[Snyk] Security upgrade popsicle from 12.0.5 to 12.1.0

[svc-ast-gh-snyk4]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	718/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: popsicle

The new version differs by 9 commits.

• 164d554 12.1.0
• c7489ad Update dev dependencies
• 71bb7e6 Bump XHR transport
• 5286fac 12.0.6
• a20ffdb Bump lodash from 4.17.15 to 4.17.19 (Update dependencies #135)
• 82f3289 Bump elliptic from 6.4.1 to 6.5.3 (Update karma to the latest version 🚀 #136)
• bd75fb0 Bump handlebars from 4.5.1 to 4.7.6 (Update karma-mocha to the latest version 🚀 #137)
• d6522ba Update servie interface and HTTP transport deps
• c6f96a9 Bump acorn from 5.7.3 to 5.7.4 (does not work with public oauth servers #133)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

[bpavlov]

Unfortunately, popsicle 12.1.0 still has vulnerability issues. It depends on vulnerable versions of popsicle-cookie-jar.

tough-cookie  <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/tough-cookie
  popsicle-cookie-jar  *
  Depends on vulnerable versions of tough-cookie
  node_modules/popsicle-cookie-jar
    popsicle  >=12.0.0
    Depends on vulnerable versions of popsicle-cookie-jar
    node_modules/popsicle