[Snyk] Fix for 8 vulnerabilities

[baby636]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	706/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.7	Remote Memory Exposure SNYK-JS-BL-608877	Yes	Proof of Concept
	726/1000 Why? Recently disclosed, Has a fix available, CVSS 8.8	Use After Free SNYK-JS-ELECTRON-6226524	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	No	Proof of Concept
	521/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4	Information Exposure SNYK-JS-NANOID-2332193	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: electron-notarize

The new version differs by 42 commits.

• 595e331 chore: move repo from electron-notarize to electron/notarize
• 2e5e6fd build: migrate from master to main
• cb7a7f1 docs: Improve macOS entitlements reference for improved security ([Snyk] Security upgrade electron from 8.2.5 to 26.6.6 #105)
• bed9eb9 ci: clean up ci config ([Snyk] Security upgrade electron from 8.2.5 to 29.3.0 #116)
• 73ad018 fix: add spawn error handling, fixes [Snyk] Fix for 1 vulnerabilities #77
• f8b7282 build(deps): bump tmpl from 1.0.4 to 1.0.5 ([Snyk] Security upgrade electron from 8.2.5 to 22.3.5 #89)
• 8c3d695 fix: make notary tool file extension agnostic ([Snyk] Security upgrade electron from 8.2.5 to 22.3.23 #95)
• 7847e27 feat: make --keychain option optional ([Snyk] Fix for 1 vulnerabilities #94)
• 204e0cb fix: export NotarizeOptions
• a6565cd build(deps): bump tar from 4.4.15 to 4.4.19
• a11346f build(deps): bump path-parse from 1.0.6 to 1.0.7 ([Snyk] Security upgrade electron from 8.2.5 to 12.2.0 #85)
• 7c15b42 feat: add support for the new Xcode 13 notarytool ([Snyk] Security upgrade electron from 8.2.5 to 10.4.1 #82)
• bc286ff Merge pull request [Snyk] Security upgrade electron from 8.2.5 to 10.4.1 #81 from electron/dependabot/npm_and_yarn/tar-4.4.15
• 29afa69 build(deps): bump tar from 4.4.13 to 4.4.15
• 2c7274f fix: use ditto instead of zip ([Snyk] Security upgrade electron from 8.2.5 to 17.4.9 #57)
• e7ea248 Merge pull request [Snyk] Security upgrade electron from 8.2.5 to 19.1.5 #76 from electron/dependabot/npm_and_yarn/normalize-url-4.5.1
• 218c6f6 Merge pull request [Snyk] Security upgrade electron from 8.2.5 to 20.3.9 #79 from electron/dependabot/npm_and_yarn/acorn-6.4.2
• e4b84c7 build(deps): bump acorn from 6.4.0 to 6.4.2
• df15819 Merge pull request [Snyk] Security upgrade electron from 8.2.5 to 20.3.10 #78 from electron/dependabot/npm_and_yarn/glob-parent-5.1.2
• 19bc6c2 build(deps): bump glob-parent from 5.1.0 to 5.1.2
• baec84d build(deps): bump normalize-url from 4.5.0 to 4.5.1
• ace1375 Merge pull request [Snyk] Security upgrade electron from 8.2.5 to 19.1.7 #74 from electron/dependabot/npm_and_yarn/ws-7.4.6
• cc0de33 build(deps): bump ws from 7.2.1 to 7.4.6
• b188274 build(deps): bump hosted-git-info from 2.8.8 to 2.8.9

See the full diff

Package name: go-ipfs-dep

The new version differs by 10 commits.

• 93a5e24 0.7.0
• 20bcda7 0.7.0-rc2
• cc6813c 0.7.0-rc1
• 8decf90 docs: add deprecation warning to top of readme ([Snyk] Security upgrade electron from 8.2.5 to 16.2.5 #46)
• 1d00358 chore: docs say lowercase
• e1572fa chore: change how value is interpreted
• d423d2a chore: restore cron
• 06d855e chore: neutral exit code has been removed in later gh actions
• 1ac361a chore: remove extra space
• 480cee5 chore: bring back cron

See the full diff

Package name: ipfs-http-client

The new version differs by 250 commits.

• bf1bc8b chore: release master (#4364)
• 7b79c1b fix: add deprecation notice to readmes (#4362)
• 410725b chore: disable dependabot.yml (#4363)
• b64d4af docs: update README.md (#4307)
• 3bcabe3 chore: fix link to ci results (#4299)
• ab02e8f docs: update readmes to fix ci badges (#4296)
• c5e76b7 update-ipfs-http-client (#4293)
• 6eeb1be deps(dev): update interop, ipfsd-ctl and kubo-rpc-client (#4294)
• 6e94067 chore: release master (#4252)
• d1c3abb deps: update libp2p to 0.42.x (#4288)
• 0cfcaf6 fix: allow reading rawLeaves in MFS (#4282)
• fa578ba fix: disallow publishing pubsub messages to zero peers (#4286)
• 789ee58 deps: update dag-jose to 4.0.0 (#4289)
• 4b4c124 deps: update ipfs-utils for node 18 compatibility (#4287)
• 5f73eca chore: do not double-build interface tests
• 1916ca8 chore: interface tests should run after build
• 115a405 fix: fix publish step
• 6d90cbf fix: use aegir to publish RCs (#4284)
• 2a6fede fix: update lerna config for rc publishing (#4283)
• e85e5b6 deps: update @ chainsafe/libp2p-gossipsub to 6.0.0 (#4280)
• 563806f fix: restore lerna for preleases (#4281)
• 521c84a fix!: update multiformats to v11.x.x and related depenendcies (#4277)
• 6be5906 fix: mfs blob import for files larger than 262144b (#4251)
• b722041 docs: DisableNatPortMap should be true to disable port mapping (#4244)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Use After Free
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution