[Snyk] Fix for 7 vulnerabilities

[MarcelRaschke]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • examples/apps/view-framework-sampler/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: html-webpack-plugin

The new version differs by 93 commits.

• 873d75b chore(release): 5.5.0
• ddeb774 chore: update examples
• 1e42625 feat: Support type=module via scriptLoading option
• 7d3645b Bump pretty-error to 4.0.0 to fix transitive vuln for ansi-regex CVE-2021-3807
• 79be779 [chore] changes actions to run on pull_requests
• b7e5859 [chore] fixes CI to avoid race conditions
• 48131d3 chore(release): 5.4.0
• 16a841a [chore] rebuild examples
• 3bb7c17 Update index.js
• e38ac97 Update index.js
• f08bd02 [chore] updates fixtures
• d62a10f [chore] upgrades html-minifier-terser@5.0.0 -> 6.0.2
• 2f5de7a Remove archived plugin
• 8f8f7c5 chore(release): 5.3.2
• 053c6e6 chore: update snapshot tests for webpack 5.4.0
• 9c7fba0 Fix security vulnerabilities
• b98fbeb Fix security vulnerabilities
• 25cdfc7 Added inject-body-webpack-plugin to readme
• 0e4c1fb Update README to document actual behavior
• 0a6568d chore(release): 5.3.1
• 82d0ee8 fix: remove loader-utils from plugin core
• 6f39192 chore(release): 5.3.0
• d654f5b feat: allow to modify the interpolation options in webpack config
• 41d7a50 feat: drop loader-utils dependency

See the full diff

Package name: webpack-dev-server

The new version differs by 250 commits.

• 5280ee7 docs: fix typo
• d834582 chore(release): 4.7.3
• 7b8c85b chore(deps): update `selfsigned` ([release/0.27] Bump 0.27 from 0.27.9 to 0.27.10. microsoft/FluidFramework#4170)
• d598325 chore: fix lint
• c1907f1 refactor: remove redundant `if` statements (Configure local test server to support op limits around summaries microsoft/FluidFramework#4158)
• e535f25 ci: debug (Remove usages of assert in all code that ends up bundled in the browser microsoft/FluidFramework#4144)
• 75999bb chore(release): 4.7.2
• 90a96f7 ci: fix (socketDocumentId on connection errors  microsoft/FluidFramework#4143)
• f6bc644 fix: compatible with `onAfterSetupMiddleware`
• 317e4b9 docs: fix testing instructions (Removed token signing from insecureUrlResolver microsoft/FluidFramework#4133)
• ff4550e test: remove redundant test cases related to 3rd party code (Fix parsing nested required dependencies in package lock file microsoft/FluidFramework#4131)
• 0dd1ee6 test: add e2e tests for `setupExitSignals` option ([release/0.26] Cherry-pick commit 136da80 AKA PR #4119 into 0.26. microsoft/FluidFramework#4130)
• afe4975 chore(release): 4.1.7
• 4e5d8ea fix: droped `url` package ([release/0.26] Bump 0.26 from 0.26.9 to 0.26.10 microsoft/FluidFramework#4132)
• b0c98f0 chore(release): 4.7.0
• 3138213 chore(deps): update (Unit tests for garbage collection microsoft/FluidFramework#4127)
• 8f02c3f feat: added types
• f4fb15f fix: update description of `onAfterSetupMiddleware` and `onBeforeSetupMiddleware` options (Local token provider for r11s driver microsoft/FluidFramework#4126)
• 37b73d5 test: add e2e test for `WEBPACK_SERVE` env variable (Update lock file to fix build break microsoft/FluidFramework#4125)
• f5a9d05 chore(deps-dev): bump eslint from 8.4.1 to 8.5.0 (Add assert to dep in pkgs that use it microsoft/FluidFramework#4121)
• c9b959f chore(deps): bump ws from 8.3.0 to 8.4.0 (Reduce bundle size analysis noise microsoft/FluidFramework#4124)
• 42208aa chore(deps-dev): bump lint-staged from 12.1.2 to 12.1.3 (Support Skipping Context Reload when New Code is Compatible with Old microsoft/FluidFramework#4122)
• f440f84 chore(deps): bump express from 4.17.1 to 4.17.2 (revert strict as assert for exported code microsoft/FluidFramework#4120)
• c13aa56 feat: added the `setupMiddlewares` option (When document is stuck with too many ops after summary, there is no way to summarize it ("read" default connection) microsoft/FluidFramework#4068)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect
🦉 Prototype Pollution