[Snyk] Fix for 3 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	711/1000 Why? Recently disclosed, Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	711/1000 Why? Recently disclosed, Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	711/1000 Why? Recently disclosed, Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gulp-iconfont

The new version differs by 24 commits.

• d751ba6 10.0.3
• b0e8399 Merge pull request [Snyk] Fix for 2 vulnerabilities #175 from pioug/master
• ed9dae2 Add support for Node.js 11/12
• 47cde1a 10.0.2
• a4a2b5e updated dependencies
• 0819325 10.0.1
• cb86fe2 Use multipipe instead of plexer: no need for explicit error handling, simpler code.
• 974891f 10.0.0
• 4a99226 Updated gulp-svgicons2svgfont and refactored tests as necessary.
• 230b2f9 Updated dependencies and added node 9.10.1 to travis in attempt to trace bugs.
• c26a03d travis: node lts and latest.
• 0295439 9.2.0
• 45c7f12 Merge branch 'feature/make_options_available_for_svg2ttf' of https://github.com/bialikover/gulp-iconfont
• 012bbd9 9.1.0
• 55b7c8a Updated package-lock.json.
• d24b64c Merge pull request [Snyk] Fix for 1 vulnerabilities #159 from selfpoint/master
• 8761113 Integrated proposed changes.
• 9e9601b lazy load gulp-* fonts dependencies when needed
• 580ac6c lazy load gulp-* fonts dependencies when needed
• 159ba51 Merge pull request [Snyk] Fix for 1 vulnerabilities #158 from ohbarye/remove-gulp-util
• d971936 Drop dependency on gulp-util
• e7db288 remove ttf2woff2 support
• 4fe2c02 pass timestamp instead of date
• 86d48c8 move options to the top and pass the entire object to svg2ttf function

See the full diff

Package name: gulp-sass

The new version differs by 38 commits.

• 5775044 Update CHANGELOG.md
• 978b8f6 Update to major version 5 (#802)
• 10eae93 Update changelog for 4.1.1
• 947b26c Upgrade lodash to fix a security issue (#776)
• 8d6ac29 Update changelog
• 43c0547 4.1.0
• ebe3ec6 Set appropriate file stat times (#763)
• 7ab018e Migrate to the lodash package
• fa670c6 4.0.2
• fefa00e Revert package.json version bump
• 98254d2 Fix README typos
• 8a14419 Continue loading Node Sass by default
• 938afbe Add a note about synchronous versus asynchronous speed
• 7cc2db1 Make this package implementation-agnostic
• 643f73b Add documentation for synchronous code options
• 0b3c7e7 4.0.1
• daca90d Merge pull request #681 from DKvistgaard/master
• 71471c2 Declaring logError as function instead of arrow function.
• 450a7b8 4.0.0
• e9b1fe8 Fix node versions in appveyor.yml
• 44be409 Merge pull request #667 from dlmanning/next
• 7656eff Adopt airbnb eslint preset
• 1293169 Bump autoprefixer@^8.1.0, gulp-postcss@^7.0.1
• 9fa817b Bump gulp-sourcemaps@^2.6.4

See the full diff

Package name: npm

The new version differs by 108 commits.

• ee147fb 5.8.0
• 7d5a7ea docs: tiny changelog fixes
• df27cdd 5.8.0-next.0
• 9b206bb update AUTHORS
• a571f80 doc: update changelog for [email protected]
• 58d2aa5 pack: use a specific mtime when packing (#20027)
• 8150dd5 makefile: dont call destructive 'uninstall' on clean (#16540)
• b2a1cf0 docs: document `browser` field (#18382)
• 9847c82 error-message: more detailed message for inaccessible files. (#18384)
• 7a87051 docs: Clarify that "files" is an exclusive list of files (#18407)
• f0e998d config: Do replace environment in config files even for keys (#18426)
• b57780b pack: Don't rely on entry point to be npm-cli.js (#18450)
• d7ff071 docs: capitalize javascript cause why not (#18514)
• d70c019 unsupported: Remove ES6 code from unsupported error logging (#18953)
• 35c4abd docs: typo fix in coding style (#18976)
• 1d368e1 install: Support for --no-proxy configuration (#19157)
• dcdfdcb docs: add --development info in npm-ls.md (#19192)
• c2bbaaa docs: tiny style fix in npm.md (#19194)
• 0616fd2 docs: add "edit" section to description in npm-team.md (#19216)
• de72d9a docs: sync package-lock spec and help page (#19307)
• b9d0c0c xmas: Holidays are for all JS, not just Node (#19448)
• ffa84cd docs: added example for homepage pkgjson field(#19475)
• dc36d85 docs: update now saves by default (#19552)
• c8230c9 npx: fix npx prefix issue (#19608)

See the full diff

Package name: tar

The new version differs by 92 commits.

• 3e35515 4.4.18
• 52b09e3 fix: prevent path escape using drive-relative paths
• bb93ba2 fix: reserve paths properly for unicode, windows
• 2f1bca0 fix: prune dirCache properly for unicode, windows
• 9bf70a8 4.4.17
• 6aafff0 fix: skip extract if linkpath is stripped entirely
• 5c5059a fix: reserve paths case-insensitively
• fd6accb 4.4.16
• 53cea6e tests: run (and pass) on windows
• 166cfc0 fix: refactoring to pass tests on Windows
• ce5148e fix: refactoring to pass tests on Windows
• 3f2e2da fix: normalize paths on Windows systems
• e29a665 fix: properly prefix hard links
• fd2a38d chore: WriteEntry cleaner write() handling
• 7b2acc5 update deps
• 83bb22c WriteEntry backpressure
• 0dcc5b2 chore: track fs state on WriteEntry class, not in arguments
• adf3511 Avoid an unlikely but theoretically possible redos
• d688cad fix: properly handle top-level files when using strip
• ea6f254 unpack: keep path reservations longer
• b2a97e1 Address unpack race conditions using path reservations
• f0fe3aa basic path reservation system
• 843c897 4.4.15
• 46fe350 Remove paths from dirCache when no longer dirs

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic