[Snyk-dev] Fix for 31 vulnerabilities

[lili2311]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/contractkit/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-ASYNC-2441827	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-BROWSERSLIST-1090194	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Arbitrary File Write via Archive Extraction (Zip Slip) SNYK-JS-DECOMPRESSTAR-559095	Yes	Proof of Concept
	554/1000 Why? Has a fix available, CVSS 6.8	Cryptographic Issues SNYK-JS-ELLIPTIC-1064899	Yes	No Known Exploit
	509/1000 Why? Has a fix available, CVSS 5.9	Timing Attack SNYK-JS-ELLIPTIC-511941	Yes	No Known Exploit
	706/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.7	Cryptographic Issues SNYK-JS-ELLIPTIC-571484	Yes	Proof of Concept
	484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	641/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.4	Prototype Pollution SNYK-JS-JSON5-3182856	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-MOUT-1014544	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-MOUT-2342654	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit
	410/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	596/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.5	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	379/1000 Why? Has a fix available, CVSS 3.3	Insecure Credential Storage SNYK-JS-WEB3-174533	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @0x/subproviders

The new version differs by 250 commits.

• 8c79268 Publish
• d6e3f73 Updated CHANGELOGS & MD docs
• 8df4471 Merge pull request [Snyk] Security upgrade firebase from 6.6.2 to 10.2.0 #86 from 0xProject/feat/parse-imports-single-quotes
• 6f68b71 add ability to parse single quote imports
• 2ca3096 Merge pull request [Snyk-dev] Fix for 2 vulnerabilities #85 from 0xProject/dependabot/npm_and_yarn/json5-1.0.2
• 2d90e21 Bump json5 from 1.0.1 to 1.0.2
• 913ee4b Merge pull request [Snyk-dev] Fix for 3 vulnerabilities #84 from 0xProject/dependabot/npm_and_yarn/decode-uri-component-0.2.2
• 03c2f93 Bump decode-uri-component from 0.2.0 to 0.2.2
• 2b6d538 Merge pull request [Snyk-dev] Fix for 16 vulnerabilities #76 from 0xProject/dependabot/npm_and_yarn/change-case-4.1.2
• 1650f30 Changed functions names
• 540286e Merge pull request [Snyk-dev] Fix for 22 vulnerabilities #79 from 0xProject/dependabot/npm_and_yarn/depcheck-1.4.3
• 7696d3b Bump change-case from 3.1.0 to 4.1.2
• 1ee8ccf Bump depcheck from 0.6.11 to 1.4.3
• 5eb26b0 Merge pull request [Snyk-dev] Fix for 22 vulnerabilities #77 from 0xProject/dependabot/npm_and_yarn/sinon-15.0.0
• b444777 Merge pull request [Snyk-dev] Fix for 19 vulnerabilities #73 from 0xProject/dependabot/github_actions/actions/setup-python-4
• 4cd16d3 Merge pull request [Snyk-dev] Security upgrade web3 from 1.0.0-beta.37 to 1.2.7 #75 from 0xProject/dependabot/npm_and_yarn/loader-utils-1.4.2
• f91bf18 Bump actions/setup-python from 2 to 4
• cb2f8d5 Merge pull request [Snyk-dev] Fix for 1 vulnerabilities #74 from 0xProject/dependabot/github_actions/actions/setup-node-3
• 4f75339 Merge pull request [Snyk-dev] Fix for 14 vulnerabilities #72 from 0xProject/dependabot/github_actions/actions/checkout-3
• 2dbb546 Bump sinon from 4.5.0 to 15.0.0
• aa71b37 Bump loader-utils from 1.4.0 to 1.4.2
• 0288fbd Bump actions/setup-node from 1 to 3
• b755773 Bump actions/checkout from 2 to 3
• 8ac6417 Merge pull request [Snyk-dev] Fix for 14 vulnerabilities #71 from 0xProject/marcin/hello-dependabot

See the full diff

Package name: babel-jest

The new version differs by 250 commits.

• be16e47 v27.0.0
• 63102ec chore: update changelog for release
• 564694a docs(blog): Jest 27 blog post (Increase throughput celo-org/celo-monorepo#11131)
• b68d91b feat(pretty-print): add option `printBasicPrototype` (#11441)
• 2226742 chore: minor simplify format results error (#11432)
• 78eb25d chore: remove needless assign (#11433)
• 696c455 chore: update lockfile after publish
• e2eb9ae v27.0.0-next.11
• 3b253f8 Wait for closed resources to actually close before detecting open handles (#11429)
• 27bee72 fix: run GC before collecting open handles (#11278)
• 50451df feat: use fallback if prettier not found (#11400)
• 150dbd8 chore: update lockfile after publish
• 6f44529 v27.0.0-next.10
• cbcec7d Upgrade fsevents in jest-haste-map (#11428)
• 9633a26 feat: support reporters written in ESM (#11427)
• 59f42d8 fix: do not cache modules that throw during evaluation (Soloseng/streamline-L2-validator-test celo-org/celo-monorepo#11263)
• 57e32e9 Detect open handles with done callbacks (#11382)
• a397607 Document and test dontThrow for custom inline snapshot matchers (Soloseng/celo-minting-schedule celo-org/celo-monorepo#10995)
• 4fa3a0b feat: custom haste (feat(foundry): publish L2 state in @celo/devchain-anvil celo-org/celo-monorepo#11107)
• 2047a36 chore: bump deps (#11419)
• a4358d6 chore: run prettier on changelog
• bdd6282 Move all default values into `jest-config` (Current Celo cli cannot approve until 1.3.0.0 Governance.sol is deployed celo-org/celo-monorepo#9924)
• db643a1 Link to Jest config (forge test should be all green and exclude e2e tests that require a devchain celo-org/celo-monorepo#11106)
• b16082c Fix locale issue Figure out what to do with ASv1 related code celo-org/celo-monorepo#10014 (#11412)

See the full diff

Package name: jest

The new version differs by 250 commits.

• be16e47 v27.0.0
• 63102ec chore: update changelog for release
• 564694a docs(blog): Jest 27 blog post (Increase throughput celo-org/celo-monorepo#11131)
• b68d91b feat(pretty-print): add option `printBasicPrototype` (#11441)
• 2226742 chore: minor simplify format results error (#11432)
• 78eb25d chore: remove needless assign (#11433)
• 696c455 chore: update lockfile after publish
• e2eb9ae v27.0.0-next.11
• 3b253f8 Wait for closed resources to actually close before detecting open handles (#11429)
• 27bee72 fix: run GC before collecting open handles (#11278)
• 50451df feat: use fallback if prettier not found (#11400)
• 150dbd8 chore: update lockfile after publish
• 6f44529 v27.0.0-next.10
• cbcec7d Upgrade fsevents in jest-haste-map (#11428)
• 9633a26 feat: support reporters written in ESM (#11427)
• 59f42d8 fix: do not cache modules that throw during evaluation (Soloseng/streamline-L2-validator-test celo-org/celo-monorepo#11263)
• 57e32e9 Detect open handles with done callbacks (#11382)
• a397607 Document and test dontThrow for custom inline snapshot matchers (Soloseng/celo-minting-schedule celo-org/celo-monorepo#10995)
• 4fa3a0b feat: custom haste (feat(foundry): publish L2 state in @celo/devchain-anvil celo-org/celo-monorepo#11107)
• 2047a36 chore: bump deps (#11419)
• a4358d6 chore: run prettier on changelog
• bdd6282 Move all default values into `jest-config` (Current Celo cli cannot approve until 1.3.0.0 Governance.sol is deployed celo-org/celo-monorepo#9924)
• db643a1 Link to Jest config (forge test should be all green and exclude e2e tests that require a devchain celo-org/celo-monorepo#11106)
• b16082c Fix locale issue Figure out what to do with ASv1 related code celo-org/celo-monorepo#10014 (#11412)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Cryptographic Issues
🦉 More lessons are available in Snyk Learn