[Snyk] Fix for 3 vulnerabilities

[adamlaska]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
• package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Uncontrolled resource consumption SNYK-JS-BRACES-6838727	Yes	Proof of Concept
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gulp

The new version differs by 131 commits.

• 5c4c547 chore: Release 5.0.0 (#2762)
• bf72116 chore: Add index.mjs to files list
• b00de68 feat: Provide an ESM export (#2760)
• 72668c6 chore!: Normalize repository, dropping node <10.13 support (#2758)
• 85896d4 chore(docs): Update stream handbook link (#2711)
• 818bd73 Docs: Remove gulp-sourcemaps because it is built-in (#2592)
• 598f971 Docs: Fix broken link in recipe (#2571)
• 9877de0 Docs: Guide CustomRegistries to maintain properties on tasks (fixes #2561) (#2565)
• f91c388 Docs: Remove typo in custom registry docs (#2543)
• df25250 Docs: Fix typo in task docs (#2524)
• b6d6d7c Docs: fix recipe link (#2526)
• c26ebcb Docs: Cleanup registry error message subtitles
• d51c6eb Docs: Rename the automate releases recipe file
• 4c1bead Docs: Add subtitles for registry error messages (#2502)
• 6e56ed8 Docs: Update and refactor release workflow recipe (#2498)
• 131b702 Docs: Remove recipe for using a config file
• c5ff7e0 Docs: Remove recipe for splitting tasks in files
• 147327c Docs: Remove recipe for specifying a CWD
• 1a653a9 Docs: Remove recipe for running shell commands
• e1190ea Docs: Remove recipe for exporting tasks
• c4305df Docs: Remove recipe for running tasks in series
• 486f927 Docs: Remove recipes for selecting changed files
• b7b70b8 Docs: Fix some links
• 93564bd Docs: Add advanced section for creation of custom registries (#2479)

See the full diff

Package name: gulp-sass

The new version differs by 42 commits.

• 5775044 Update CHANGELOG.md
• 978b8f6 Update to major version 5 (Update hacking-on-atom-core.md atom/flight-manual.atom.io#802)
• 10eae93 Update changelog for 4.1.1
• 947b26c Upgrade lodash to fix a security issue (Patch 1 atom/flight-manual.atom.io#776)
• 8d6ac29 Update changelog
• 43c0547 4.1.0
• ebe3ec6 Set appropriate file stat times (S69y patch 3 atom/flight-manual.atom.io#763)
• 7ab018e Migrate to the lodash package
• fa670c6 4.0.2
• fefa00e Revert package.json version bump
• 98254d2 Fix README typos
• 8a14419 Continue loading Node Sass by default
• 938afbe Add a note about synchronous versus asynchronous speed
• 7cc2db1 Make this package implementation-agnostic
• 643f73b Add documentation for synchronous code options
• 0b3c7e7 4.0.1
• daca90d Merge pull request ΑͲἂͲΘΩ⩩https://github.com/solveforce/flight-manual.atom.io/new/master… atom/flight-manual.atom.io#681 from DKvistgaard/master
• 71471c2 Declaring logError as function instead of arrow function.
• 450a7b8 4.0.0
• e9b1fe8 Fix node versions in appveyor.yml
• 44be409 Merge pull request ⛰️ATOM⛰️ atom/flight-manual.atom.io#667 from dlmanning/next
• 7656eff Adopt airbnb eslint preset
• 1293169 Bump autoprefixer@^8.1.0, gulp-postcss@^7.0.1
• 9fa817b Bump gulp-sourcemaps@^2.6.4

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Note: This is a default PR template raised by Snyk. Find out more about how you can customise Snyk PRs in our documentation.

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@gulpjs/messages@1.1.0	None	0	7.19 kB	phated
npm/@gulpjs/to-absolute-glob@4.0.0	None	0	6.68 kB	phated
npm/anymatch@3.1.3	None	0	9.65 kB	phated
npm/async-done@2.0.0	None	0	12.9 kB	phated
npm/async-settle@2.0.0	None	0	5.52 kB	phated
npm/bach@2.0.1	None	0	15.5 kB	phated
npm/bare-events@2.2.2	None	0	18.9 kB	kasperisager
npm/base64-js@1.5.1	None	0	9.62 kB	feross
npm/binary-extensions@2.3.0	None	0	5.03 kB	sindresorhus
npm/bl@5.1.0	Transitive: environment	+4	259 kB	rvagg
npm/braces@3.0.3	None	0	44.6 kB	jonschlinkert
npm/buffer@6.0.3	None	0	91.3 kB	feross
npm/chokidar@3.6.0	environment, filesystem	0	90.2 kB	paulmillr
npm/cliui@7.0.4	None	+2	40.2 kB	oss-bot
npm/color-convert@2.0.1	None	0	27.2 kB	qix
npm/color-name@1.1.4	None	0	6.69 kB	dfcreative
npm/copy-props@4.0.0	None	0	14.6 kB	phated
npm/each-props@3.0.0	None	0	7.9 kB	phated
npm/emoji-regex@8.0.0	None	0	48.3 kB	mathias
npm/end-of-stream@1.4.4	None	0	6.23 kB	mafintosh
npm/escalade@3.1.2	filesystem	0	11.6 kB	lukeed
npm/extend@3.0.2	None	0	23.5 kB	ljharb
npm/fast-fifo@1.3.2	None	0	5.07 kB	mafintosh
npm/fast-levenshtein@3.0.0	None	0	7.63 kB	hiddentao
npm/fastest-levenshtein@1.0.16	None	0	21.3 kB	ka-weihe
npm/fastq@1.17.1	None	0	41.9 kB	matteo.collina
npm/fill-range@7.1.1	None	0	16.7 kB	jonschlinkert
npm/findup-sync@5.0.0	filesystem	0	6.63 kB	phated
npm/fined@2.0.0	filesystem	0	8.44 kB	phated
npm/flagged-respawn@2.0.0	shell	0	10.1 kB	phated
npm/fs-mkdirp-stream@2.0.1	None	0	8.79 kB	phated
npm/fsevents@2.3.3	None	0	173 kB	pipobscure
npm/function-bind@1.1.2	None	0	31.4 kB	ljharb
npm/get-caller-file@2.0.5	None	0	4.72 kB	stefanpenner
npm/glob-parent@5.1.2	None	0	12.1 kB	phated
npm/glob-stream@8.0.2	filesystem	+1	21.7 kB	phated
npm/glob-watcher@6.0.0	None	0	9.89 kB	phated
npm/graceful-fs@4.2.11	environment, filesystem	0	32.5 kB	isaacs
npm/gulp-cli@3.0.0	environment, filesystem, unsafe	+6	149 kB	phated
npm/gulp-sass@5.0.0	unsafe	+1	29.9 kB	xzyfer
npm/gulp@5.0.0	None	0	11.2 kB	phated
npm/has-flag@4.0.0	None	0	4.42 kB	sindresorhus
npm/hasown@2.0.2	None	0	8.77 kB	ljharb
npm/homedir-polyfill@1.0.3	environment, filesystem	0	8.05 kB	doowb
npm/ieee754@1.2.1	None	0	6.8 kB	feross
npm/ini@1.3.8	None	0	9.3 kB	isaacs
npm/interpret@3.1.1	None	0	21.5 kB	phated
npm/is-binary-path@2.1.0	None	0	3.08 kB	sindresorhus
npm/is-core-module@2.13.1	None	0	30.2 kB	ljharb
npm/is-fullwidth-code-point@3.0.0	None	0	4.99 kB	sindresorhus
npm/is-glob@4.0.3	None	0	13.6 kB	phated
npm/is-number@7.0.0	None	0	9.62 kB	jonschlinkert
npm/is-plain-object@5.0.0	None	0	9.16 kB	trysound
npm/last-run@2.0.0	None	0	4.99 kB	phated
npm/lead@4.0.0	None	0	4.7 kB	phated
npm/liftoff@5.0.0	environment, filesystem	0	34.8 kB	phated
npm/lodash@4.17.21	None	0	1.41 MB	bnjmnt4n
npm/micromatch@4.0.7	None	0	0 B
npm/mute-stdout@2.0.0	None	0	3.74 kB	phated
npm/normalize-path@3.0.0	None	0	9.22 kB	jonschlinkert
npm/now-and-later@3.0.0	None	0	15.1 kB	phated
npm/path-parse@1.0.7	None	0	4.51 kB	jbgutierrez
npm/picomatch@2.3.1	None	0	90 kB	mrmlnc
npm/plugin-error@1.0.1	None	0	11.9 kB	phated
npm/queue-tick@1.0.1	None	0	3.03 kB	mafintosh
npm/readdirp@3.6.0	filesystem	0	20.5 kB	paulmillr
npm/rechoir@0.8.0	None	0	8.64 kB	phated
npm/replace-homedir@2.0.0	None	0	4.66 kB	phated
npm/resolve-options@2.0.0	None	0	7.87 kB	phated
npm/resolve@1.22.8	environment, filesystem	0	145 kB	ljharb
npm/reusify@1.0.4	None	0	9.44 kB	matteo.collina
npm/safer-buffer@2.1.2	None	0	42.3 kB	chalker
npm/semver-greatest-satisfied-range@2.0.0	None	0	4.29 kB	phated
npm/semver@6.3.1	None	0	68.3 kB	lukekarrys
npm/stream-composer@1.0.2	None	0	13.1 kB	mafintosh
npm/streamx@2.16.1	None	0	49.3 kB	mafintosh
npm/string-width@4.2.3	None	0	5.16 kB	sindresorhus
npm/supports-preserve-symlinks-flag@1.0.0	None	0	9.18 kB	ljharb
npm/sver@1.8.4	None	0	24.8 kB	guybedford
npm/teex@1.0.1	None	0	4.79 kB	mafintosh
npm/to-regex-range@5.0.1	None	0	22.9 kB	jonschlinkert
npm/to-through@3.0.0	None	0	7.16 kB	phated
npm/transfob@1.0.0	None	0	1.35 kB	desandro
npm/undertaker-registry@2.0.0	None	0	9.07 kB	phated
npm/undertaker@2.0.0	environment	0	23.2 kB	phated
npm/v8flags@4.0.1	environment, filesystem, shell	0	9.76 kB	phated
npm/value-or-function@4.0.0	None	0	8.63 kB	phated
npm/vinyl-contents@2.0.0	Transitive: unsafe	+2	44.7 kB	phated
npm/vinyl-fs@4.0.0	filesystem	+1	403 kB	phated
npm/vinyl-sourcemap@2.0.0	None	+1	32.7 kB	phated
npm/which@1.3.1	environment	0	9.42 kB	isaacs
npm/wrap-ansi@7.0.0	None	0	10.6 kB	sindresorhus
npm/y18n@5.0.8	filesystem	0	23.4 kB	oss-bot
npm/yargs@16.2.0	environment, filesystem	0	286 kB	oss-bot

