[Snyk] Fix for 10 vulnerabilities

[sparkbold]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/strapi-plugin-upload/package.json
  • packages/strapi-plugin-upload/.snyk

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-IMMER-1019369	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-IMMER-1540542	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	No	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	No	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	No	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	No	No Known Exploit
	811/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.8	Prototype Pollution SNYK-JS-PROPERTYEXPR-598800	No	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Remote Code Execution (RCE) SNYK-JS-SHARP-2848109	No	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YUP-2420835	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @buffetjs/custom

The new version differs by 47 commits.

• fd4458e v3.3.7
• dd2d2d4 Merge pull request Bump node-fetch from 2.6.1 to 3.2.2 #199 from strapi/fix-jest
• 38b4878 Fix jest conf
• 89495f4 Merge pull request Bump aws-sdk from 2.785.0 to 2.1087.0 #198 from strapi/fix/yup
• 5783a0f Fix Prototype Pollution in property-expr (yup)
• e1587b1 Merge pull request Bump aws-sdk from 2.785.0 to 2.1086.0 #197 from vczb/fix-button-content-alignment
• fb15703 Fix button content alignment
• d32d0f9 v3.3.6
• 0175f5f Merge pull request Bump urijs from 1.19.2 to 1.19.9 #194 from strapi/fix/lodashVuln
• 52af025 Update lodash to remove prototype pollution vuln
• 8670b4c Merge pull request Bump urijs from 1.19.2 to 1.19.8 #187 from strapi/develop
• 5be8636 bump to 3.3.5
• 1599de7 Fix alphabetical order
• 7f6b216 Merge pull request Bump node-fetch from 2.6.1 to 3.2.1 #192 from raphael-ms/patch-1
• c626975 update label's name
• 6ca4a13 Update index.js
• 7d55bd9 Add label customization on the Toggle
• 43ebfaf Merge pull request Bump mini-css-extract-plugin from 0.6.0 to 2.5.3 #189 from bidoubiwa/fixe-customrow-doc
• 26bea18 Fix custom row code example
• 43aacb1 Add radius to Card (Bump url-parse from 1.4.7 to 1.5.10 #188)
• c0a29c9 Merge pull request Bump aws-sdk from 2.785.0 to 2.1080.0 #186 from strapi/fix/label-icon
• d873563 Add tooltip to label icon
• 1e7bc04 Merge branch 'master' of github.com:strapi/buffet into develop
• 9a5cad0 Merge pull request Bump aws-sdk from 2.785.0 to 2.1079.0 #185 from gustavpursche/patch-1

See the full diff

Package name: @buffetjs/utils

The new version differs by 47 commits.

• fd4458e v3.3.7
• dd2d2d4 Merge pull request Bump node-fetch from 2.6.1 to 3.2.2 #199 from strapi/fix-jest
• 38b4878 Fix jest conf
• 89495f4 Merge pull request Bump aws-sdk from 2.785.0 to 2.1087.0 #198 from strapi/fix/yup
• 5783a0f Fix Prototype Pollution in property-expr (yup)
• e1587b1 Merge pull request Bump aws-sdk from 2.785.0 to 2.1086.0 #197 from vczb/fix-button-content-alignment
• fb15703 Fix button content alignment
• d32d0f9 v3.3.6
• 0175f5f Merge pull request Bump urijs from 1.19.2 to 1.19.9 #194 from strapi/fix/lodashVuln
• 52af025 Update lodash to remove prototype pollution vuln
• 8670b4c Merge pull request Bump urijs from 1.19.2 to 1.19.8 #187 from strapi/develop
• 5be8636 bump to 3.3.5
• 1599de7 Fix alphabetical order
• 7f6b216 Merge pull request Bump node-fetch from 2.6.1 to 3.2.1 #192 from raphael-ms/patch-1
• c626975 update label's name
• 6ca4a13 Update index.js
• 7d55bd9 Add label customization on the Toggle
• 43ebfaf Merge pull request Bump mini-css-extract-plugin from 0.6.0 to 2.5.3 #189 from bidoubiwa/fixe-customrow-doc
• 26bea18 Fix custom row code example
• 43aacb1 Add radius to Card (Bump url-parse from 1.4.7 to 1.5.10 #188)
• c0a29c9 Merge pull request Bump aws-sdk from 2.785.0 to 2.1080.0 #186 from strapi/fix/label-icon
• d873563 Add tooltip to label icon
• 1e7bc04 Merge branch 'master' of github.com:strapi/buffet into develop
• 9a5cad0 Merge pull request Bump aws-sdk from 2.785.0 to 2.1079.0 #185 from gustavpursche/patch-1

See the full diff

Package name: immer

The new version differs by 85 commits.

