[Snyk] Fix for 9 vulnerabilities

[sparkbold]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/strapi-plugin-content-manager/package.json
  • packages/strapi-plugin-content-manager/.snyk

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	No	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	No	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	No	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKDOWNIT-2331914	Yes	No Known Exploit
	811/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.8	Prototype Pollution SNYK-JS-PROPERTYEXPR-598800	No	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Validation Bypass SNYK-JS-SANITIZEHTML-1070780	No	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Access Restriction Bypass SNYK-JS-SANITIZEHTML-1070786	No	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SANITIZEHTML-2957526	No	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YUP-2420835	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @buffetjs/custom

The new version differs by 47 commits.

• fd4458e v3.3.7
• dd2d2d4 Merge pull request Bump node-fetch from 2.6.1 to 3.2.2 #199 from strapi/fix-jest
• 38b4878 Fix jest conf
• 89495f4 Merge pull request Bump aws-sdk from 2.785.0 to 2.1087.0 #198 from strapi/fix/yup
• 5783a0f Fix Prototype Pollution in property-expr (yup)
• e1587b1 Merge pull request Bump aws-sdk from 2.785.0 to 2.1086.0 #197 from vczb/fix-button-content-alignment
• fb15703 Fix button content alignment
• d32d0f9 v3.3.6
• 0175f5f Merge pull request Bump urijs from 1.19.2 to 1.19.9 #194 from strapi/fix/lodashVuln
• 52af025 Update lodash to remove prototype pollution vuln
• 8670b4c Merge pull request Bump urijs from 1.19.2 to 1.19.8 #187 from strapi/develop
• 5be8636 bump to 3.3.5
• 1599de7 Fix alphabetical order
• 7f6b216 Merge pull request Bump node-fetch from 2.6.1 to 3.2.1 #192 from raphael-ms/patch-1
• c626975 update label's name
• 6ca4a13 Update index.js
• 7d55bd9 Add label customization on the Toggle
• 43ebfaf Merge pull request Bump mini-css-extract-plugin from 0.6.0 to 2.5.3 #189 from bidoubiwa/fixe-customrow-doc
• 26bea18 Fix custom row code example
• 43aacb1 Add radius to Card (Bump url-parse from 1.4.7 to 1.5.10 #188)
• c0a29c9 Merge pull request Bump aws-sdk from 2.785.0 to 2.1080.0 #186 from strapi/fix/label-icon
• d873563 Add tooltip to label icon
• 1e7bc04 Merge branch 'master' of github.com:strapi/buffet into develop
• 9a5cad0 Merge pull request Bump aws-sdk from 2.785.0 to 2.1079.0 #185 from gustavpursche/patch-1

See the full diff

Package name: @buffetjs/utils

The new version differs by 47 commits.

• fd4458e v3.3.7
• dd2d2d4 Merge pull request Bump node-fetch from 2.6.1 to 3.2.2 #199 from strapi/fix-jest
• 38b4878 Fix jest conf
• 89495f4 Merge pull request Bump aws-sdk from 2.785.0 to 2.1087.0 #198 from strapi/fix/yup
• 5783a0f Fix Prototype Pollution in property-expr (yup)
• e1587b1 Merge pull request Bump aws-sdk from 2.785.0 to 2.1086.0 #197 from vczb/fix-button-content-alignment
• fb15703 Fix button content alignment
• d32d0f9 v3.3.6
• 0175f5f Merge pull request Bump urijs from 1.19.2 to 1.19.9 #194 from strapi/fix/lodashVuln
• 52af025 Update lodash to remove prototype pollution vuln
• 8670b4c Merge pull request Bump urijs from 1.19.2 to 1.19.8 #187 from strapi/develop
• 5be8636 bump to 3.3.5
• 1599de7 Fix alphabetical order
• 7f6b216 Merge pull request Bump node-fetch from 2.6.1 to 3.2.1 #192 from raphael-ms/patch-1
• c626975 update label's name
• 6ca4a13 Update index.js
• 7d55bd9 Add label customization on the Toggle
• 43ebfaf Merge pull request Bump mini-css-extract-plugin from 0.6.0 to 2.5.3 #189 from bidoubiwa/fixe-customrow-doc
• 26bea18 Fix custom row code example
• 43aacb1 Add radius to Card (Bump url-parse from 1.4.7 to 1.5.10 #188)
• c0a29c9 Merge pull request Bump aws-sdk from 2.785.0 to 2.1080.0 #186 from strapi/fix/label-icon
• d873563 Add tooltip to label icon
• 1e7bc04 Merge branch 'master' of github.com:strapi/buffet into develop
• 9a5cad0 Merge pull request Bump aws-sdk from 2.785.0 to 2.1079.0 #185 from gustavpursche/patch-1

See the full diff

Package name: markdown-it

The new version differs by 88 commits.

• d72c68b 12.3.2 released
• aca3396 dist rebuild
• ffc49ab Fix possible ReDOS in newline rule.
• 76469e8 12.3.1 released
• ae5a243 dist rebuild
• 1cd8a51 Fix tab preventing paragraph continuation in lists
• 830757c Fix spelling error in question Github Template (Correct description to match example strapi/strapi#835)
• 2e31d34 12.3.0 released
• 393354c Dist rebuild
• 8564eed Dev deps bump
• 24abaa5 Improve emphasis algorithm
• e07a9dd typo fix
• 6e2de08 12.2.0 released
• 08827d6 dist rebuild
• 8bcc82a Parser: Set ordered list_item_open token info to input marker.
• 77fb937 Add pathological test from cmark
• e5986bb Always suffix indented code block with a newline
• 13cdeb9 12.1.0 released
• 13d8335 Dist rebuild
• eed156e Fix emphasis algorithm as per 0.30 spec
• 0b14fa0 Update CommonMark spec to 0.30
• 064d602 Updated highlight.js usage info
• df4607f 12.0.6 released
• e5b0eb3 dist rebuild

See the full diff

Package name: sanitize-html

The new version differs by 103 commits.

