[Snyk] Fix for 16 vulnerabilities

[Jsn2win]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • apps/block_scout_web/assets/package.json
  • apps/block_scout_web/assets/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-CHARTJS-1018716	No	Proof of Concept
	484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	No	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HIGHLIGHTJS-1048676	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	No	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	No	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	No	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Directory Traversal SNYK-JS-MOMENT-2440688	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	No	Proof of Concept
	596/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.5	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-URIJS-1319803	No	Proof of Concept
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-URIJS-1319806	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-URIJS-2401466	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-URIJS-2415026	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-URIJS-2419067	No	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Misinterpretation of Input SNYK-JS-URIJS-2440699	No	Proof of Concept
	591/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.4	Cross-site Scripting (XSS) SNYK-JS-URIJS-2441239	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: chart.js

The new version differs by 9 commits.

• 1d92605 Use Object.create(null) as `merge` target (Derive current token balances concurrently blockscout/blockscout#7920)
• dff7140 When objects are merged together, the target prototype can be polluted. (Fix "Elixir.Indexer.Memory.Monitor",{{badkey,limit} blockscout/blockscout#7918)
• d919188 Bump verison number to v2.9.4
• 42ed589 Fix Maximum call stack size exception in computeLabelSizes (Bump ex_doc from 0.29.4 to 0.30.1 blockscout/blockscout#7883)
• 063b7dc [2.9] FitBoxes recursion when dimensions are NaN (Increase web pod requests for rc1 environments blockscout/blockscout#7853)
• 2493cb5 Use node v12.18.2 on Travis CI (Inconsistent tokens for address in new chiado env blockscout/blockscout#7864)
• 679ec4a docs: fix rollup external moment (#7587)
• 484f0d1 Preserve object prototypes when cloning (Postgrex expected an integer in .., got ... blockscout/blockscout#7404)
• 2df6986 Look for any branch starting with release (Allow URI special symbols in DATABASE_URL blockscout/blockscout#7087) (Improve Json Rpc requests timeouts blockscout/blockscout#7089)

See the full diff

Package name: urijs

The new version differs by 15 commits.

• b655c1b chore(build): bumping to version 1.19.11
• b0c9796 fix(parse): handle CR,LF,TAB
• 88805fd fix(parse): handle excessive slashes in scheme-relative URLs
• 926b2aa chore(build): bumping to version 1.19.10
• a8166fe fix(parse): handle excessive colons in scheme delimiter
• 01920b5 chore(build): bumping to version 1.19.9
• 86d1052 fix(parse): remove leading whitespace
• efae1e5 chore(build): bumping to version 1.19.8
• 6ea641c fix(parse): case insensitive scheme - Add transaction status indicator blockscout/blockscout#412
• 19e54c7 chore(build): bumping to version 1.19.7
• 547d4b6 build: update jquery
• aab4a43 build: remove obsolete build tools
• ac43ca8 fix(parse): more backslash galore Contributor see a Token tab in the Address page blockscout/blockscout#410
• 622db6d docs: add security policy
• 8e51b00 fix(parse): prevent overwriting __proto__ in parseQuery()

See the full diff

Package name: web3

The new version differs by 125 commits.

• 02895cb Build for 1.7.5
• 34f6b68 v1.7.5
• 195f01d Manual build commit for 1.7.5-rc.1
• b640e26 v1.7.5-rc.1
• 96a7935 npm i
• 9476964 Merge branch '1.x' into release/1.7.5
• 84ac9b7 Fixed unit tests & removed dead code for web3-providers-http (Fix docker-compose blockscout/blockscout#5228) (Fix bug with 500 response on partial sourcify status blockscout/blockscout#5264)
• 2dcf142 Manual build commit for 1.7.5-rc.0
• ba30e1d v1.7.5-rc.0
• c93940b npm i and CHANGELOG update for 1.7.5 release
• fc7bfcd 1.x Libs Update including parse-url (#5254)
• ca827a7 fix Promise in Accounts.signTransaction() throwing errors that cannot be caught Empty blocks sanitizer blockscout/blockscout#4724 (Alloted rate limit by a global API key blockscout/blockscout#5080) (Awesome chain: <Issue Title> blockscout/blockscout#5252)
• 35d8f7f Update AbstractProvider with correct typing (Uncaught TypeError: Cannot read properties of undefined (reading 'includes') blockscout/blockscout#5206)
• 57b6dc4 Add createAccessList type (Emerald Mainnet: <Issue Title> blockscout/blockscout#5146) (Emerald Mainnet: <Issue Title> blockscout/blockscout#5204)
• 46b5a5b fix remove wallet using an index when an account address and address lowercase are equal On new block, stats information switches to another network blockscout/blockscout#5049 (Gnosis Chain: I can use the link to get free xDai blockscout/blockscout#5050) (Docker setup Makefile release/publish tasks blockscout/blockscout#5202)
• 2a1308f Fix transactionRoot -> transactionsRoot in BlockHeader (Palm: <Issue Title> blockscout/blockscout#5083) (Fix contract functions outputs blockscout/blockscout#5197)
• 9e0d9d1 hexToNumber: return BigInt if result is bigger than max integer (serious problem blockscout/blockscout#5157)
• 555aa0d web3-providers-http: Migrate from xhr2-cookies to cross-fetch (Hide request url in exceptions message blockscout/blockscout#5179)
• c034b8d Update `got` dependency for `web3-bzz` package (Testnet: <Issue Title> blockscout/blockscout#5178)
• aae9d4a Updates on `README.md` Format (Running with indexer disabled doesn't refresh the interface when new blocks come in blockscout/blockscout#5115)
• 8f05f19 Fixed documentation for web3.eth.accounts.signTransaction (Token contract hash: <0xxxx> error while fetching metadata: blockscout/blockscout#5121)
• 5b10473 Fix typo (Testnet: <Issue Title> blockscout/blockscout#5116)
• 18da528 fix typos in web3-eth-accounts.rst & TESTING.md At contract write use wei precision blockscout/blockscout#5047 (404 on internal-transactions and coin-balances blockscout/blockscout#5048)
• e9ab4a5 Typo foudn (Updated some outdated npm packages blockscout/blockscout#5142)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)
🦉 Open Redirect
🦉 Open Redirect
🦉 More lessons are available in Snyk Learn