[Snyk] Fix for 6 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • cvat-core/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	616/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.9	Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-1579269	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	No	Proof of Concept
	520/1000 Why? Has a fix available, CVSS 5.9	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKED-584281	No	No Known Exploit
	596/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.5	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: axios

The new version differs by 250 commits.

• e367be5 [Releasing] 0.21.3
• 83ae383 Correctly add response interceptors to interceptor chain (Update installation guide for exporting CVAT_HOST env variable before docker compose command. cvat-ai/cvat#4013)
• c0c8761 [Updating] changelog to include links to issues and contributors
• 619bb46 [Releasing] v0.21.2
• 82c9455 Create SECURITY.md (Cypress. Fix case 108 for Firefox. cvat-ai/cvat#3981)
• 5b45711 Security fix for ReDoS (Cypress. Update case 105. Add check "Google cloud storage" provider fields. cvat-ai/cvat#3980)
• 5bc9ea2 Update ECOSYSTEM.md (502 Bad Gateway cvat-ai/cvat#3817)
• e72813a Fixing README.md (A user with that username already exists, when create a new project cvat-ai/cvat#3818)
• e10a027 Fix README typo under Request Config (Fix intelligent scissors blocking cvat-ai/cvat#3825)
• e091491 Update README.md (#3936)
• b42fbad Removed un-needed bracket
• 520c8dc Updating CI status badge (CVAT_server. Test for "Project updated time". cvat-ai/cvat#3953)
• 4fbeecb Adding CI on Github Actions. (Connected file share folder doesn't work cvat-ai/cvat#3938)
• e9965bf Fixing the sauce labs tests (Update Datumaro dependency to 0.2.0 cvat-ai/cvat#3813)
• dbc634c Remove charset in tests (Improving documentation about tracker SiamMask  cvat-ai/cvat#3807)
• 3958e9f Add explanation of cancel token (Could not check authorization on the server cvat-ai/cvat#3803)
• 69949a6 Adding custom return type support to interceptor (Cypress. Fix tests. cvat-ai/cvat#3783)
• 49509f6 Create FUNDING.yml (Too many frames have rectangles when using a Tracker cvat-ai/cvat#3796)
• 199c8aa Adding parseInt to config.timeout (CVAT 1.6.0 How to set Hostname cvat-ai/cvat#3781)
• 94fc4ea Adding isAxiosError typeguard documentation ([Snyk] Upgrade @types/react-router-dom from 5.1.8 to 5.1.9 cvat-ai/cvat#3767)
• 0ece97c Fixing quadratic runtime when setting a maxContentLength (CVAT-3D - Part1 cvat-ai/cvat#3738)
• a18a0ec Updating `lib/core/README.md` about Dispatching requests (Error while getting preview/thumbnail images cvat-ai/cvat#3772)
• 59fa614 [Updated] follow-redirects to the latest version (Bump url-parse from 1.5.1 to 1.5.3 in /cvat-ui cvat-ai/cvat#3771)
• 7821ed2 Feat/json improvements (Images are copied into the docker FS though using the "Connected file share" option cvat-ai/cvat#3763)

See the full diff

Package name: eslint

The new version differs by 250 commits.

• 145aec1 7.16.0
• 83518a5 Build: changelog update for 7.16.0
• a62ad6f Update: fix false negative of no-extra-parens with NewExpression (#13930)
• f85b4c7 Fix: require-atomic-updates false positive across await (fixes #11954) (#13915)
• 301d0c0 Fix: no-constant-condition false positives with unary expressions (#13927)
• 555c128 Fix: false positive with await and ** in no-extra-parens (fixes #12739) (#13923)
• d93c935 Docs: update JSON Schema links (#13936)
• 8d0c93a Upgrade: [email protected] (#13920)
• 9247683 Docs: Remove for deleted npm run profile script (#13931)
• ab240d4 Fix: prefer-exponentiation-operator invalid autofix with await (#13924)
• dc76911 Chore: Add .pre-commit-hooks.yaml file (#13628)
• 2124e1b Docs: Fix wrong rule name (#13913)
• 06b5809 Sponsors: Sync README with website
• 26fc12f Docs: Update README team and sponsors
• 902a032 7.15.0
• 6356778 Build: changelog update for 7.15.0
• 5c11aab Upgrade: @ eslint/esintrc and espree for bug fixes (refs #13878) (#13908)
• 0eb7957 Upgrade: [email protected] (#13877)
• 683ad00 New: no-unsafe-optional-chaining rule (fixes #13431) (#13859)
• cbc57fb Fix: one-var autofixing for export (fixes #13834) (#13891)
• 110cf96 Docs: Fix a broken link in working-with-rules.md (#13875)
• 0cb81a9 7.14.0
• fb3a594 Build: changelog update for 7.14.0
• 5f09073 Update: fix 'skip' options in no-irregular-whitespace (fixes #13852) (#13853)

See the full diff

Package name: jest

The new version differs by 250 commits.

• 343532a v26.0.0
• 075854a chore: update changelog for release
• 68b65af v26.0.0-alpha.2
• d30a586 fix: disallow hook definitions in tests (#9957)
• 3375ac3 chore: remove unused prettier uninstall step from CI
• 0a63d40 fix: absolute path moduleNameMapper + jest.mock issue (Enhanced running of annotations actions cvat-ai/cvat#8727)
• 03dbb2f chore: fix watch mode test with utimes (#9967)
• 68d12d5 chore: skip broken test on windows (#9966)
• e8e8146 align circus with jasmine's top-to-bottom execution order (#9965)
• 968a301 Fix invalid re-run of tests in watch mode (Server Status 500 when exporting task annotations cvat-ai/cvat#7347)
• 5d1be03 chore: fix windows CI (#9964)
• 2bac04f v26.0.0-alpha.1
• c665f22 feat: add `createMockFromModule` to replace `genMockFromModule` (#9962)
• 8147af1 chore: improve error on module not found (#9963)
• 71631f6 feat: add new 'modern' implementation of Fake Timers ([GSoC2024] added check for the attributes which aren't present for the specified clientID for a conflict of annotation cvat-ai/cvat#7776)
• d7f3427 chore: rename LolexFakeTimers to ModernFakeTimers (#9960)
• 2c7682c Update index.js (#9095)
• 5a16415 docs: Updated Testing Frameworks guide with React; make it generic (#9106)
• 4216b86 updated docs regarding testSequencer (#9174)
• 2e8f8d5 fix: handle `null` being passed to `createTransformer` (#9955)
• 7a3c997 jest-circus: throw if a test / hook is defined asynchronously (Remove the "classifier" compatibility alias cvat-ai/cvat#8096)
• 42f920c chore: update ts-eslint (#9953)
• 3078172 Updated config docs with default transform value (Fix typos in UI code cvat-ai/cvat#8583)
• b6052e0 Update jest-phabricator documentation (Export dataset in CVAT format misses frames in tasks with non-default… cvat-ai/cvat#8662)

See the full diff

Package name: jest-config

The new version differs by 22 commits.