• fa671e5 fix(security): Follow up on CVE-2020-28477 where `path: [["__proto__"], "x"]` could still pollute the prototype
• 2e0aa95 Create SECURITY.md
• 050522d chore: fix CI. maybe.
• 1195510 docs: Update example-setstate.mdx (introduction of userObj strapi/strapi#833)
• 648d39b docs: fixing link to RFC-6902 & fixing typo (Wysiwyg preview strapi/strapi#830)
• bc890f7 docs: Update example-setstate.mdx (Fixes #828 strapi/strapi#829)
• 16a3d0f chore(deps): bump prismjs from 1.23.0 to 1.24.0 in /website (Split project setup process strapi/strapi#822)
• 847492c docs: Extended / updated documenation (Optimize the build process time strapi/strapi#824)
• 7f41483 chore: [workflows] don't release from forks
• 3f9a94e chore: let's test before publish
• bfb8dec fix: release missing dist/ folder
• b314b19 chore: fix cpx usage
• a607d6c chore: Remove old shizzle
• 6fd5329 chore: fixes for deploy preview
• 144f886 chore: fix docs deployment attempt 3
• 38964fa chore: semantic-release + GH actions
• 06c6741 chore: fix docs deploy
• ad23da9 chore: fix test job
• b6d92f4 chore: publish docs automatically
• c59576a chore: setup GH action for test
• dc3f66c fix: Update styles.scss strapi/strapi#807 new undefined properties should end up in result object
• 5412c9f fix: Field names can clash with API code, causing errors when creating records strapi/strapi#791 return 'nothing' should produce undefined patch
• 58b74a6 chore(deps): bump ssri from 6.0.1 to 6.0.2 in /website (Wysiwyg strapi/strapi#818)
• c9deb48 chore(deps): bump color-string from 1.5.4 to 1.5.5 in /website ((doc) fix collection name in many-to-many example strapi/strapi#817)

See the full diff

Package name: node-fetch

The new version differs by 7 commits.

• 1ef4b56 backport of Singleton content type strapi/strapi#1449 (Yarn support strapi/strapi#1453)
• 8fe5c4e 2.x: Specify encoding as an optional peer dependency in package.json (Specify MongoDB >= 2.6 strapi/strapi#1310)
• f56b0c6 fix(URL): prefer built in URL version when available and fallback to whatwg (Fix route count strapi/strapi#1352)
• b5417ae fix: import whatwg-url in a way compatible with ESM Node (Add count route for bookshelf strapi/strapi#1303)
• 18193c5 fix v2.6.3 that did not sending query params (mainField will lost content type builder model update strapi/strapi#1301)
• ace7536 fix: properly encode url with unicode characters (Rich Text Editor Doesn't Support Multi Paragraph Edits strapi/strapi#1291)
• 152214c Fix(package.json): Corrected main file path in package.json (Replace default _id by id with Mongoose strapi/strapi#1274)

See the full diff

Package name: sharp

The new version differs by 250 commits.

• db654de Release v0.30.5
• a6aeef6 Install: pass `PKG_CONFIG_PATH` via env rather than substitution
• 7bf6cbd Docs: correct links to libvips documentation
• 04c31b3 Install: warn about filesystem owner running npm v8+ as root
• ee9cdb6 Bump deps
• 8960eb8 Docs: changelog entry for Setup Cloudfront url for AWS S3 provider strapi/strapi#3218
• 54d9dc4 Fix rotate-then-extract for EXIF orientation 2 (Setup Cloudfront url for AWS S3 provider strapi/strapi#3218)
• 51b4a7c Add support for --libc flag to improve cross-platform install (Deleted attributes are returned by API strapi/strapi#3160)
• 5b03579 Docs: more details about concurrency, parallelism, threads
• 58c2af3 Docs: improve output format info for toBuffer
• ee948ac Docs: changelog and credit for Cloudinary provider plugin secret field now password type strapi/strapi#3196
• 66a3ce5 Allow installation of prebuilt libvips binary from filesystem (Cloudinary provider plugin secret field now password type strapi/strapi#3196)
• 75e5afc Docs: fix typo in gif example (Add optional field role if want to register specific user role strapi/strapi#3201)
• d396a4e Release v0.30.4
• ae1dbcd Bump deps
• 4c29368 Docs: EXIF metadata unsupported for TIFF output Changing the non-required field to requried field and arrange it strapi/strapi#3074
• 36e5596 Docs: mention npm's foreground-scripts option to aid debugging
• 985e881 Bump deps
• 0b11671 Docs: changelog for Hierarchical relationship type strapi/strapi#3178
• 9deac83 Add missing file name to 'Input file is missing' error message (Hierarchical relationship type strapi/strapi#3178)
• 5d36f5f Improve error message for SVG render above limit v26 Error: Cannot find module 'lodash' strapi/strapi#3167
• 926572b Control sensitivity to invalid images via failOn
• d0c8e95 Docs: expand info about use with worker threads
• b0ca23c Docs: changelog and credit for Use multiple sorts break the search results strapi/strapi#3146

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn