[Snyk] Fix for 49 vulnerabilities

[wmurphysnyk]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	199/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00299, Social Trends: No, Days since published: 848, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.49, Likelihood: 2.65, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	172/1000 Why? Confidentiality impact: None, Integrity impact: High, Availability impact: None, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00091, Social Trends: No, Days since published: 75, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 8.32, Likelihood: 2.06, Score Version: V5	Use of Weak Hash SNYK-JS-CRYPTOJS-6028119	No	No Known Exploit
	198/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00109, Social Trends: No, Days since published: 406, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.49, Likelihood: 2.64, Score Version: V5	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	Yes	Proof of Concept
	211/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00049, Social Trends: No, Days since published: 213, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.49, Likelihood: 2.81, Score Version: V5	Prototype Pollution SNYK-JS-DOTTIE-3332763	No	Proof of Concept
	199/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00242, Social Trends: No, Days since published: 1095, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.49, Likelihood: 2.65, Score Version: V5	Denial of Service (DoS) SNYK-JS-ENGINEIO-1056749	Yes	Proof of Concept
	142/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.0007, Social Trends: No, Days since published: 413, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.49, Likelihood: 1.89, Score Version: V5	Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	No	No Known Exploit
	241/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00197, Social Trends: No, Days since published: 1286, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 10.8, Likelihood: 2.23, Score Version: V5	Authorization Bypass SNYK-JS-EXPRESSJWT-575022	Yes	No Known Exploit
	255/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: High, Attack Vector: Local, EPSS: 0.00045, Social Trends: No, Days since published: 635, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 98, Impact: 10.8, Likelihood: 2.36, Score Version: V5	Directory Traversal SNYK-JS-GRUNT-2635969	No	Proof of Concept
	269/1000 Why? Confidentiality impact: Low, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: High, Attack Vector: Local, EPSS: 0.00042, Social Trends: No, Days since published: 607, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 98, Impact: 11.4, Likelihood: 2.36, Score Version: V5	Race Condition SNYK-JS-GRUNT-2813632	No	Proof of Concept
	177/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Local, EPSS: 0.01055, Social Trends: No, Days since published: 39, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 7.49, Likelihood: 2.35, Score Version: V5	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
	197/1000 Why? Confidentiality impact: Low, Integrity impact: High, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00046, Social Trends: No, Days since published: 382, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 9.79, Likelihood: 2, Score Version: V5	Improper Authentication SNYK-JS-JSONWEBTOKEN-3180022	Yes	No Known Exploit
	133/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00053, Social Trends: No, Days since published: 382, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.24, Likelihood: 2.52, Score Version: V5	Improper Restriction of Security Token Assignment SNYK-JS-JSONWEBTOKEN-3180024	Yes	No Known Exploit
	217/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: High, Attack Vector: Network, EPSS: 0.0005, Social Trends: No, Days since published: 382, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 10.8, Likelihood: 2, Score Version: V5	Use of a Broken or Risky Cryptographic Algorithm SNYK-JS-JSONWEBTOKEN-3180026	Yes	No Known Exploit
	78/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00231, Social Trends: No, Days since published: 1057, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.94, Likelihood: 2.65, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	No	Proof of Concept
	298/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): High, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00606, Social Trends: No, Days since published: 1057, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 12.2, Likelihood: 2.43, Score Version: V5	Command Injection SNYK-JS-LODASH-1040724	No	Proof of Concept
	189/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01552, Social Trends: No, Days since published: 1651, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.03, Likelihood: 2.68, Score Version: V5	Prototype Pollution SNYK-JS-LODASH-450202	No	Proof of Concept
	188/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 1235, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.03, Likelihood: 2.67, Score Version: V5	Prototype Pollution SNYK-JS-LODASH-608086	No	Proof of Concept
	186/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00117, Social Trends: No, Days since published: 1801, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.03, Likelihood: 2.64, Score Version: V5	Prototype Pollution SNYK-JS-LODASH-73638	No	Proof of Concept
	166/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): High, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00317, Social Trends: No, Days since published: 1739, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 7.49, Likelihood: 2.2, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	No	Proof of Concept
	56/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00071, Social Trends: No, Days since published: 447, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.94, Likelihood: 1.89, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	No	No Known Exploit
	73/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.01248, Social Trends: No, Days since published: 658, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Low, Package Popularity Score: 99, Impact: 2.94, Likelihood: 2.45, Score Version: V5	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	199/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00437, Social Trends: No, Days since published: 400, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.49, Likelihood: 2.65, Score Version: V5	Prototype Poisoning SNYK-JS-QS-3153490	No	Proof of Concept
	148/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00063, Social Trends: No, Days since published: 297, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.24, Likelihood: 2.81, Score Version: V5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	No	Proof of Concept
	185/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00137, Social Trends: No, Days since published: 1063, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.24, Likelihood: 3.52, Score Version: V5	Validation Bypass SNYK-JS-SANITIZEHTML-1070780	Yes	Proof of Concept
	133/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00137, Social Trends: No, Days since published: 1063, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.24, Likelihood: 2.52, Score Version: V5	Access Restriction Bypass SNYK-JS-SANITIZEHTML-1070786	Yes	No Known Exploit
	75/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00112, Social Trends: No, Days since published: 497, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.94, Likelihood: 2.52, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SANITIZEHTML-2957526	Yes	No Known Exploit
	291/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 1218, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Critical, Package Popularity Score: 99, Impact: 11.4, Likelihood: 2.56, Score Version: V5	Arbitrary Code Execution SNYK-JS-SANITIZEHTML-585892	Yes	No Known Exploit
	211/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00091, Social Trends: No, Days since published: 202, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.49, Likelihood: 2.81, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	222/1000 Why? Confidentiality impact: High, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 535, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 2.26, Score Version: V5	SQL Injection SNYK-JS-SEQUELIZE-2959225	No	No Known Exploit
	214/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00076, Social Trends: No, Days since published: 325, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.78, Likelihood: 2.74, Score Version: V5	Improper Filtering of Special Elements SNYK-JS-SEQUELIZE-3324088	No	No Known Exploit
	81/1000 Why? Confidentiality impact: Low, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00087, Social Trends: No, Days since published: 325, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.94, Likelihood: 2.74, Score Version: V5	Information Exposure SNYK-JS-SEQUELIZE-3324089	No	No Known Exploit
	178/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.0005, Social Trends: No, Days since published: 325, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 7.03, Likelihood: 2.52, Score Version: V5	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-SEQUELIZE-3324090	No	No Known Exploit
	304/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00132, Social Trends: No, Days since published: 712, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 12.2, Likelihood: 2.48, Score Version: V5	Information Exposure SNYK-JS-SIMPLEGET-2361683	Yes	Proof of Concept
	264/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00097, Social Trends: No, Days since published: 620, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 98, Impact: 7.49, Likelihood: 3.52, Score Version: V5	Denial of Service (DoS) SNYK-JS-SQLITE3-2388645	No	Proof of Concept
	300/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00143, Social Trends: No, Days since published: 300, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 98, Impact: 12.2, Likelihood: 2.45, Score Version: V5	Arbitrary Code Execution SNYK-JS-SQLITE3-3358947	No	No Known Exploit
	119/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: None, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Local, EPSS: 0.00889, Social Trends: No, Days since published: 887, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 12, Likelihood: 0.989, Score Version: V5	Arbitrary File Overwrite SNYK-JS-TAR-1536528	No	No Known Exploit
	121/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: None, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Local, EPSS: 0.01656, Social Trends: No, Days since published: 887, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 12, Likelihood: 1.01, Score Version: V5	Arbitrary File Overwrite SNYK-JS-TAR-1536531	No	No Known Exploit
	50/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 886, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Low, Package Popularity Score: 99, Impact: 2.94, Likelihood: 1.69, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	No	No Known Exploit
	121/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: Low, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Local, EPSS: 0.0011, Social Trends: No, Days since published: 859, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 12.4, Likelihood: 0.969, Score Version: V5	Arbitrary File Write SNYK-JS-TAR-1579147	No	No Known Exploit
	121/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: Low, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Local, EPSS: 0.0011, Social Trends: No, Days since published: 859, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 12.4, Likelihood: 0.969, Score Version: V5	Arbitrary File Write SNYK-JS-TAR-1579152	No	No Known Exploit
	121/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: Low, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Local, EPSS: 0.00059, Social Trends: No, Days since published: 859, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 12.4, Likelihood: 0.968, Score Version: V5	Arbitrary File Write SNYK-JS-TAR-1579155	No	No Known Exploit
	148/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00173, Social Trends: No, Days since published: 192, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.24, Likelihood: 2.81, Score Version: V5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	No	Proof of Concept
	144/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 694, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.49, Likelihood: 1.92, Score Version: V5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	308/1000 Why? Confidentiality impact: Low, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Functional, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 2066, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 8.78, Likelihood: 3.5, Score Version: V5	Uninitialized Memory Exposure npm:base64url:20180511	Yes	Mature
	72/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00296, Social Trends: No, Days since published: 2295, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Low, Package Popularity Score: 99, Impact: 2.94, Likelihood: 2.43, Score Version: V5	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept
	266/1000 Why? Confidentiality impact: High, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00559, Social Trends: No, Days since published: 3205, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.49, Likelihood: 3.54, Score Version: V5	Authentication Bypass npm:jsonwebtoken:20150331	Yes	Proof of Concept
	204/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: None, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 2722, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: High, Package Popularity Score: 99, Impact: 12, Likelihood: 1.69, Score Version: V5	Forgeable Public/Private Tokens npm:jws:20160726	Yes	No Known Exploit
	175/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00121, Social Trends: No, Days since published: 2154, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 7.03, Likelihood: 2.48, Score Version: V5	Prototype Pollution npm:lodash:20180130	No	Proof of Concept
	224/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Functional, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00084, Social Trends: No, Days since published: 2462, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: Critical, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.24, Likelihood: 4.27, Score Version: V5	Cross-site Scripting (XSS) npm:sanitize-html:20161026	No	Mature

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: body-parser

The new version differs by 16 commits.

• 424dadd 1.19.2
• 11248a2 deps: [email protected]
• 7a088eb build: [email protected]
• ecedf31 build: [email protected]
• b6bfabd build: [email protected]
• badd6b2 build: fix code coverage aggregate upload
• 96b448a build: [email protected]
• 70560b1 build: [email protected]
• 548a06f build: [email protected]
• 3b00678 deps: [email protected]
• d5acb61 build: [email protected]
• 82c8a7c tests: add limit + inflate tests
• b356758 deps: [email protected]
• c631b58 build: [email protected]
• c81a8e2 build: [email protected]
• 3c4dcb8 build: [email protected]

See the full diff

Package name: check-dependencies

The new version differs by 61 commits.

• 03c8847 Tag 2.0.0
• 65d9ef5 Set Node.js requirement in package.json engines to >=18.3
• 4917ab0 Simplify the spawn logic
• fc04cc8 Drop support for the callback interface
• 28257dd Tweak ESLint settings
• dc16e8a Drop the bluebird devDependency
• 412337a Drop fs-extra & graceful-fs devDependencies
• 091279a Drop the findup-sync dependency
• 10ac9c5 Drop lodash.camelcase & minimist dependencies
• 35dce52 Update dependencies
• 2929ba7 Update tested Node.js versions
• 1f514eb Don't invoke `npm prune`, `npm install` is already enough
• 65107d2 Drop support for Bower & the `checkCustomPackageNames` option
• f28ba1b Avoid `git://` URLs, they're no longer supported
• 8fdc6ad Limit allowed `packageManager` values
• 9809f13 Bump word-wrap from 1.2.3 to 1.2.4 ([Snyk] Security upgrade @angular-devkit/build-angular from 0.1000.8 to 15.0.0 #58)
• e522471 Bump semver from 7.3.8 to 7.5.2 ([Snyk] Fix for 50 vulnerabilities #57)
• 031416d Bump yaml from 2.2.1 to 2.2.2 ([Snyk] Security upgrade express-jwt from 3.0.0 to 5.3.0 #56)
• dff3ab9 Build: Fix running tests on Windows
• 062005f Build: Update the GitHub Actions config
• ecf138f Build: Update dependencies
• 15c13b3 Build: Remove AppVeyor
• 89b9df0 Build: Update .gitattributes to files always use LF line endings
• db8c172 Build: Tweak GitHub Actions workflow code style

See the full diff

Package name: dottie

The new version differs by 6 commits.

• e0c8bae 2.0.4
• 7d3aee1 rudimentary __proto__ guarding
• b48e227 add github action to run tests
• 001ca40 2.0.3
• dbf26a6 Setting a null value should convert it to object ([Snyk] Security upgrade @angular-devkit/build-angular from 0.1000.8 to 0.1102.11 #37)
• b581120 added power support arch ppc64le on yml file. ([Snyk] Security upgrade sequelize from 5.22.5 to 6.29.0 #35)

See the full diff

Package name: express

The new version differs by 30 commits.

• 3d7fce5 4.17.3
• f906371 build: update example dependencies
• 6381bc6 deps: [email protected]
• a007863 deps: [email protected]
• e98f584 Revert "build: use [email protected] for Node.js < 4"
• a659137 tests: use strict mode
• a39e409 tests: prevent leaking changes to NODE_ENV
• 82de4de examples: fix path traversal in downloads example
• 12310c5 build: use nyc for test coverage
• 884657d examples: remove bitwise syntax for includes check
• 7511d08 build: use [email protected] for Node.js < 4
• 2585f20 tests: fix test missing assertion
• 9d09762 build: [email protected]
• 43cc56e build: clean up gitignore
• 1c7bbcc build: [email protected]
• 9cbbc8a deps: [email protected]
• 6fbc269 pref: remove unnecessary regexp for trust proxy
• 2bc734a deps: accepts@~1.3.8
• 89bb531 docs: fix typo in res.download jsdoc
• 744564f tests: add test for multiple ips in "trust proxy"
• da6cb0e tests: add range tests to res.download
• 00ad5be tests: add more tests for app.request & app.response
• 141914e tests: fix tests that did not bubble errors
• bd4fdfe tests: remove global dependency on should

See the full diff

Package name: glob

The new version differs by 116 commits.

• a68703e 9.0.0
• 58159ca test: cwd can be a url
• a547a9c more docs
• 42a3ac7 link to bash manual for Pattern Matching
• 474172d update readme with cwd URL support
• ad3904d update readme with posix class support
• b22fc7d [email protected]
• cdd1627 update all the things, remove unused mkdirp types
• 75c6416 Merge branch 'v9'
• fa0cd77 cwd can be a file:// url
• d03ed0a typedoc github action
• 9a5a45a put bench results in readme
• 20b2f88 docs, fix benchmark script
• 4829c88 upgrade ci actions
• 5cbacdd [email protected]
• 210310b omit symlinks on windows
• d34c8d5 full test coverage, clean up signals and remove extranous code
• 5f21b46 adding lots of tests, clean up types
• b12e6ba slashes on nodir test
• 75f74b0 more windows test slashes
• 3aa1abd more windows test affordances
• 3e68a7b some windows test affordances
• 8c2e082 feature complete and tests passing
• c3be35a correct ** vs ./** behavior

See the full diff

Package name: grunt

The new version differs by 36 commits.

• 8372e11 1.6.1
• 72f6f03 Changelog updates
• 8d4c183 Merge pull request Facing DatabaseError [SequelizeDatabaseError]: SQLITE_ERROR: no such table: Wallets , while doing npm start after npm install. Also tried changing access rights but got similar error.[🐛]  juice-shop/juice-shop#1755 from gruntjs/rm-dep
• 1c7d483 Add recursive
• 2d4fd38 Merge pull request New Crowdin updates juice-shop/juice-shop#1756 from gruntjs/downgrade-glob
• 902db7c Downgrade glob
• 494f243 Fix syntax
• b01389e remove mkdirp
• 0072510 remove dep on rimraf and mkdirp
• 0afeb5c 1.6.0
• 2805dc3 Merge pull request [🐛] Version 13.1.0 does not work on ARM-based systems (rPi, Mac M1, ...) juice-shop/juice-shop#1750 from gruntjs/dep-update-jan28
• 3f1e423 README updates
• 8fd096d Bump to 16
• 42c5f95 Update more deps
• 1d88050 Bump eslint and node version
• 82d79b8 1.5.3
• 572d79b Merge pull request #1745 from gruntjs/fix-copy-op
• 58016ff Patch up race condition in symlink copying.
• 0749e1d Merge pull request Bug/code injection juice-shop/juice-shop#1746 from JamieSlome/patch-1
• 69b7c50 Create SECURITY.md
• ac667b2 1.5.2
• 7f15fd5 Update Changelog
• b0ec6e1 Merge pull request Fix error rendering bug in 'Change Password' form juice-shop/juice-shop#1743 from gruntjs/cleanup-link
• 433f91b Clean up link handling

See the full diff

Package name: grunt-contrib-compress

The new version differs by 5 commits.

• bd9fc8e v2.0.0
• b8565a9 Update Archiver ([Snyk] Upgrade core-js from 3.22.8 to 3.39.0 #232)
• f6815bf Update deps and remove nodeunit loading ([Snyk] Upgrade @nguniversal/express-engine from 10.0.1 to 10.1.0 #231)
• b70c1d9 Update tests and dependencies ([Snyk] Upgrade rxjs from 6.6.2 to 6.6.7 #230)
• 5759edd Bump ini from 1.3.5 to 1.3.7 ([Snyk] Upgrade zone.js from 0.10.3 to 0.15.0 #228)

See the full diff

Package name: i18n

The new version differs by 93 commits.

• 02dd49d tests: use arrow function
• fa50268 eslint refactor var -> const,let
• abb05ec refactor to arrow functions
• 5855724 drop node support < 10
• 9e6559a Merge branch 'gajus-master'
• 234b94b (re-)added tests fast-printf Update jasmine to the latest version 🚀 juice-shop/juice-shop#453
• ef5675c Merge branch 'master' of git://github.com/gajus/i18n-node into gajus-master
• 2461a97 typo
• 737b67d refactored test to cover mf plurals
• 42f12d3 Merge branch 'calmonr-fix-messageformat'
• 0faeee0 Merge branch 'fix-messageformat' of https://github.com/calmonr/i18n-node into calmonr-fix-messageformat
• 6018b9f Merge tag '0.13.4'
• 9683cc6 Merge branch 'release/0.13.4' into npm
• bdce606 v0.13.4
• 4e6963f upgrade tested
• 3139881 save update
• aa60ac7 upgraded devDeps
• b6e672d Merge pull request New Crowdin translations juice-shop/juice-shop#482 from Justman10000/patch-1
• ed5c03f should fix coverage report
• 10daf65 publish coverage