[Snyk] Fix for 18 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • test/fixtures/qs-package/node_modules/got/node_modules/readable-stream/package.json
  • test/fixtures/qs-package/node_modules/got/node_modules/readable-stream/.snyk

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: nyc

The new version differs by 250 commits.

• e21721a chore(release): 14.0.0
• 8cf8a89 docs: update issue template [skip ci] ([Snyk] Fix for 20 vulnerabilities #1008)
• d7a9d6a chore: Update package-lock.json
• 189bae8 chore: Update dependencies for 14.0.0-rc.1
• 2eb13c6 feat: instrument `--complete-copy` implementation ([Snyk] Security upgrade lab from 5.18.1 to 14.3.4 #1056)
• c88a852 docs: `nyc instrument` and `--exclude-node-modules` ([Snyk] Security upgrade tape from 2.14.1 to 4.0.0 #1039)
• c213469 feat: always build the processinfo temp dir ([Snyk] Fix for 18 vulnerabilities #1061)
• e597c46 feat: Add support for --exclude-node-modules to subcommands. ([Snyk] Fix for 25 vulnerabilities #1053)
• 8dcf180 feat: add processinfo index, add externalId ([Snyk] Fix for 14 vulnerabilities #1055)
• 32f75b0 fix: set processinfo pid/ppid to actual numbers ([Snyk] Security upgrade tap from 2.3.4 to 14.6.8 #1057)
• 16d4315 chore: Stop excluding `bin` from coverage results. ([Snyk] Fix for 26 vulnerabilities #1060)
• b909575 fix: Use a single instance of nyc for all actions of main command. ([Snyk] Security upgrade standard from 6.0.8 to 11.0.0 #1059)
• 997ed29 chore: Remove arrify dependency. ([Snyk] Security upgrade uglify-js from 2.3.6 to 3.14.3 #1058)
• 68d6333 docs: move setup docs out of the readme [skip ci] ([Snyk] Security upgrade django from 1.6.1 to 3.2.14 #1052)
• 8da097e feat: add `include` and `exclude` options to instrument command ([Snyk] Fix for 1 vulnerabilities #1007)
• 31817de chore: Update dependencies ([Snyk] Security upgrade tap from 2.3.4 to 14.6.8 #1050)
• 18e04ba fix: make --all work for transpiled code ([Snyk] Fix for 6 vulnerabilities #1047)
• b7e16cd feat: Support turning off node_modules default exclude via flag ([Snyk] Security upgrade django from 1.6.1 to 1.11.29 #912)
• 3eb0e37 docs: A bunch of docs fix-ups ([Snyk] Security upgrade faucet from 0.0.1 to 0.0.2 #1038)
• 5c1eb38 test(instrument): should return unmodified source if no transform found ([Snyk] Security upgrade tape from 2.12.3 to 4.0.0 #1036)
• 1f6c3d4 docs: project root directory and `--cwd` doc ([Snyk] Fix for 13 vulnerabilities #1032)
• 051d95a fix: Add `cwd` option to instrument command ([Snyk] Fix for 9 vulnerabilities #1024)
• 91e02c6 chore: A few code cleanups ([Snyk] Security upgrade nodeunit from 0.9.5 to 0.11.3 #1033)
• 2867538 feat: Rename `plugins` option to `parser-plugins`. ([Snyk] Fix for 17 vulnerabilities #1031)

See the full diff

Package name: tap

The new version differs by 150 commits.

• 963943e v1.0.8
• 2a76bb6 use glob 5
• 247dadc Remove deps that are no longer used
• 7492ec4 handle slow ok.js test run in test/runner.js
• 9754119 v1.0.7
• 3056f4d use upstream js-yaml
• c38c7e8 v1.0.6
• a2720d6 isc license
• 30ca273 v1.0.5
• 495e05c Don't lose - arg from glob
• 1533ea1 stack: don't read indexOf if file is unset
• 22680b0 Fail unfinished tests
• 7d073be v1.0.4
• ead7bf4 Exclude .tap files from publish
• 418a7dc v1.0.3
• ff9af3d run: perform globbing on path arguments
• a970809 add todo: more mocha globals when you tap.mochaGlobals()
• b8ba7bb v1.0.2
• 7680b79 empty tests are not failures now (they're skips)
• b295aee spawn: empty tests that exit non-zero are failures
• e50a299 typo in mochalike test
• 7b0423c verify that top-level tests can be defined asynchronously
• 75b5b6c v1.0.1
• f477c87 spawn: emit a 'skip' for tests that do nothing

See the full diff

Package name: zuul

The new version differs by 40 commits.

• 56e2128 3.12.0
• 79693fa Merge pull request [Snyk] Security upgrade django from 1.6.1 to 1.6.3 #323 from vweevers/custom-loopback-hostname
• 060d991 Disambiguate with other projects named zuul ([Snyk] Fix for 1 vulnerabilities #324)
• 4c5d666 refactor: function for local url building
• 542b122 don't instantiate tunnel if opt.tunnel is false
• e8a1965 test: support custom loopback hostname
• 4d4abe3 support custom loopback hostname
• 8f8adf0 Merge pull request [Snyk] Security upgrade tap from 11.1.3 to 12.6.2 #317 from defunctzombie/vvo-patch-1
• a0b10d0 Merge pull request [Snyk] Fix for 1 vulnerabilities #318 from Haroenv/patch-1
• c7ac9c7 nit(package.json): update github repository
• cd036ed Stop using http tarball for stacktrace-js
• 0c91153 upgrade phantomjs to 2.1.13
• 54c7556 Add --no-instrument option. ([Snyk] Security upgrade tap from 5.8.0 to 9.0.0 #310)
• f07d842 Merge pull request [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5.2 #308 from mcollina/master
• 7b3d032 Bumped yamljs dependency to v0.2.8.
• f021cf3 3.11.1
• 519c66a Merge pull request [Snyk] Security upgrade sinatra from 1.3.2 to 2.2.0 #306 from defunctzombie/fix-305
• 0b8d4c2 Support new 'electron' package (electron-prebuilt is deprecated)
• 326ddce add .npmrc with save-exact = true
• 2e34c5d v3.11.0
• 482238e update history
• f7d185d saucebrowser: use an environment variable to specify the appium version ([Snyk] Security upgrade Newtonsoft.Json from 10.0.3 to 13.0.1 #300)
• 05133bc v3.10.3
• b775921 Merge pull request [Snyk] Security upgrade python from 3.6-slim to 3.8-slim #297 from JamesKyburz/electron-1.2.0-fix

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:hawk:20160119	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Timing Attack npm:http-signature:20150122	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) npm:ms:20151024	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:negotiator:20160616	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Denial of Service (DoS) npm:qs:20140806-1	No Known Exploit
	469/1000 Why? Has a fix available, CVSS 5.1	Remote Memory Exposure npm:request:20160119	No Known Exploit
	576/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.1	Uninitialized Memory Exposure npm:tunnel-agent:20170305	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) npm:uglify-js:20151024	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Improper minification of non-boolean comparisons
🦉 More lessons are available in Snyk Learn