm run test scripts
• cc79290 .npmignore
• 7b5e482 .npmignore
• 538f087 [email protected]
• 0147989 [email protected]
• 7ff022f [email protected]
• c9e8503 changelog
• a5333eb changelog
• 98f513c test style
• 8376af6 don't peg CPU when running tests
• 47489da update changelog
• 4ff2152 eslint-plugin-node@6
• 78be324 [email protected]
• c2bd85c Merge pull request publish ethereum/remix#1054 from standard/greenkeeper/initial
• 5edd7c3 chore: adapt code to updated dependencies
• aef406a copy
• ff379a0 add stdlib sponsor logo
• c1770a9 readme tweaks
• 4acfb74 Merge pull request #1057 from sonicdoe/patch-1
• e1c58fb Fix typo

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[guardrails]

⚠️ We detected 18 security issues in this pull request:

Mode: paranoid | Total findings: 18 | Considered vulnerability: 18

Insecure Use of Language/Framework API (14)

Severity	Details	Docs
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-lib/src/helpers/uiHelper.js Line 74 in 32ca31e const reg = /(.{40})$/.exec(hex)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-analyzer/src/solidity-analyzer/modules/staticAnalysisCommon.ts Line 400 in 32ca31e const types: RegExpExecArray | null = new RegExp(basicRegex.LIBRARYTYPE).exec(node.expression.expression.typeDescriptions.typeString)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-solidity/src/compiler/compiler.ts Line 281 in 32ca31e while ((match = importRegex.exec(files[fileName].content))) {	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-solidity/src/compiler/compiler.ts Line 284 in 32ca31e const path: RegExpExecArray | null = /(.*\/).*/.exec(fileName)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-solidity/src/compiler/compiler.ts Line 315 in 32ca31e const tmp: RegExpExecArray | null = /^(\d+.\d+.\d+)/.exec(version)	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-tests/src/compiler.ts Line 65 in 32ca31e while (group = importRegEx.exec(content)) {	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-tests/src/testRunner.ts Line 50 in 32ca31e const accountIndex: RegExpExecArray | null = fullName && userdoc.methods[fullName] ? senderRegex.exec(userdoc.methods[fullName].notice) : null	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-tests/src/testRunner.ts Line 64 in 32ca31e const value: RegExpExecArray | null = fullName && userdoc.methods[fullName] ? valueRegex.exec(userdoc.methods[fullName].notice) : null	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-url-resolver/src/resolve.ts Line 88 in 32ca31e match: (url) => { return /^(https?:\/\/)?(www.)?github.com\/([^/]*\/[^/]*)\/(.*)/.exec(url) },	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-url-resolver/src/resolve.ts Line 93 in 32ca31e match: (url) => { return /^(http?:\/\/?(.*))$/.exec(url) },	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-url-resolver/src/resolve.ts Line 98 in 32ca31e match: (url) => { return /^(https?:\/\/?(.*))$/.exec(url) },	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-url-resolver/src/resolve.ts Line 103 in 32ca31e match: (url) => { return /^(bzz-raw?:\/\/?(.*))$/.exec(url) },	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-url-resolver/src/resolve.ts Line 108 in 32ca31e match: (url) => { return /^(ipfs:\/\/?.+)/.exec(url) },	📚
High	Title: Child process (child_process) methods accept untrusted data to execute remix/remix-url-resolver/tests/test.ts Line 30 in 32ca31e match: (url: string) => { return /(^(?!(?:http:\/\/)|(?:https:\/\/)?(?:www.)?(?:github.com)))(^\/*[\w+-_/]*\/)*?(\w+\.sol)/g.exec(url) },	📚

More info on how to fix Insecure Use of Language/Framework API in JavaScript.

---

Vulnerable Libraries (4)

Severity	Details
High	pkg:npm/[email protected] upgrade to: > 2.2.2
Critical	pkg:npm/[email protected] upgrade to: > 0.4.30
Critical	pkg:npm/[email protected] upgrade to: > 11.0.0
Medium	pkg:npm/[email protected] upgrade to: > 6.2.0

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.