• ff9269b chore: bump most dated deps (Update develop after v2.24.0 cvat-ai/cvat#8850)
• 7594141 chore: upgrade to eslint@6 (How to export data to COCO format while keeping polygon data? cvat-ai/cvat#8855)
• b33ce0d chore: upgrade to micromatch v4 (Update serverless-tutorial.md cvat-ai/cvat#8852)
• d6ff72a chore: add node 12 to CI (Can not export CVAT for video annotaitons cvat-ai/cvat#8411)
• 7e9b4ea chore: upgrade jsdom (README & Docs needs to be updated about mask_rcnn(gpu) cvat-ai/cvat#8851)
• 4bb7a2d Use `weak-napi` instead of `weak` in `jest-leak-detector`
• ce47c6c Get rid of Node 6 support (cvat-vector deployment crashing on a fresh Kubernetes deployment cvat-ai/cvat#8455)
• bc5c3c7 jest-snapshot: Remove only the added newlines in multiline snapshots (Why does the position of an already marked annotation box change? cvat-ai/cvat#8859)
• d523fa8 bug.md: highlights placeholder should be removed (cannot find correct tasks api cvat-ai/cvat#8836)
• 08f109c expect: Display expectedDiff more carefully in toBeCloseTo (Added trigger dependent repo update workflow cvat-ai/cvat#8389)
• b09de2d chore: bump node-notifier for node v6 support
• 557a39f fix(linter): Fix linting failure introduced in Create holes in masks cvat-ai/cvat#8847 😓 (Release v2.24.0 cvat-ai/cvat#8849)
• 012472b fix(docs): Update broken links in docs. (Create holes in masks cvat-ai/cvat#8847)
• ee2bea1 chore: sort member in imports (cvat_worker_chunks Container Does Not Inherit Database Environment Variables cvat-ai/cvat#8846)
• 9ba4594 add Chinese Jest work with AngularJS tutorial (Bump nanoid from 3.3.7 to 3.3.8 cvat-ai/cvat#8828)
• 0e5b363 chore: reduce reliance on esModuleInterop (Flickering in 3D play functionality cvat-ai/cvat#8842)
• d69f8d3 getTimerCount will not include cancelled immediates (Can access CVAT over LAN but not Internet cvat-ai/cvat#8764)
• b4bd77b Fix grammar: "your jest's config"->"your Jest..." (E2E test of issue #8785: Undefined when reading getUpdated cvat-ai/cvat#8843)
• 54b3dcf Fix grammar: "a known issues"->"a known issue" (All outside skeleton trajectory  cvat-ai/cvat#8844)
• e76c7da docs: update matchMedia methods (Ability to quickly change labels cvat-ai/cvat#8835)
• 23b9860 chore: roll new version of docs
• 3cdbd55 Release 24.9.0

See the full diff

Package name: jest-junit

The new version differs by 88 commits.

• 76bba08 Merge pull request Scene annotation cvat-ai/cvat#189 from palmerj3/v13
• 6a84a3e Merge pull request @transaction for select_for_update in update_job_status() cvat-ai/cvat#160 from sginter/noStackTrace
• 017af76 Merge pull request Unable to build docker with tf annotation cvat-ai/cvat#154 from arabull/rootDir
• ba1a2ac v13.0.0
• 1b5af37 Merge branch 'rootDir' of https://github.com/arabull/jest-junit into rootDir
• c5ca7c8 Replace <rootDir> prior to path.join().
• 46bc2c9 Merge pull request Hide "completed" tasks by default from dashboard cvat-ai/cvat#188 from KeYu-dev/fixcg-ansi-regex
• 2b6c131 Update package.json
• 8f43cd0 Fix CG by updating strip-ansi from 5.2.0 to 6.0.1
• 506df22 chore: use Jest 27 (Fixed split functionality. cvat-ai/cvat#186)
• c054549 chore: run tests on Windows (Expose an API to manage tasks cvat-ai/cvat#187)
• 475c84f chore: refresh lockfile (Git application cvat-ai/cvat#184)
• 77e5b64 chore: migrate to GH Actions (Permissions per tasks and jobs cvat-ai/cvat#185)
• 46ab4a4 Merge pull request is there a way to edit the labels once submitted (add or remove attributes, ...) cvat-ai/cvat#182 from palmerj3/twelveThreeZero
• 7568d08 v12.3.0
• 8e5f72b Merge pull request Sometimes attributes can be truncated in attribute annotation mode cvat-ai/cvat#179 from D4N14L/fixDisplayName
• e189f2d Fix displayName usage in templates
• 6751a86 Merge pull request Selection of an object isn't propagated by default on next frame cvat-ai/cvat#172 from palmerj3/v12.2.0
• ce8dde5 v12.2.0
• 181e14e Merge pull request Change cursor view in merge/group modes cvat-ai/cvat#171 from scttcper/uuid-upgrade
• c6bc051 fix: Upgrade uuid package
• e02ac65 Merge pull request Support image filtration by objects cvat-ai/cvat#169 from palmerj3/bumpVersion
• 712907b v12.1.0
• 69e802c Merge pull request Cannot upload annotations to large task (due to segments?) cvat-ai/cvat#168 from daivinhtran/add-outputfile-config

See the full diff

Package name: jsdoc

The new version differs by 4 commits.

• e1f1919 3.6.7
• f7a64bd chore(deps): update selected dependencies
• 3f5c462 3.6.6
• 95e3192 fix: correctly track interface members

See the full diff

Package name: jsonpath

The new version differs by 5 commits.

• c1dd8ec version 1.1.1
• 1303356 upgrade underscore dependency version
• eafa80c version 1.1.0
• c125a0c Merge pull request [Snyk] Security upgrade pillow from 7.2.0 to 9.0.0 #123 from chris-branch/master
• 9fec3fa Bug fix for permissions issue during global installs

See the full diff

Package name: webpack-cli

The new version differs by 250 commits.

• fb50f76 chore(release): publish new version
• 2c75aeb chore: new version of the packages
• 0d05c30 chore(release): publish %s
• 3f9e151 chore: fix lerna config
• 2c1e34c tests(generator): enhance init generator tests (couldn't connet to server when create superuser cvat-ai/cvat#1236)
• 6ee61b9 Fix loader-generator and plugin-generator tests (Exception: filename collision: when uploading remote-files with the same basename cvat-ai/cvat#1250)
• 52956a2 Fixing the typos and grammatical errors in Readme files ([WIP] Fixed security warnings in CVAT server cvat-ai/cvat#1246)
• 7faaed2 chore: update Bug_report & Feature_request Templates (Move annotation formats to dataset manager cvat-ai/cvat#1256)
• 7a5b33d feat(webpack-cli): added mode argument (Bug: Occluded Objects Still Appear In YOLO output! cvat-ai/cvat#1253)
• 3715756 tests(webpack-cli): add test case for defaults flag (Feature requests: Let the user delete last point when drawing a polygon cvat-ai/cvat#1254)
• a7cba2f chore: project maintanance and typescript fix (fixed git sync app cvat-ai/cvat#1247)
• 7748472 chore: ignore package-lock.json and remove its references (All annotations have disappeared cvat-ai/cvat#1252)
• a014aa7 docs: fix supported arguments & commands link in README (Fixed security issues in Datumaro cvat-ai/cvat#1244)
• 06129a1 feat(webpack-cli): add progress bar for progress flag (Release 0.6.0 cvat-ai/cvat#1238)
• 6cc6a49 chore: post refactor CLI (Converting DEXTR model to Inference Engine format cvat-ai/cvat#1237)
• 358651e chore: move cli under lerna package (React UI: Filters history cvat-ai/cvat#1225)
• 2dc495a fix(init): fix webpack config scaffold (Remote access results in 404 Not Found error (nginx/1.16.1) cvat-ai/cvat#1231)
• 1ab62d2 tests(generator): add tests for plugin generator (Some debian package manager tweaks cvat-ai/cvat#1235)
• d2dd0c1 tests(sourcemap): fix flaky stats statement ([Datumaro] Optimize mask operations cvat-ai/cvat#1232)
• f6dc680 tests(loader-generator): add tests for loader generator (Task button doesn't work cvat-ai/cvat#1234)
• 35d1381 tests(generator): enable init generator test ([Datumaro] Label remapping transform cvat-ai/cvat#1233)
• 66cdcb6 chore(generator): remove transpiled tests (Az/fix annotation dump upload cvat-ai/cvat#1229)
• f29a170 fix(init): fix the invalid package name (Action recognition: 1D intervals cvat-ai/cvat#1228)
• 8c3a66d chore(cli): updated changelog of v3 (auto-annotation fails for large videos cvat-ai/cvat#1224)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic