[Snyk] Upgrade npm from 6.2.0 to 6.14.5 #259

snyk-bot · 2020-07-08T04:12:05Z

Snyk has created this PR to upgrade npm from 6.2.0 to 6.14.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 53 versions ahead of your current version.
The recommended version was released 2 months ago, on 2020-05-04.

The recommended version fixes:

Severity	Issue	Exploit Maturity
	Arbitrary File Overwrite SNYK-JS-TAR-174125	No Known Exploit
	Arbitrary File Write SNYK-JS-NPM-537606	Proof of Concept
	Arbitrary File Overwrite SNYK-JS-NPM-537603	Proof of Concept
	Arbitrary File Overwrite SNYK-JS-FSTREAM-174725	No Known Exploit
	Arbitrary File Write SNYK-JS-BINLINKS-537610	Proof of Concept
	Arbitrary File Overwrite SNYK-JS-BINLINKS-537608	Proof of Concept
	Denial of Service (DoS) npm:mem:20180117	No Known Exploit
	Man-in-the-Middle (MitM) SNYK-JS-HTTPSPROXYAGENT-469131	Proof of Concept
	Unauthorized File Access SNYK-JS-NPM-537604	Proof of Concept
	Unauthorized File Access SNYK-JS-BINLINKS-537609	Proof of Concept

Release notes

Package name: npm

6.14.5 - 2020-05-04
6.14.5 (2020-05-04)

BUG FIXES
- 33ec41f18 #758 fix: relativize file links when inflating shrinkwrap (@jsnajdr)
- 94ed456df #1162 fix: npm init help output (@mum-never-proud)
DEPENDENCIES
- 5587ac01f npm-registry-fetch@4.0.4
  - fc5d94c39 fix: removed default timeout
- 07a4d8884 graceful-fs@4.2.4
- 8228d1f2e mkdirp@0.5.5
- e6d208317 nopt@4.0.3
6.14.4 - 2020-03-25
6.14.4 (2020-03-25)

DEPENDENCIES
- 136832dca mkdirp@0.5.4
- Bump minimist@1.2.5 transitive dep to resolve security issue
  - 9c554fd8c update-notifier@2.5.0
  - bump deep-extend@1.2.5
  - bump is-ci@1.2.1
  - bump is-retry-allowed@1.2.0
  - bump rc@1.2.8
  - bump registry-auth-token@3.4.0
  - bump widest-line@2.0.1
- 8bf99b2b5 #1053 deps: updates term-size to use signed binary
6.14.3 - 2020-03-19
6.14.3 (2020-03-19)

DOCUMENTATION
- 4ad221487 #1020 docs(teams): updated team docs to reflect MFA workflow (@blkdm0n)
- 4a31a4ba2 #1034 docs: cleanup (@ruyadorno)
- 0eac801cd #1013 docs: fix links to cli commands (@alenros)
- 7d8e5b99c #755 docs: correction to npm update -g behaviour (@johnkennedy9147)
DEPENDENCIES
- e11167646 mkdirp@0.5.3
  - c5b97d17d fix: bump minimist dep to resolve security issue (@isaacs)
- c50d679c6 rimraf@2.7.1
- a2de99ff9 npm-registry-mock@1.3.1
- 217debeb9 npm-registry-couchapp@2.7.4
6.14.2 - 2020-03-03
6.14.2 (2020-03-03)

DOCUMENTATION
- f9248c0be #730 chore(docs): update unpublish docs & policy reference (@nomadtechie, @mikemimik)
DEPENDENCIES
- 909cc3918 hosted-git-info@2.8.8 (@darcyclarke)
  - 5038b1891 fix: regression in old node versions w/ respect to url.URL implmentation
- 9204ffa58 npm-profile@4.0.4 (@isaacs)
  - 6bcf0860a fix: treat non-http/https login urls as invalid
- 0365d39bd glob@7.1.6 (@isaacs)
- dab030536 node-gyp@5.1.0 (@rvagg)
6.14.1 - 2020-02-27
6.14.1 (2020-02-26)
- 303e5c11e hosted-git-info@2.8.7 Fixes a regression where scp-style git urls are passed to the WhatWG URL parser, which does not handle them properly. (@isaacs)
6.14.0 - 2020-02-25
6.14.0 (2020-02-25)

FEATURES
- 30f170877 #731 add support for multiple funding sources (@ljharb & @ruyadorno)
BUG FIXES
- 55916b130 #508 fix: check npm.config before accessing its members (@kaiyoma)
- 7d0cd65b2 #733 fix: access grant with unscoped packages (@netanelgilad)
- 28c3d40d6, 0769c5b20 #945, #697 fix: allow new major versions of node to be automatically considered "supported" (@isaacs, @ljharb)
DEPENDENCIES
- 6f39e93 hosted-git-info@2.8.6 (@darcyclarke)
  - fix: passwords & usernames are escaped properly in git deps (@stevenhilder)
- f14b594ee chownr@1.1.4 (@isaacs)
- 77044150b npm-packlist@1.4.8 (@isaacs)
- 1d112461a npm-registry-fetch@4.0.3 (@isaacs)
  - ba8b4fe fix: always bypass cache when ?write=true
- a47fed760 readable-stream@3.6.0
  - 3bbf2d6 fix: babel's "loose mode" class transform enbrittles BufferList (@ljharb)
DOCUMENTATION
- 284c1c055, fbb5f0e50 #729 update lifecycle hooks docs
  (@seanhealy, @mikemimik)
- 1c272832d #787 fix: trademarks typo (@dnicolson)
- f6ff41776 #936 fix: postinstall example (@ajaymathur)
- 373224b16 #939 fix: bad links in publish docs (@vit100)
MISCELLANEOUS
- 85c79636d #736 add script to update dist-tags (@mikemimik)
6.13.7 - 2020-01-28
6.13.7 (2020-01-28)

BUG FIXES
- 7dbb91438 #655 Update CI detection cases (@isaacs)
DEPENDENCIES
- 0fb1296c7 libnpx@10.2.2 (@mikemimik)
- c9b69d569 node-gyp@5.0.7 (@mikemimik)
- e8dbaf452 bin-links@1.1.7 (@mikemimik)
  - #613 Fixes bin entry for package
6.13.6 - 2020-01-09
6.13.6 (2020-01-09)

DEPENDENCIES
- 6dba897a1 pacote@9.5.12:
  - d2f4176 fix(git): Do not drop uid/gid when executing in root-owned directory (@isaacs)
6.13.5 - 2020-01-09
6.13.5 (2020-01-09)

BUG FIXES
- fd0a802ec #550 Fix cache location for npm ci (@zhenyavinogradov)
- 4b30f3cca #648 fix(version): using 'allow-same-version', git commit --allow-empty and git tag -f (@rhengles)
TESTING
- e16f68d30 test(ci): add failing cache config test (@ruyadorno)
- 3f009fbf2 #659 test: fix bin-overwriting test on Windows (@isaacs)
- 43ae0791f #601 ci: Allow builds to run even if one fails (@XhmikosR)
- 4a669bee4 #603 Remove the unused appveyor.yml (@XhmikosR)
- 9295046ac #600 ci: switch to actions/checkout@v2 (@XhmikosR)
DOCUMENTATION
- f2d770ac7 #569 fix netlify publish path config (@claudiahdz)
- 462cf0983 #627 update gatsby dependencies (@felixonmars)
- 6fb5dbb72 #532 docs: clarify usage of global prefix (@jgehrcke)
6.13.4 - 2019-12-11
6.13.4 (2019-12-11)

BUGFIXES
- 320ac9aee npm/bin-links#12 npm/gentle-fs#7 Do not remove global bin/man links inappropriately (@isaacs)
DEPENDENCIES
- 52fd21061 gentle-fs@2.3.0 (@isaacs)
- d06f5c0b0 bin-links@1.1.6 (@isaacs)
6.13.3 - 2019-12-10
6.13.2 - 2019-12-03
6.13.1 - 2019-11-18
6.13.0 - 2019-11-05
6.12.1 - 2019-10-29
6.12.0 - 2019-10-08
6.12.0-next.0 - 2019-09-26
6.11.3 - 2019-09-03
6.11.2 - 2019-08-22
6.11.1 - 2019-08-21
6.11.0 - 2019-08-20
6.10.3 - 2019-08-06
6.10.2 - 2019-07-23
6.10.2-next.3 - 2019-07-22
6.10.2-next.2 - 2019-07-21
6.10.2-next.1 - 2019-07-17
6.10.2-next.0 - 2019-07-16
6.10.1 - 2019-07-11
6.10.1-next.2 - 2019-07-10
6.10.1-next.1 - 2019-07-03
6.10.1-next.0 - 2019-07-03
6.10.0 - 2019-07-03
6.10.0-next.0 - 2019-07-01
6.9.2 - 2019-06-27
6.9.1-next.0 - 2019-03-20
6.9.0 - 2019-03-06
6.9.0-next.0 - 2019-02-21
6.8.0 - 2019-02-13
6.8.0-next.2 - 2019-02-07
6.8.0-next.1 - 2019-02-06
6.8.0-next.0 - 2019-01-31
6.7.0 - 2019-01-23
6.6.0 - 2019-01-17
6.6.0-next.1 - 2019-01-10
6.6.0-next.0 - 2018-12-12
6.5.0 - 2018-12-10
6.5.0-next.0 - 2018-11-28
6.4.1 - 2018-08-29
6.4.1-next.0 - 2018-08-23
6.4.0 - 2018-08-15
6.4.0-next.0 - 2018-08-09
6.3.0 - 2018-08-02
6.3.0-next.0 - 2018-07-25
6.2.0 - 2018-07-14

from npm GitHub release notes

Commit messages

Package name: npm

abdf528 6.14.5
074f9a5 update AUTHORS
1238ee0 chore: remove slack notification
19a0230 docs: updated node-gyp links
36c878d chore: remove pyc files from tarball
0f219cc chore: reenable windows ci
725bef8 docs: changelog for 6.14.5
e6d2083 nopt@4.0.3
8228d1f mkdirp@0.5.5
07a4d88 graceful-fs@4.2.4
5587ac0 npm-registry-fetch@4.0.4
94ed456 npm init help wrong command
3f7301b docs: fix minor typos in CONTRIBUTING.md
d16a34f chore(docs): Fixed example typo & code style in npm-scripts.md
33ec41f fix: relativize file links when inflating shrinkwrap
b411f76 chore: avoid publish vim session file
cf7da1e 6.14.4
66f77ad docs: changelog for 6.14.4
be37961 Do not ship CoC/Contributing files for deps
5e75850 Add note about third-party test fixture code
8bf99b2 deps: updates term-size to use signed binary
b3eb8d5 chore: ignore any nested .DS_Store file
9c554fd update-notifier@2.5.0
136832d mkdirp@0.5.4

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade npm from 6.2.0 to 6.14.5. See this package in NPM: https://www.npmjs.com/package/npm See this project in Snyk: https://app.snyk.io/org/phillipgraniero-rxi/project/2958b718-1a0e-4eb7-bf1f-99ec96c329f3?utm_source=github&utm_medium=upgrade-pr

snyk-bot mentioned this pull request Jul 8, 2020

[Snyk] Upgrade terser from 3.8.1 to 3.17.0 #260

Open

snyk-bot mentioned this pull request Sep 14, 2021

[Snyk] Upgrade terser from 3.8.1 to 3.17.0 #658

Open

snyk-bot mentioned this pull request Feb 10, 2022

[Snyk] Upgrade terser from 3.8.1 to 3.17.0 #745

Open

restinpeaceinout mentioned this pull request Nov 23, 2023

[Snyk] Upgrade terser from 3.8.1 to 3.17.0 #1202

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade npm from 6.2.0 to 6.14.5 #259

[Snyk] Upgrade npm from 6.2.0 to 6.14.5 #259

snyk-bot commented Jul 8, 2020

6.14.5 (2020-05-04)

BUG FIXES

DEPENDENCIES

6.14.4 (2020-03-25)

DEPENDENCIES

6.14.3 (2020-03-19)

DOCUMENTATION

DEPENDENCIES

6.14.2 (2020-03-03)

DOCUMENTATION

DEPENDENCIES

6.14.1 (2020-02-26)

6.14.0 (2020-02-25)

FEATURES

BUG FIXES

DEPENDENCIES

DOCUMENTATION

MISCELLANEOUS

6.13.7 (2020-01-28)

BUG FIXES

DEPENDENCIES

6.13.6 (2020-01-09)

DEPENDENCIES

6.13.5 (2020-01-09)

BUG FIXES

TESTING

DOCUMENTATION

6.13.4 (2019-12-11)

BUGFIXES

DEPENDENCIES

[Snyk] Upgrade npm from 6.2.0 to 6.14.5 #259

Are you sure you want to change the base?

[Snyk] Upgrade npm from 6.2.0 to 6.14.5 #259

Conversation

snyk-bot commented Jul 8, 2020

Snyk has created this PR to upgrade npm from 6.2.0 to 6.14.5.

6.14.5 (2020-05-04)

BUG FIXES

DEPENDENCIES

6.14.4 (2020-03-25)

DEPENDENCIES

6.14.3 (2020-03-19)

DOCUMENTATION

DEPENDENCIES

6.14.2 (2020-03-03)

DOCUMENTATION

DEPENDENCIES

6.14.1 (2020-02-26)

6.14.0 (2020-02-25)

FEATURES

BUG FIXES

DEPENDENCIES

DOCUMENTATION

MISCELLANEOUS

6.13.7 (2020-01-28)

BUG FIXES

DEPENDENCIES

6.13.6 (2020-01-09)

DEPENDENCIES

6.13.5 (2020-01-09)

BUG FIXES

TESTING

DOCUMENTATION

6.13.4 (2019-12-11)

BUGFIXES

DEPENDENCIES