• b4682c1 Merge pull request [Snyk] Fix for 1 vulnerabilities #557 from apostrophecms/release-2.7.1
• b6c4971 release 2.7.1 (with security fix previously tested and approved by Miro)
• 6683aad remove DoS vulnerability
• 7c7ccb4 credit
• 994f962 Merge pull request [Snyk] Security upgrade sharp from 0.26.2 to 0.29.3 #555 from paweljq/fix_protocol_relative_script_tag
• 3c3f075 Merge pull request [Snyk] Security upgrade execa from 1.0.0 to 2.1.0 #556 from cha147/patch-1
• 8e3b00f fix typos in readme
• 329dae7 Fix protocol relative url in scripts tags Bump snyk from 1.427.0 to 1.1081.0 #531
• 3cdc262 release 2.7.0 (Bump aws-sdk from 2.785.0 to 2.1290.0 #534)
• 72989f1 Merge pull request Bump immer from 7.0.14 to 9.0.17 #530 from apostrophecms/zade-credit
• 208cdb4 zade credit
• 7338f8b Merge pull request Bump aws-sdk from 2.785.0 to 2.1285.0 #529 from zadeviggers/patch-1
• 1971a57 Update defaults in readme
• 43f28f3 Update changelog
• 5fccedb Allow srcset
• be9c90d Add common image attributes
• 379b55b Bumps version ([Snyk] Security upgrade jsonwebtoken from 8.5.1 to 9.0.0 #523)
• da9767f Fixes important stripping (Bump aws-sdk from 2.785.0 to 2.1281.0 #522)
• d077c9f Merge pull request Bump snyk from 1.427.0 to 1.1076.0 #521 from alex-rantos/fix-trailing-text
• d905b3b typo on changelog
• 836c5ab add CHANGELOG entry
• c1112fb fix trailing text issue
• d737f39 Bumps version ([Snyk] Security upgrade jsonwebtoken from 8.5.1 to 9.0.0 #520)
• e5027ef Merge pull request Bump snyk from 1.427.0 to 1.1071.0 #515 from apostrophecms/revert-505-504-whatwg-url

See the full diff

Package name: yup

The new version differs by 116 commits.

• 31bbfc3 Publish v0.30.0
• d225b5d chore: fix lockfile
• f08d507 fix: defined() so it doesn't mark a schema as nullable
• 57d42a8 fix: uuid's regexp (How can I add search bar and CSV file download button on the content manager page? strapi/strapi#1112)
• 15a0f43 fix: security Fix for Prototype Pollution - huntr.dev (404 message every route after creating the project strapi/strapi#1088)
• 040c40d docs: Clarify return value of mixed.test (Fix entry create relations strapi/strapi#1089)
• e616039 chore(deps): update all non-major dependencies (Fix single upload with Bookshelf strapi/strapi#1087)
• 7fd80aa fix: IE11 clone() (Update v12 Readme.md strapi/strapi#1029)
• 7459544 chore: bump lodash (Add eslint to ctb backend strapi/strapi#1071)
• 66bb500 chore(deps): update all non-major dependencies (Hash is placed and stored in password field when editing a user in the admin strapi/strapi#1069)
• 6096064 feat: exposes context on mixed.test function and add originalValue to context (Reorder model root attributes and remove "multiple" key strapi/strapi#1021)
• a56655d chore(deps): update all non-major dependencies (GraphQL nesting security limit strapi/strapi#1058)
• 0dcfa21 chore(deps): update all non-major dependencies (Fix for host not in config.url strapi/strapi#1049)
• 7573a1a chore: upgrades property-expr dependency to 2.0.4 (Image gets removed/ resetted when changing another field strapi/strapi#1048)
• a3f94b0 chore(deps): update all non-major dependencies (Fixes multiple relationships on different models name strapi/strapi#1044)
• ed49b9e chore(deps): update all non-major dependencies (Error with the request /upload/files/:id in MySQL strapi/strapi#1037)
• 02f59ad chore(deps): update dependency eslint-plugin-jest to v24 (Fix prevGrantConfig equal undefined when config not exist in db strapi/strapi#1030)
• a5f55a4 chore(deps): update all non-major dependencies (Extraction depth strapi/strapi#1031)
• ce83c0b chore(deps): update all non-major dependencies (Improve SQL experience strapi/strapi#1025)
• 01da7e1 perf: reduce function calls for shallower stacks (Bug when having the same attributes in connected entities strapi/strapi#1022)
• dcae108 feat!: remove sync promise implementation and use callbacks internally (Improve Decimal128 and Float support with MongoDB strapi/strapi#1019)
• 70e39ef Update issue templates
• f8d5189 chore(deps): update all non-major dependencies (Add corresponding errors when duplicate email strapi/strapi#1014)
• 234b296 chore(deps): update all non-major dependencies (Can not test the connection of database when create new project strapi/strapi#1011)

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 More lessons are available in Snyk Learn