[Snyk] Fix for 21 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • node_modules/path-to-regexp/package.json
  • node_modules/path-to-regexp/.snyk

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-DOTPROP-543489	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
	541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOCHA-2863123	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOCHA-561476	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept
	704/1000 Why? Has a fix available, CVSS 9.8	Arbitrary Code Injection npm:growl:20160721	Yes	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) npm:ms:20151024	No	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: istanbul

The new version differs by 72 commits.

• 89e338f 0.4.5
• 7efe4dc update changelog, contributors
• da79378 Merge pull request [Snyk] Fix for 1 vulnerabilities #673 from popomore/swap-fileset-for-glob
• 58f4c90 swap fileset for glob
• fef889b Merge pull request [Snyk] Security upgrade xo from 0.24.0 to 0.53.0 #657 from djorg83/master
• 91bb666 log filename when file fails to parse using esprima
• 5dbd62c 0.4.4
• 5642fb4 Update changelog, contributors
• f4195bb Merge pull request [Snyk] Fix for 1 vulnerabilities #507 from Victorystick/es-modules-support
• c521035 Merge pull request [Snyk] Fix for 1 vulnerabilities #628 from inversion/use-tmp-dir
• 66fffdc Merge pull request [Snyk] Fix for 1 vulnerabilities #597 from JamesMGreene/patch-1
• dfcab10 Merge pull request [Snyk] Security upgrade xo from 0.24.0 to 0.41.0 #627 from a0viedo/patch-1
• abec3ae Merge pull request [Snyk] Security upgrade standard from 12.0.1 to 15.0.0 #625 from ChALkeR/tmpdir
• a9aaf53 tmp dir setting was being ignored in TmpStore
• 522f465 link build badge to master branch
• 0b5e80d use os.tmpdir() instead of os.tmpDir()
• 5069661 Set "medium" coverage CSS color scheme to yellow
• 0e8c350 Merge pull request [Snyk] Fix for 1 vulnerabilities #587 from clickthisnick/chore-remove-trailing-spaces
• fc3ba35 0.4.3
• b3de106 Update changelog, contributors
• bb5b6e1 Merge pull request [Snyk] Fix for 1 vulnerabilities #579 from jtangelder/fix-colors
• 0411600 return plain string when an invalid clazz is given
• a556a5e Merge pull request [Snyk] Security upgrade nyc from 11.9.0 to 15.0.0 #552 from abejfehr/patch-1
• 369ed49 Merge pull request [Snyk] Fix for 1 vulnerabilities #545 from pra85/patch-1

See the full diff

Package name: standard

The new version differs by 250 commits.

• 39a54d3 6.0.0
• 3afcc2c CHANGELOG.md for 6.0.0
• 0b71b07 eslint-plugin-promise@1.0.8
• 4b725bd lock to latest deps
• 0a9a77b eslint-config-standard@5.0.0
• 48fb60c add eslint-config-standard-jsx
• 8802ea7 run standard on ourselves
• 6fbd66d test: add --disabled flag to run disabled tests
• 910eaa5 depend on eslint-plugin-promise
• f0d1983 Remove React-specific rules (fixes [Snyk] Fix for 3 vulnerabilities #351)
• 8a095f1 readme: add one more gotcha
• fbb66c4 package.json
• 44b551a remove one more usage of `win-spawn`
• f1ad085 eslint@^2.0.0-rc.0
• 1cdd9f5 clone test: ignore git output
• 22971ce use cross-spawn-async
• 3e2001d add standard-format instructions to --format
• 60d4a87 install babel in dev-deps for test repos that need it
• 134de73 use standard-packages@3
• f149307 cleanup
• 3c86923 remove standard-format. fixes [Snyk] Fix for 5 vulnerabilities #340
• 9b3a14d test: add --quiet option
• c59a55c test: test 500+ standard packages
• cb625b4 test: add command line --help test

See the full diff

Package name: ts-node

The new version differs by 170 commits.

• d90ffba 3.2.0
• 2e03f54 fix(package): update chalk to version 2.0.0 ([Snyk] Fix for 5 vulnerabilities #372)
• c60d3a7 Export `printError` utility ([Snyk] Security upgrade requests from 1.2.3 to 2.20 #376)
• 3f0d975 Enable debug flag for method call tracking ([Snyk] Fix for 19 vulnerabilities #377)
• 394ddb8 Boolean flags inherit from env ([Snyk] Fix for 44 vulnerabilities #375)
• 82effb2 Handle possibly undefined diagnostic "start"
• 9bc3dd8 Remove `preferGlobal` from `package.json`
• 3ea7458 3.1.0
• 1cac86b Combine source map with source file output ([Snyk] Security upgrade mocha from 6.2.3 to 10.1.0 #368)
• 61f1c16 Add missing implementations to service host ([Snyk] Fix for 4 vulnerabilities #366)
• 28697b1 chore(package): update tslint-config-standard to version 6.0.0 ([Snyk] Security upgrade mocha from 7.2.0 to 10.1.0 #354)
• 125544f 3.0.6
• ae4b423 Set `cache.contents` (no version) on read request ([Snyk] Fix for 8 vulnerabilities #347)
• c18331a 3.0.5
• 5cf97b1 Add `--inspect-brk` to known flags ([Snyk] Security upgrade tap from 12.7.0 to 15.0.0 #343)
• 7dfb3e3 Pin node tests at `6.x` ([Snyk] Fix for 5 vulnerabilities #340)
• 633d537 chore(package): update chai to version 4.0.1 ([Snyk] Security upgrade standard from 7.1.2 to 11.0.0 #337)
• b751a56 Define `exports` and improve `getTypeInfo` help ([Snyk] Security upgrade tap from 0.4.13 to 1.0.8 #332)
• d018300 Update `yn` default option
• cc3bf22 Expose `_` bin file for consumers to use
• 01a6be2 3.0.4
• d5849b4 Enable caching by default for programmatic usage ([Snyk] Fix for 4 vulnerabilities #323)
• 1856f71 3.0.3
• 491ce93 Delete config options after TypeScript parse ([Snyk] Security upgrade tap from 14.11.0 to 15.0.0 #321)

See the full diff

Package name: typings

The new version differs by 23 commits.

• ce773a3 2.1.1
• 2dfd06b Avoid printing "no dependencies", print uninstall
• 657bd4a chore(package): update tslint-config-standard to version 5.0.0 ([Snyk] Security upgrade jest from 25.5.4 to 27.0.0 #788)
• 60aa87a chore(package): update tslint to version 5.0.0 ([Snyk] Security upgrade karma from 1.7.1 to 5.0.8 #786)
• 6afabc9 chore(package): update ts-node to version 3.0.0 ([Snyk] Security upgrade browserify from 9.0.3 to 12.0.0 #783)
• aba62db Update `typings-core` to latest build
• 04ff2fb Update TSLint
• 46d6ab3 fix(package): update update-notifier to version 2.0.0 ([Snyk] Security upgrade requests from 1.2.3 to 2.20 #770)
• 74a60d9 chore(package): update tslint-config-standard to version 3.0.0 ([Snyk] Fix for 1 vulnerabilities #761)
• 25309fd fix(package): update cli-truncate to version 1.0.0 ([Snyk] Fix for 1 vulnerabilities #758)
• a7e34df chore(package): update ts-node to version 2.0.0 ([Snyk] Fix for 1 vulnerabilities #752)
• afc99a2 v2.1.0
• fed00bf Update generated documentation
• 454fd1f Update bin-install.ts ([Snyk] Security upgrade nyc from 13.3.0 to 15.0.0 #744)
• ebecc13 Update README.md ([Snyk] Fix for 1 vulnerabilities #742)
• c67bd61 Update build to use native promises
• 23e4906 Document supported node versions in FAQ ([Snyk] Fix for 1 vulnerabilities #737)
• e42ec68 Update TSLint
• 68c9af7 chore(package): update tslint-config-standard to version 2.0.0 ([Snyk] Fix for 1 vulnerabilities #731)
• ffc6497 v2.0.0
• f36b453 fix(package): update typings-core to version 2.0.0 ([Snyk] Fix for 1 vulnerabilities #725)
• 4d76d44 Document effect of `NODE_ENV=production` on the `typings install` command ([Snyk] Fix for 1 vulnerabilities #721)
• af50263 chore: drop support for Node.js 0.10 ([Snyk] Security upgrade nyc from 13.3.0 to 15.0.0 #722)

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Arbitrary Code Injection