[Snyk] Fix for 5 vulnerabilities

[Exnadella]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/cli/package.json
  • packages/cli/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASHSET-1320032	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: chokidar

The new version differs by 216 commits.

• 7b8e02a Release 3.0.0.
• e7bfe2f Move stuff.
• df7f22e Remove changelog from npm, move to hidden dir.
• 3df7692 Improve naming.
• 6e94ca2 Clean-up.
• 2de2f9c test: Add testing of Node.js v12 in Travis pipeline. (Prepare web-component-tester@6.9.2 and polymer-cli@1.9.4 release Polymer/tools#833)
• 9e0965a Fix Windows tests in Travis CI (Update gulpfile.js Polymer/tools#832)
• c95a98f Update stuff.
• 187ff2b test: Trying to fix blinked tests for Travis CI. ([modulizer] update iron-component-page dependency to 4.0.0 Polymer/tools#825)
• db99076 fix(Windows): Add converting from windows to unix path for all ignored paths. (Update npm-ignore rules for all npm published packages Polymer/tools#824)
• 41f8782 fix(FsEvents): Remove situation with NaN depth. (Fix modulizer tests to expect PolymerElement Polymer/tools#823)
• 7cf3f7e Update readdirp to stable.
• 0927a62 Bump packages.
• 11cd857 Update nyc.
• 99c14d7 Uncomment fsevents.
• cf330a5 Update fsevents.
• 0e4fca5 Fix deps.
• 9c575d4 Fix Windows version (HTMLSplitter doesn't split script tags with the string "</script>" Polymer/tools#821)
• 3323d59 fix(Linux): Make event loop hack for keep testing valid. (Prepare 1.9.3 cli + upstream deps release Polymer/tools#820)
• 06214c5 Update to latest readdirp.
• 793639f Rename osxfswatch.
• 078bc2d Refactor and fix freaking tests.
• 2b9bb41 Try node 11.
• 3fe3d4e Test travis.

See the full diff

Package name: findup-sync

The new version differs by 11 commits.

• 25a89c7 Release: 2.0.0
• 1b1852a Docs: Update release history
• 8971e8f Scaffold: Simplify package.json
• 42b711c Build: Test on node 8
• b40bb46 Build: Remove grunt
• 328cf9f Build: Add AppVeyor configuration
• d103167 Upgrade: Update is-glob, micromatch, detect-file & resolve-dir
• 93b114b Upgrade: Update devDependencies
• 19742de Breaking: Drop node 0.8 support
• c19ee36 1.0.0
• 0b1e565 Update release history

See the full diff

Package name: globby

The new version differs by 33 commits.

• 878ef6e 10.0.0
• 3706920 Upgrade `fast-glob` package to v3 ([Snyk] Security upgrade rimraf from 2.6.3 to 4.3.1 #126)
• 8aadde8 Add `globby.stream` ([Snyk] Upgrade @types/fs-extra from 5.1.0 to 11.0.4 #113)
• 2dd76d2 Remove `**/bower_components/**` as a default ignore pattern
• 9f781ce Require Node.js 8
• 04d51bf Upgrade `ignore` package ([Snyk] Security upgrade gulp-typescript from 3.2.4 to 4.0.0 #120)
• 2b61484 Readme tweaks
• ff3e1f9 Tidelift tasks
• 31f18ae Create funding.yml
• 33ca01c Fix using the `gitignore` and `stats` options together ([Snyk] Fix for 2 vulnerabilities #121)
• c737820 Minor TypeScript definition improvements
• 82db101 Add Node.js 12 to testing ([Snyk] Upgrade @types/glob from 5.0.36 to 8.1.0 #117)
• 766b728 9.2.0
• dc0a49c Refactor TypeScript definition to CommonJS compatible export ([Snyk] Upgrade fs-extra from 6.0.1 to 11.2.0 #115)
• 89cee24 9.1.0
• 59f4b48 Add check to ensure `cwd` is a directory ([Snyk] Upgrade @babel/types from 7.5.0 to 7.24.0 #110)
• 9a9cf1e Add TypeScript definition ([Snyk] Upgrade minimatch from 3.0.4 to 9.0.4 #111)
• eb26c7e Meta tweaks
• d77a623 Add failing test for [Snyk] Upgrade command-line-usage from 5.0.5 to 7.0.1 #105 ([Snyk] Upgrade @types/compression from 0.0.33 to 1.7.5 #108)
• 2294618 Deduplicate identical file patterns ([Snyk] Upgrade @types/express from 4.17.0 to 4.17.21 #102)
• ba9c267 Add failing test for [Snyk] Fix for 2 vulnerabilities #97 ([Snyk] Upgrade http-proxy-middleware from 0.17.4 to 3.0.0 #100)
• 71b9c58 9.0.0
• 39ad0d9 Update dependencies
• d804228 Fix compatibility with latest `dir-glob` release ([Snyk] Upgrade lru-cache from 4.1.5 to 10.2.0 #99)

See the full diff

Package name: update-notifier

The new version differs by 18 commits.

• 492c21e 2.3.0
• 3eaa793 Force bump `boxen` dependency
• 70b8248 package.json indentation
• 97d0b97 Add is-installed-globally for auto-detection ([Snyk] Upgrade vscode-uri from 1.0.6 to 3.0.8 #114)
• 6008ccf Meta tweaks
• 6f2b074 Move to AVA for testing ([Snyk] Fix for 2 vulnerabilities #121)
• 4bfb8b4 Update chalk to 2.0.1 ([Snyk] Upgrade @types/glob from 5.0.36 to 8.1.0 #117)
• adf7af0 2.2.0
• d032e12 Bail if notify is disabled ([Snyk] Upgrade @babel/types from 7.5.0 to 7.24.0 #110)
• 1055d57 Meta tweaks
• e2f9233 Add npm as »reference« ([Snyk] Upgrade @types/compression from 0.0.33 to 1.7.5 #108)
• 86ca238 2.1.0
• 607d3c9 Add option to exclude `-g` argument from default update message ([Snyk] Upgrade command-line-usage from 5.0.5 to 7.0.1 #105)
• d295cf3 2.0.0
• fda96b6 ES2015ify
• ac47d69 Improve readme
• f1de1bf Update dependencies
• 01fcd25 Bump minimum supported `node` version to `node@4`. ([Snyk] Upgrade @types/express from 4.17.0 to 4.17.21 #102)

See the full diff

Package name: validate-element-name

The new version differs by 4 commits.

• e8d2414 3.0.0
• 13780cc Meta tweaks
• 1d01ee2 Require Node.js 12 and move to ESM ([Snyk] Upgrade @types/rimraf from 2.0.2 to 3.0.0 #11)
• e5c0a4f Move to GitHub Actions ([Snyk] Upgrade clang-format from 1.2.4 to 1.5.0 #10)

See the full diff

Package name: yeoman-environment

The new version differs by 16 commits.

• 21e9baa 2.0.4
• aca8527 Bump versions + Drop gulp
• 0ea7e54 2.0.3
• 73637a6 Support for multi-word command line arguments ([Snyk] Fix for 1 vulnerabilities #88)
• 3922881 2.0.2
• 3dd2286 Add support for yarn linked generators
• 5092d40 2.0.1
• e924a99 search default system paths last ([Snyk] Security upgrade selenium-standalone from 6.16.0 to 6.21.0 #85)
• 8efc379 2.0.0
• cc008e5 Fix for issue Suggestion for installing scoped generator is wrong yeoman/yo#518 ([Snyk] Security upgrade socket.io from 2.2.0 to 3.0.5 #81)
• 414b8c0 Bump dependencies
• 1a478c5 Convert to ES2015 classes
• 0a43ad1 ES2015ify
• 90b1628 chore(package): update yeoman-assert to version 3.0.0 ([Snyk] Security upgrade glob from 7.1.4 to 9.0.0 #78)
• e9787d4 Update dependencies to enable Greenkeeper 🌴 ([Snyk] Security upgrade vinyl-fs from 2.4.4 to 4.0.0 #77)
• 11ac9d2 Bump minimum supported `node` version to `node@4`. ([Snyk] Security upgrade gulp-eslint from 4.0.2 to 6.0.0 #76)

See the full diff

Package name: yeoman-generator

The new version differs by 250 commits.

• aad5fac 5.0.0
• 4f4a802 Add transform to expected priority.
• 57d240c Remove only from test.
• 812751f Lint fix
• 33d050f Implement getFeatures for singleton support.
• 99ac2c5 Add transform priority.
• 5136342 Bump peter-evans/create-pull-request from v3.8.0 to v3.8.2 (Delete Polymer/tools#1278)
• fa408bd Bump actions/stale from v3.0.15 to v3.0.16 (Update to sw-precache ^5.0.0 for Chrome 59 and latest Firefox support Polymer/tools#1275)
• d7103f3 Drop reference from yeoman-test repository
• b36f294 Bump yeoman-environment to 3.0.0-rc.1
• ee0d1ad Hide shared options and drop support for kebab case options.
• 310f72d Fix spawn destinationRoot.
• 8f4afe9 Switch composeWith to use environment.
• e9d0a15 Remove support for chainning at composeWith.
• c2245e1 Switch from node 10 to 12 at Travis.
• 5be7b07 5.0.0-rc.0
• 8a448b4 Bump yeoman-environment to 3.0.0-rc.0
• 6d6c4b0 Changes to queueTransformStream
• 632d60d Add option to skip parsing options.
• 7050e53 Pass destinationRoot to spawn-command by default.
• 097cd20 Implement package-json mixin.
• 52c90a2 Add merge support to Storage.
• f4336d9 5.0.0-beta.1
• 1952724 Change version to 5.0.0-beta.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution