[Snyk] Fix for 16 vulnerabilities

[Exnadella]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/cli/package.json
  • packages/cli/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	Yes	Proof of Concept
	703/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-INI-1048974	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Validation Bypass SNYK-JS-KINDOF-537849	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit
	410/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: chokidar

The new version differs by 216 commits.

• 7b8e02a Release 3.0.0.
• e7bfe2f Move stuff.
• df7f22e Remove changelog from npm, move to hidden dir.
• 3df7692 Improve naming.
• 6e94ca2 Clean-up.
• 2de2f9c test: Add testing of Node.js v12 in Travis pipeline. (Prepare web-component-tester@6.9.2 and polymer-cli@1.9.4 release Polymer/tools#833)
• 9e0965a Fix Windows tests in Travis CI (Update gulpfile.js Polymer/tools#832)
• c95a98f Update stuff.
• 187ff2b test: Trying to fix blinked tests for Travis CI. ([modulizer] update iron-component-page dependency to 4.0.0 Polymer/tools#825)
• db99076 fix(Windows): Add converting from windows to unix path for all ignored paths. (Update npm-ignore rules for all npm published packages Polymer/tools#824)
• 41f8782 fix(FsEvents): Remove situation with NaN depth. (Fix modulizer tests to expect PolymerElement Polymer/tools#823)
• 7cf3f7e Update readdirp to stable.
• 0927a62 Bump packages.
• 11cd857 Update nyc.
• 99c14d7 Uncomment fsevents.
• cf330a5 Update fsevents.
• 0e4fca5 Fix deps.
• 9c575d4 Fix Windows version (HTMLSplitter doesn't split script tags with the string "</script>" Polymer/tools#821)
• 3323d59 fix(Linux): Make event loop hack for keep testing valid. (Prepare 1.9.3 cli + upstream deps release Polymer/tools#820)
• 06214c5 Update to latest readdirp.
• 793639f Rename osxfswatch.
• 078bc2d Refactor and fix freaking tests.
• 2b9bb41 Try node 11.
• 3fe3d4e Test travis.

See the full diff

Package name: globby

The new version differs by 33 commits.

• 878ef6e 10.0.0
• 3706920 Upgrade `fast-glob` package to v3 ([Snyk] Security upgrade rimraf from 2.6.3 to 4.3.1 #126)
• 8aadde8 Add `globby.stream` ([Snyk] Upgrade @types/fs-extra from 5.1.0 to 11.0.4 #113)
• 2dd76d2 Remove `**/bower_components/**` as a default ignore pattern
• 9f781ce Require Node.js 8
• 04d51bf Upgrade `ignore` package ([Snyk] Security upgrade gulp-typescript from 3.2.4 to 4.0.0 #120)
• 2b61484 Readme tweaks
• ff3e1f9 Tidelift tasks
• 31f18ae Create funding.yml
• 33ca01c Fix using the `gitignore` and `stats` options together ([Snyk] Fix for 2 vulnerabilities #121)
• c737820 Minor TypeScript definition improvements
• 82db101 Add Node.js 12 to testing ([Snyk] Upgrade @types/glob from 5.0.36 to 8.1.0 #117)
• 766b728 9.2.0
• dc0a49c Refactor TypeScript definition to CommonJS compatible export ([Snyk] Upgrade fs-extra from 6.0.1 to 11.2.0 #115)
• 89cee24 9.1.0
• 59f4b48 Add check to ensure `cwd` is a directory ([Snyk] Upgrade @babel/types from 7.5.0 to 7.24.0 #110)
• 9a9cf1e Add TypeScript definition ([Snyk] Upgrade minimatch from 3.0.4 to 9.0.4 #111)
• eb26c7e Meta tweaks
• d77a623 Add failing test for [Snyk] Upgrade command-line-usage from 5.0.5 to 7.0.1 #105 ([Snyk] Upgrade @types/compression from 0.0.33 to 1.7.5 #108)
• 2294618 Deduplicate identical file patterns ([Snyk] Upgrade @types/express from 4.17.0 to 4.17.21 #102)
• ba9c267 Add failing test for [Snyk] Fix for 2 vulnerabilities #97 ([Snyk] Upgrade http-proxy-middleware from 0.17.4 to 3.0.0 #100)
• 71b9c58 9.0.0
• 39ad0d9 Update dependencies
• d804228 Fix compatibility with latest `dir-glob` release ([Snyk] Upgrade lru-cache from 4.1.5 to 10.2.0 #99)

See the full diff

Package name: yeoman-generator

The new version differs by 250 commits.

• aad5fac 5.0.0
• 4f4a802 Add transform to expected priority.
• 57d240c Remove only from test.
• 812751f Lint fix
• 33d050f Implement getFeatures for singleton support.
• 99ac2c5 Add transform priority.
• 5136342 Bump peter-evans/create-pull-request from v3.8.0 to v3.8.2 (Delete Polymer/tools#1278)
• fa408bd Bump actions/stale from v3.0.15 to v3.0.16 (Update to sw-precache ^5.0.0 for Chrome 59 and latest Firefox support Polymer/tools#1275)
• d7103f3 Drop reference from yeoman-test repository
• b36f294 Bump yeoman-environment to 3.0.0-rc.1
• ee0d1ad Hide shared options and drop support for kebab case options.
• 310f72d Fix spawn destinationRoot.
• 8f4afe9 Switch composeWith to use environment.
• e9d0a15 Remove support for chainning at composeWith.
• c2245e1 Switch from node 10 to 12 at Travis.
• 5be7b07 5.0.0-rc.0
• 8a448b4 Bump yeoman-environment to 3.0.0-rc.0
• 6d6c4b0 Changes to queueTransformStream
• 632d60d Add option to skip parsing options.
• 7050e53 Pass destinationRoot to spawn-command by default.
• 097cd20 Implement package-json mixin.
• 52c90a2 Add merge support to Storage.
• f4336d9 5.0.0-beta.1
• 1952724 Change version to 5.0.0-beta.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Validation Bypass
🦉 More lessons are available in Snyk Learn