[Snyk] Fix for 24 vulnerabilities

[baby636]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-ASYNC-2441827	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	Yes	Proof of Concept
	703/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-INI-1048974	Yes	Proof of Concept
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Validation Bypass SNYK-JS-KINDOF-537849	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit
	410/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: karma

The new version differs by 77 commits.

• 16010eb chore(release): 5.0.8 [skip ci]
• a409696 chore: remove unused `grunt lint` command (Progress of Bootstrap feels like there is a foot on the break. twbs/bootstrap#3515)
• 47f1cb2 fix(dependencies): update to latest log4js major (Opera + modal = :( twbs/bootstrap#3514)
• b60391f fix(dependencies): update and unlock socket.io dependency (Glyphicons in documentation are in no particular order twbs/bootstrap#3513)
• 4d49948 chore(release): 5.0.7 [skip ci]
• f399063 fix: detect type for URLs with query parameter or fragment identifier (less v1.3.0 doesn't work with bootstrap v2.0.3 twbs/bootstrap#3509)
• 17b50bc chore(release): 5.0.6 [skip ci]
• 0cd696f fix(dependencies): update production dependencies (well-large and well-small need to be documented twbs/bootstrap#3512)
• 7c24a03 chore: fix broken HTML markup in the changelog file (Get the text for tooltip with $.data (not $.attr) twbs/bootstrap#3507)
• fdc4f9d refactor(test): remove no debug matching option (Can't choose first option with mouse click twbs/bootstrap#3504)
• 35d57e9 chore(release): 5.0.5 [skip ci]
• e99da31 fix(cli): restore command line help contents (silly question. what is the role of {{_i}} when building docs... twbs/bootstrap#3502)
• 4f2fe56 chore: add Node 14 to the build matrix (tooltip on input flicker twbs/bootstrap#3501)
• 100b227 refactor(test): move execKarma into the World (Sticky Popovers With Click Events twbs/bootstrap#3500)
• f375884 refactor(test): reduce execKarma to a reasonable size (The tables overlap on the "Using LESS" page twbs/bootstrap#3496)
• a3d1f11 refactor(test): add common method to start server in background (Popover sporadically disappears, although still mouse over twbs/bootstrap#3495)
• e4a5126 refactor(test): write config file in its own steps (Fluid Thumbnails Broken After First Row twbs/bootstrap#3494)
• 0bd5c2b refactor(test): adjust sandbox folder location and simplify config logic (Improve JS Philosophy with design pattern twbs/bootstrap#3493)
• b788f94 refactor(test): extract proxy into a separate Given claim (bootstrap (not responsive) dosnt work on mobile (ipad, iphone) twbs/bootstrap#3492)
• 633f833 chore(release): 5.0.4 [skip ci]
• 810489d refactor(test): migrate Proxy to ES2015 (Disallow Modal Close on Backdrop Click twbs/bootstrap#3490)
• fa95fa3 fix(browser): make sure that empty results array is still recognized (Make Bootstrap Responsive with IE6/7/8 twbs/bootstrap#3486)
• 255bf67 refactor(test): migrate World to ES2015 (Bigger arrow on popover twbs/bootstrap#3489)
• be5db67 chore(test): remove usage of deprecated defineSupportCode (Popover arrow colour twbs/bootstrap#3488)

See the full diff

Package name: node-sass

The new version differs by 103 commits.

• 3b556c1 7.0.2
• c716359 Bump sass-graph@^4.0.1 (Tooltips not appearing correctly on inline labels twbs/bootstrap#3292)
• 24741b3 docs(readme): fix docpad plugin link
• 1523330 feat: Drop Node 12
• 365d357 update https://registry.npm.taobao.org to https://registry.npmmirror.com
• 1456114 build(deps): bump actions/upload-artifact from 2 to 3
• b465b69 chore: bump GitHub Actions to Windows 2019 (Responsive styles broken on iOS? twbs/bootstrap#3254)
• e6194b1 build(deps): bump make-fetch-happen from 9.1.0 to 10.0.4
• 4edf594 build(deps): bump node-gyp from 8.4.1 to 9.0.0
• 29e2344 build(deps): bump actions/checkout from 2 to 3
• 85b0d22 build(deps): bump actions/setup-node from 2 to 3
• 3bb51da Use make-fetch-happen instead of request ([2.0.3] Modified values twbs/bootstrap#3193)
• adc2f8b build(deps): bump true-case-path from 1.0.3 to 2.2.1 (scrollspy offset issue with collapsable content twbs/bootstrap#3000)
• 77d12f0 chore: disable Apline for Node 16/17 builds
• 308d533 ci: use Python 3 for Node 12
• c818907 ci: unpin actions/setup-node to v2
• 99242d7 7.0.1
• 77049d1 build(deps): bump sass-graph from 2.2.5 to 4.0.0 (Add support for contrast detection twbs/bootstrap#3224)
• c929f25 build(deps): bump node-gyp from 7.1.2 to 8.4.1 (Nested collapse items interfere with one another twbs/bootstrap#3209)
• 918dcb3 Lint fix
• 0a21792 Set rejectUnauthorized to true by default (Audio/Video issue with HTML5 in a Modal twbs/bootstrap#3149)
• e80d4af chore: Drop EOL Node 15 (.carousel-control hidden by default twbs/bootstrap#3122)
• d753397 feat: Add Node 17 support (responsive.css page change breaks https twbs/bootstrap#3195)
• dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0

See the full diff

Package name: postcss-cli

The new version differs by 15 commits.

• 745ad2c 7.0.0
• cf6ea09 Update eslint config
• ea1cec4 Update eslint-config-problems to version 3.1.0 (Sticky footer twbs/bootstrap#306)
• 1519430 Update globby to version 10.0.1 (Icon Buttons twbs/bootstrap#303)
• 5b47456 Update eslint to version 6.8.0 (thead tbody first/lastitem border radius leads to unnice radius in first tbody row twbs/bootstrap#305)
• e241672 Update nyc to version 15.0.0 (tabs/pills on left side, right side, or bottom of div (not just top) twbs/bootstrap#297)
• 4a87ff1 Update chalk to version 3.0.0 (bootstrap-1.3.0.zip wrong css file twbs/bootstrap#294)
• e666505 Update prettier to version 1.19.1 (center pagination? twbs/bootstrap#304)
• 0d3591a Update ava to version 2.4.0 (Dropdown Menu doesn't work with Form inside twbs/bootstrap#302)
• cb9f451 Update fs-extra to version 8.1.0 (Fixed typo twbs/bootstrap#301)
• 4f68a46 Update chokidar to version 3.3.0 (add margin between consecutive fields with error twbs/bootstrap#300)
• 5c22ddb Update yargs to version 15.0.2 (modal "shown" event fires before transitions finish. twbs/bootstrap#298)
• 79eb0ac Update get-stdin to version 7.0.0 (whitespace: replace some TAB entries by spaces in mixins.less twbs/bootstrap#273)
• 71384c6 Update Travis config; remove AppVeyor
• 6b92df3 BREAKING: Drop Node 6 & 8; test on new Node versions

See the full diff

Package name: stylelint

The new version differs by 143 commits.

• 04af9e4 13.0.0
• 704f6a2 Prepare 13.0.0
• 50ba8a9 Reorder changelog
• 1666bba Update devDependencies (Fix typo in readme. twbs/bootstrap#4542)
• 062d298 Reindent nodejs.yml (Handle locally-installing node packages twbs/bootstrap#4541)
• a24e44a Fix atypical rule README structure (Collapse not working properly in IE9 twbs/bootstrap#4537)
• 616ad71 Bump husky from 4.0.3 to 4.0.6 (Table with vertical scrolling? twbs/bootstrap#4536)
• 5e58ee7 Bump globby from 10.0.2 to 11.0.0 (Append alignment problem twbs/bootstrap#4528)
• eaee6a4 Refactor CLI options definition (Incongruous Documentation twbs/bootstrap#4530)
• 6a2ffbd Fix plugin path
• 644b713 Fix Windows path problem
• 1005cbd Add info about invalid syntax in FAQ (Ctrl + click on open dropdown doesn't open a new tab twbs/bootstrap#4535)
• 18b1f99 Fix help text indentation (Cloned Carousel unresponsive twbs/bootstrap#4531)
• d3c4a9f Update CHANGELOG.md
• 32f67e7 Update CHANGELOG.md
• 04ec577 Bump globby from 10.0.1 to 11.0.0
• d9dbce2 Process multiple spaces in media-feature-parentheses-space-inside (collapsible accordian broken (visually) in IE9  twbs/bootstrap#4513)
• 1dc203e Regenerate package-lock.json (margin-bottom of <p> (paragraphs) stated was old value twbs/bootstrap#4517)
• 36bf292 Bump husky from 3.1.0 to 4.0.3 (Improve submenu behavior twbs/bootstrap#4527)
• f5529d5 Bump @ types/micromatch from 3.1.1 to 4.0.0 (2.1 regression: forms: thin line drawn over radio buttons with error twbs/bootstrap#4526)
• a254fd2 Bump got from 10.2.0 to 10.2.1 (Missing "Using Less with Bootstrap" page twbs/bootstrap#4525)
• f2e9f02 Bump remark-validate-links from 9.0.1 to 9.1.0 (Some bugs twbs/bootstrap#4524)
• 74d5233 Remove unneeded `@ types/meow` package (icons turn white on active nav tabs twbs/bootstrap#4523)
• cef0b95 Update CHANGELOG.md

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Validation Bypass
🦉 More lessons are available in Snyk Learn