[Snyk] Fix for 2 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/core/package.json
  • packages/core/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	691/1000 Why? Recently disclosed, Has a fix available, CVSS 8.1	Command Injection SNYK-JS-SIMPLEGIT-2421199	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @salesforce/command

The new version differs by 32 commits.

• 76e3220 chore(release): 5.0.0 [ci skip]
• 45951bc Merge pull request [skip ci] Fix promotion of CLI to beta #60 from salesforcecli/wr/corev3
• d2ec30b chore: use regex
• 5a196d3 chore: remove suffix Error from error names
• ce6a297 chore: update oclif/core version
• fb1fe34 chore: update core
• 9a43cc7 chore: use OCLIF Flags
• 121c80b chore: clean up comments
• 5c43e25 docs: standardize flags as sf messages
• 0c419f5 docs: standardize command sf messages
• a728e92 chore: use CliUx, core everywhere
• 794037a chore: command v5 including core3, oclif/core
• 9de2661 Merge pull request Dependency Check before deploying unlocked packages #57 from salesforcecli/dependabot-npm_and_yarn-oclif-parser-3.8.7
• 770e864 chore(deps): bump @ oclif/parser from 3.8.6 to 3.8.7
• b437983 Merge pull request Do not throw error when package build number exceeds 999 #58 from salesforcecli/dependabot-npm_and_yarn-salesforce-core-2.35.3
• fbab047 chore(deps): bump @ salesforce/core from 2.35.0 to 2.35.3
• b80ccfd Merge pull request Move agents to ubuntu-latest #59 from salesforcecli/dependabot-npm_and_yarn-salesforce-kit-1.5.33
• a414a46 chore(deps): bump @ salesforce/kit from 1.5.30 to 1.5.33
• 6c9a589 Merge pull request Remove tagging function from CLI packaging tasks #48 from salesforcecli/sync-dependabot
• 5dadb0c Merge pull request New Task for Pushing Tags to Git #52 from salesforcecli/dependabot-npm_and_yarn-trim-off-newlines-1.0.3
• e0680a9 Merge branch 'main' into sync-dependabot
• 74c1f84 chore(deps): bump trim-off-newlines from 1.0.1 to 1.0.3
• d873e1c Merge pull request Add maintainer to docs/maintainers.md #53 from salesforcecli/dependabot-npm_and_yarn-oclif-config-1.18.3
• 90abfef chore(deps-dev): bump @ oclif/config from 1.18.2 to 1.18.3

See the full diff

Package name: simple-git

The new version differs by 87 commits.

• 94c2462 Merge pull request hotfix/forceignore #768 from steveukx/changeset-release/main
• 9113366 Version Packages
• 372efa0 Merge pull request chore(npm-shrinkwrap): add npm-shrinkwrap.json to sfpowerscripts-cli #767 from steveukx/feat/fix-fetch-snyk
• d119ec4 Prevent use of `--upload-pack` as a command in `git.fetch` to avoid potential accidental command execution.
• e4ff627 Merge pull request Source Packages not respecting multiple forceignores resulting in aliasifed package installation being skipped #761 from steveukx/changeset-release/main
• fcc7618 Version Packages
• 7c24bb0 Merge pull request sfpowerscripts not surfacing unlocked package installation errors #760 from steveukx/fix/project-readme
• 80651d5 Remove pre-publish step of copying `readme.md`, no longer required
• 0d0c198 Merge pull request fix(validate): valdiate against org should not do diff check #759 from steveukx/changeset-release/main
• 6838e24 Version Packages
• d53875f Merge pull request chore(apex-parser): upgrade apex-parser dependency to 2.11.0 #758 from steveukx/fix/project-readme
• ac4f38f Move workspace readme into the `simple-git` package, symlink to it from the workspace
• e9f0461 Move workspace readme into the `simple-git` package, symlink to it from the workspace
• bcfa6f8 Merge pull request Upgrade dependency apex-parser to 2.10.0 #756 from steveukx/changeset-release/main
• 7a29566 Version Packages
• 50a8a6b Merge pull request Enable pools to succeed on deployment errors by default #755 from steveukx/release-attempt
• d35987b Add publish goal to changeset action
• 5073eaa Merge pull request Error validating against an Org and not finding commit ID #754 from steveukx/changeset-release/main
• c4f937d Version Packages
• e9abd5d Merge pull request How to use aliasify on a data package? #753 from steveukx/release-attempt
• 1e4c591 Removes the auto-deletion of changesets branches
• 284f896 Merge pull request Fix deployment of default directory for aliasfied packages #752 from steveukx/changeset-release/main
• c486165 Version Packages
• 79ec4e4 Merge pull request #751 from steveukx/release-attempt

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[codecov-commenter]

Codecov Report

Merging #888 (3953ec2) into develop (7bcb73f) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##           develop     #888   +/-   ##
========================================
  Coverage    80.03%   80.03%           
========================================
  Files           36       36           
  Lines         1102     1102           
  Branches       233      233           
========================================
  Hits           882      882           
  Misses         220      220           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7bcb73f...3953ec2. Read the comment docs.