[Snyk] Fix for 1 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-ASYNC-2441827	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: grunt

The new version differs by 40 commits.

• 6f49017 1.3.0
• faab6be Merge pull request #1720 from gruntjs/update-changelog-deps
• 520fedb Update Changelog and legacy-util dependency
• 7e669ac Merge pull request #1719 from gruntjs/yaml-refactor
• e350cea Switch to use `safeLoad` for loading YML files via `file.readYAML`.
• 7125f49 Merge pull request #1718 from gruntjs/legacy-log-bumo
• 00d5907 Bump legacy-log
• 3b75085 1.2.1
• ae11839 Changelog update
• 9d23cb6 Merge pull request #1715 from sibiraj-s/remove-path-is-absolute
• e789b1f Remove path-is-absolute dependency
• 27bc5d9 Merge pull request #1714 from gruntjs/release-1.2.0
• 64a3cf4 Release v1.2.0
• 0d23eff Merge pull request #1570 from bhldev/feature-options-keys
• ee70306 Merge pull request #1697 from philz/1696
• 05c0634 Merge pull request #1712 from gruntjs/fix-lint
• cdd1c19 fix lint in file.js
• bc168e3 Merge pull request #1283 from greglittlefield-wf/recognize-relative-links
• 5f16b5a Merge pull request #1675 from STRML/remove-coffeescript
• 58f80ae Merge pull request #1677 from micellius/monorepo-support
• 1f61427 Add CODE_OF_CONDUCT.md
• 4c6fcd9 Merge pull request #1709 from NotMoni/patch-1
• 169d496 add link to license
• 288ea76 add license link

See the full diff

Package name: grunt-contrib-compress

The new version differs by 14 commits.

• bd9fc8e v2.0.0
• b8565a9 Update Archiver (Save graphics created by draw widget cmv/cmv-app#232)
• f6815bf Update deps and remove nodeunit loading (Layer Control - Use icon for Layer menu instead of text link. cmv/cmv-app#231)
• b70c1d9 Update tests and dependencies (Layer Control - Add ability to group layers with toggle all layers for each group cmv/cmv-app#230)
• 5759edd Bump ini from 1.3.5 to 1.3.7 (Buffer, select and export cmv/cmv-app#228)
• 0603886 v1.6.0
• ea2bb69 Update deps ([Help] Exclude feature layers from TOC cmv/cmv-app#218)
• 1cfa1f1 update iltorb to 2.4.3 (Selecting a result in Find Widget zooms to and opens info window cmv/cmv-app#216)
• a8998ec 1.5.0
• e7cb371 Update changelog
• f6e95ab Add package lock (Adding a second field to the result of Find widget cmv/cmv-app#213)
• 050ae41 Updated iltorb to latest minor version for v1.* (Need help: creating a link in a popup that executes method in widget cmv/cmv-app#209)
• fd055e9 update tar to 4.4.8 (Is there a configuration setting to include zoom by selection, or does this need to be developed? cmv/cmv-app#211)
• b8ed0cc package.json: minimum node.js version is 4 since the Brotli patch.

See the full diff

Package name: grunt-contrib-connect

The new version differs by 24 commits.

• 5c3d0e7 v3.0.0
• 0df44c9 Merge pull request Basemap widget does not show when Print widget set to false cmv/cmv-app#262 from gruntjs/upt-depxa
• caa1331 Update dependencies
• ace8bd8 Merge pull request Geoprocessing Widget cmv/cmv-app#260 from gruntjs/dependabot/npm_and_yarn/lodash-4.17.19
• eb4496c Bump lodash from 4.17.15 to 4.17.19
• 4f3954d Merge pull request Layer Control Widget - disable turn on/off sublayer cmv/cmv-app#261 from gruntjs/add-actions
• 434ecd6 Add actions
• 15b3a28 Merge pull request Only Enable Editing if Map at specific scale cmv/cmv-app#257 from gruntjs/dependabot/npm_and_yarn/lodash-4.17.15
• 801dcda Bump lodash from 4.17.10 to 4.17.15
• b6e703d v2.1.0
• 399dd5f Merge pull request Question. Customizing Layer Control Widget cmv/cmv-app#256 from TheGreatRefrigerator/master
• f93c287 Fix the gitignore change
• 71fcea9 Upgrade morgan to v1.9.1
• d5390ff Allow all configuration options of livereload to be passed through. (indent list cmv/cmv-app#246)
• 9da2f37 v2.0.0.
• 122398b pass directory options to serve-index
• 19924f8 Fixed: options.open.{appName, callback} (Layer Control - Add ability to group layers with toggle all layers for each group cmv/cmv-app#230)
• b218f7a Update all dependencies.
• c5a7091 Use https.
• d1cfd54 No need to be verbose now.
• 6289a8a Replace http2 with node-http2.
• 42703e0 Added secureProtocol property in httpsOptions
• 216c5e9 Drop Node.js < 6 support and update devDependencies.
• 6f96a55 Fix a broken test.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution