[Snyk] Fix for 17 vulnerabilities

[aliscco]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • test/fixtures/qs-package/node_modules/snyk/node_modules/request/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-1056752	Yes	Proof of Concept
	704/1000 Why? Has a fix available, CVSS 9.8	Improper Input Validation SNYK-JS-SOCKETIOPARSER-3091012	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-USERAGENT-174737	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:hoek:20180212	Yes	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:parsejson:20170908	Yes	No Known Exploit
	576/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.1	Uninitialized Memory Exposure npm:tunnel-agent:20170305	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: codecov

The new version differs by 97 commits.

• e427d90 feat(services): add azure pipelines ([Snyk] Security upgrade uglify-js from 2.4.24 to 3.14.3 #114)
• 023d204 Use small HTTP dependency ([Snyk] Security upgrade cryptography from 2.6.1 to 3.2 #110)
• 500f308 Update Readme
• 0ce3c76 v3.1.0
• 7c1f16e fix: support `.codecov.yml`/`codecov.yml` files for token ([Snyk] Security upgrade sanitize from 4.6.2 to 4.6.2 #108)
• 1fff4dc Allow custom `yaml` file. ([Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #107)
• 77d7a5e Add ESLint ([Snyk] Security upgrade cliui from 3.2.0 to 6.0.0 #93)
• 625807c Removing Makefile ([Snyk] Security upgrade axios from 0.18.0 to 0.21.3 #104)
• 94cd1c6 Change from istanbul to nyc ([Snyk] Security upgrade snyk-docker-plugin from 4.21.3 to 4.25.1 #103)
• b0b580b Update README.md
• 08ca881 v3.0.4
• 012ef08 Update dependencies ([Snyk] Security upgrade jinja2 from 2.7.2 to 2.11.3 #102)
• f954f91 Prettier ([Snyk] Security upgrade bl from 0.9.5 to 1.2.3 #101)
• 16efd18 Update README.md
• 49257a9 Update Readme
• 15cdae3 v3.0.3
• 39dc2d8 Support non-git/hg root dirs ([Snyk] Security upgrade string-width from 1.0.2 to 5.0.0 #75)
• a19efbe Updated readme
• 31926f7 v3.0.2
• 1114b03 Stop outputting upload-token in logs ([Snyk] Security upgrade boxen from 0.3.1 to 4.1.0 #97)
• e903e88 v3.0.1 ([Snyk] Security upgrade tap from 11.1.3 to 15.0.0 #96)
• 75cc0dd package: unpin request so i stop getting these vulnerability reports ([Snyk] Security upgrade tap from 11.1.3 to 15.0.0 #91)
• 4a7561e add -X s3 to disable uploading to s3 ([Snyk] Security upgrade yargs from 11.1.0 to 15.0.1 #84)
• 19facba Replace the `cd` command with the `pwd` option. ([Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5.1 #85)

See the full diff

Package name: coveralls

The new version differs by 3 commits.

• 2ed4d09 major version bump for node > 4.x
• 5ebe57f bump version
• 428780c Expand allowed dependency versions to all API compatible versions ([Snyk] Security upgrade actionpack from 4.2.5 to 4.2.11.3 #172)

See the full diff

Package name: eslint

The new version differs by 250 commits.

• ff8c4bb 4.5.0
• 480bbee Build: changelog update for 4.5.0
• decdd2c Update: allow arbitrary nodes to be ignored in `indent` (fixes #8594) (#9105)
• 79062f3 Update: fix indentation of multiline `new.target` expressions (#9116)
• d00e24f Upgrade: `chalk` to 2.x release (#9115)
• 6ef734a Docs: add missing word in processor documentation (#9106)
• a4f53ba Fix: Include files with no messages in junit results (#9093) (#9094)
• 1d6a9c0 Chore: enable eslint-plugin/test-case-shorthand-strings (#9067)
• f8add8f Fix: don't autofix with linter.verifyAndFix when `fix: false` is used (#9098)
• 77bcee4 Docs: update instructions for adding TSC members (#9086)
• bd09cd5 Update: avoid requiring NaN spaces of indentation (fixes #9083) (#9085)
• c93a853 Chore: Remove extra space in blogpost template (#9088)
• 0d9da6d 4.4.1
• 1ea9a6c Build: changelog update for 4.4.1
• ec93614 Fix: no-multi-spaces to avoid reporting consecutive tabs (fixes #9079) (#9087)
• a113cd3 4.4.0
• 181bd46 Build: changelog update for 4.4.0
• 89196fd Upgrade: Espree to 3.5.0 (#9074)
• b3e4598 Fix: clarify AST and don't use `node.start`/`node.end` (fixes #8956) (#8984)
• 62911e4 Update: Add ImportDeclaration option to indent rule (#8955)
• de75f9b Chore: enable object-curly-newline & object-property-newline.(fixes #9042) (#9068)
• 5ae8458 Docs: fix typo in object-shorthand.md (#9066)
• c3d5b39 Docs: clarify options descriptions (fixes #8875) (#9060)
• 37158c5 Docs: clarified behavior of globalReturn option (fixes #8953) (#9058)

See the full diff

Package name: karma

The new version differs by 250 commits.

• 1b48637 chore(release): 5.0.0 [skip ci]
• a5dbe89 Update issue templates (test: fix broken test after security URL change snyk/cli#3460)
• 1074f38 chore(ci): rely on karma-runnre/integration-tests for saucelabs config ([Snyk-dev] Security upgrade got from 3.3.1 to 11.8.5 snyk/cli#3462)
• 4d45cf0 chore(ci): remove more old connection security stuffs (fix: fix broken test after security URL change snyk/cli#3459)
• be76fcc chore(ci): use travis UI for sauce config (#3458)
• a04a542 chore(ci): remove secure encryption var ([Snyk] Security upgrade python from 3.8-slim to 3.9-slim snyk/cli#3457)
• 1eaf35e fix: install semantic-release as a regular dev dependency (#3455)
• 0647109 docs: Fix simple typo, overriden -> overridden (feat: add --remote-repo-url to "iac test" snyk/cli#3453)
• ec1e69a fix(server): replace optimist on yargs lib (feat: Add support for severity threshold [CFG-1991] snyk/cli#3451)
• ffad7fa refactor(launcher): use class syntax (feat: OS CLI output part I - update severity headline +test snyk/cli#3437)
• 7166ce2 fix(server): detection new MS Edge Chromium (feat: bump snyk-iac-test version snyk/cli#3440)
• b8b2ed8 fix(ci): echo travis env that gates release after_success (fix: bump snyk docker plugin version golang fixes snyk/cli#3446)
• 33a069f refactor: use native Promise instead of Bluebird (chore: cleanup iac custom rules analytics [CFG-1144] snyk/cli#3436)
• 131d154 refactor: drop safe-buffer dependency in favor of native Buffer (fix: always show path names of invalid IaC files snyk/cli#3438)
• cb1bcbf fix(server): cleanup import of the removed method (Update driftctl to v0.35 snyk/cli#3439)
• 5c334f5 fix(server): createPreprocessor was removed (Synchronizing CLI help from user-docs snyk/cli#3435)
• d7128d4 refactor(server): remove PromiseContainer class (refactor: Remove white texts from IaC test output snyk/cli#3416)
• 057d527 feat(docs): document `DEFAULT_LISTEN_ADDR` constant (chore: upgrade snyk-iac-test snyk/cli#3443)
• a673aa8 ci: drop node 8, adopt node 12 (chore: Authentication negotiation for Kerberos snyk/cli#3430)
• 9eb6436 chore(server): Convert PromiseContainer to object and remove ([Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 snyk/cli#3401)
• 0856234 chore(travis): release on node 10 success ([NEBULA-635] chore: bump code-client version snyk/cli#3428)
• 708ae13 feat(preprocessor): obey Pattern.isBinary when set (fix: docker/Dockerfile.python-3.6 to reduce vulnerabilities snyk/cli#3422)
• 00d536f chore(test): logLevel debug in proxy test (chore: snyk-iac-test checksum snyk/cli#3427)
• da9d8bd chore(docs): delete PULL_REQUEST_TEMPLATE.md

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Server-side Request Forgery (SSRF)
🦉 More lessons are available in Snyk Learn