🚮 Removed packages: npm/abbrev@1.1.1, npm/ajv@5.5.0, npm/anymatch@2.0.0, npm/append-buffer@1.0.2, npm/aproba@1.2.0, npm/archy@1.0.0, npm/are-we-there-yet@1.1.4, npm/arr-filter@1.1.2, npm/arr-flatten@1.1.0, npm/arr-map@2.0.2, npm/array-find-index@1.0.2, npm/array-initial@1.1.0, npm/array-last@1.3.0, npm/array-sort@1.0.0, npm/array-unique@0.3.2, npm/asn1@0.2.3, npm/assert-plus@1.0.0, npm/async-done@1.3.1, npm/async-each@1.0.1, npm/async-foreach@0.1.3, npm/async-settle@1.0.0, npm/asynckit@0.4.0, npm/atob@2.1.2, npm/aws-sign2@0.7.0, npm/aws4@1.6.0, npm/bach@1.2.0, npm/base@0.11.2, npm/bcrypt-pbkdf@1.0.1, npm/binary-extensions@1.12.0, npm/block-stream@0.0.9, npm/boom@4.3.1, npm/braces@2.3.2, npm/buffer-equal@1.0.0, npm/buffer-from@1.1.1, npm/builtin-modules@1.1.1, npm/cache-base@1.0.1, npm/camelcase-keys@2.1.0, npm/camelcase@2.1.1, npm/caseless@0.12.0, npm/chokidar@2.0.4, npm/class-utils@0.3.6, npm/cliui@3.2.0, npm/co@4.6.0, npm/code-point-at@1.1.0, npm/collection-map@1.0.0, npm/collection-visit@1.0.0, npm/combined-stream@1.0.5, npm/component-emitter@1.2.1, npm/concat-stream@1.6.2, npm/console-control-strings@1.1.0, npm/copy-descriptor@0.1.1, npm/copy-props@2.0.4, npm/cross-spawn@3.0.1, npm/cryptiles@3.1.2, npm/currently-unhandled@0.4.1, npm/d@1.0.0, npm/dashdash@1.14.1, npm/decode-uri-component@0.2.0, npm/default-compare@1.0.0, npm/default-resolution@2.0.0, npm/define-properties@1.1.3, npm/define-property@2.0.2, npm/delayed-stream@1.0.0, npm/delegates@1.0.0, npm/each-props@1.3.2, npm/ecc-jsbn@0.1.1, npm/end-of-stream@1.4.1, npm/error-ex@1.3.1, npm/es5-ext@0.10.46, npm/es6-iterator@2.0.3, npm/es6-symbol@3.1.1, npm/es6-weak-map@2.0.2, npm/expand-brackets@2.1.4, npm/extend@3.0.1, npm/extglob@2.0.4, npm/extsprintf@1.3.0, npm/fast-deep-equal@1.0.0, npm/fast-json-stable-stringify@2.0.0, npm/fill-range@4.0.0, npm/find-up@1.1.2, npm/findup-sync@2.0.0, npm/fined@1.1.0, npm/flagged-respawn@1.0.0, npm/flush-write-stream@1.0.3, npm/forever-agent@0.6.1, npm/form-data@2.3.1, npm/fragment-cache@0.2.1, npm/fs-mkdirp-stream@1.0.0, npm/fs.realpath@1.0.0, npm/fsevents@1.2.4, npm/fstream@1.0.11, npm/function-bind@1.1.1, npm/gauge@2.7.4, npm/get-caller-file@1.0.2, npm/get-stdin@4.0.1, npm/get-value@2.0.6, npm/getpass@0.1.7, npm/glob-parent@3.1.0, npm/glob-stream@6.1.0, npm/glob-watcher@5.0.1, npm/glob@7.1.3, npm/graceful-fs@4.1.11, npm/gulp-sass@2.3.2, npm/gulp@4.0.0, npm/har-schema@2.0.0, npm/har-validator@5.0.3, npm/has-symbols@1.0.0, npm/has-unicode@2.0.1, npm/has-value@1.0.0, npm/has-values@1.0.0, npm/hawk@6.0.2, npm/hoek@4.2.0, npm/homedir-polyfill@1.0.1, npm/hosted-git-info@2.5.0, npm/http-signature@1.2.0, npm/in-publish@2.0.0, npm/indent-string@2.1.0, npm/inflight@1.0.6, npm/ini@1.3.5, npm/interpret@1.1.0, npm/invert-kv@1.0.0, npm/is-accessor-descriptor@0.1.6, npm/is-arrayish@0.2.1, npm/is-binary-path@1.0.1, npm/is-builtin-module@1.0.0, npm/is-data-descriptor@0.1.4, npm/is-descriptor@0.1.6, npm/is-extendable@0.1.1, npm/is-fullwidth-code-point@1.0.0, npm/is-glob@4.0.0, npm/is-number@3.0.0, npm/is-typedarray@1.0.0, npm/is-utf8@0.2.1, npm/isstream@0.1.2, npm/js-base64@2.4.0, npm/jsbn@0.1.1, npm/json-schema-traverse@0.3.1, npm/json-schema@0.2.3, npm/json-stable-stringify@1.0.1, npm/json-stringify-safe@5.0.1, npm/jsonify@0.0.0, npm/jsprim@1.4.1, npm/just-debounce@1.0.0, npm/last-run@1.1.1, npm/lazystream@1.0.0, npm/lcid@1.0.0, npm/lead@1.0.0, npm/liftoff@2.5.0, npm/load-json-file@1.1.0, npm/lodash.assign@4.2.0, npm/lodash.clonedeep@4.5.0, npm/lodash.debounce@4.0.8, npm/loud-rejection@1.6.0, npm/make-iterator@1.0.1, npm/map-obj@1.0.1, npm/map-visit@1.0.0, npm/matchdep@2.0.0, npm/meow@3.7.0, npm/micromatch@3.1.10, npm/mixin-deep@1.3.1, npm/mute-stdout@1.0.1, npm/nan@2.8.0, npm/nanomatch@1.2.13, npm/next-tick@1.0.0, npm/node-gyp@3.6.2, npm/node-sass@3.13.1, npm/nopt@3.0.6, npm/normalize-package-data@2.4.0, npm/normalize-path@2.1.1, npm/now-and-later@2.0.0, npm/npmlog@4.1.2, npm/oauth-sign@0.8.2, npm/object-copy@0.1.0, npm/object-keys@1.0.12, npm/object-visit@1.0.1, npm/object.assign@4.1.0, npm/object.map@1.0.1, npm/object.reduce@1.0.1, npm/once@1.3.3, npm/ordered-read-streams@1.0.1, npm/os-locale@1.4.0, npm/osenv@0.1.4, npm/parse-json@2.2.0, npm/pascalcase@0.1.1, npm/path-dirname@1.0.2, npm/path-exists@2.1.0, npm/path-parse@1.0.6, npm/path-type@1.1.0, npm/performance-now@2.1.0, npm/pify@2.3.0, npm/pinkie-promise@2.0.1, npm/pinkie@2.0.4, npm/posix-character-classes@0.1.1, npm/pretty-hrtime@1.0.3, npm/pseudomap@1.0.2, npm/pump@2.0.1, npm/pumpify@1.5.1, npm/punycode@1.4.1, npm/read-pkg-up@1.0.1, npm/read-pkg@1.1.0, npm/readdirp@2.2.1, npm/rechoir@0.6.2, npm/redent@1.0.0, npm/regex-not@1.0.2, npm/remove-bom-buffer@3.0.0, npm/remove-bom-stream@1.2.0, npm/repeat-element@1.1.3, npm/replace-homedir@1.0.0, npm/request@2.83.0, npm/require-main-filename@1.0.1, npm/resolve-options@1.1.0, npm/resolve-url@0.2.1, npm/resolve@1.8.1, npm/ret@0.1.15, npm/rimraf@2.6.2, npm/safe-regex@1.1.0, npm/sass-graph@2.2.4, npm/scss-tokenizer@0.2.3, npm/semver-greatest-satisfied-range@1.1.0, npm/semver@4.3.6, npm/set-blocking@2.0.0, npm/set-value@2.0.0, npm/signal-exit@3.0.2, npm/snapdragon-node@2.1.1, npm/snapdragon-util@3.0.1, npm/snapdragon@0.8.2, npm/sntp@2.1.0, npm/source-map-resolve@0.5.2, npm/source-map-url@0.4.0, npm/spdx-correct@1.0.2, npm/spdx-expression-parse@1.0.4, npm/spdx-license-ids@1.2.2, npm/split-string@3.1.0, npm/sshpk@1.13.1, npm/stack-trace@0.0.10, npm/static-extend@0.1.2, npm/string-width@1.0.2, npm/stringstream@0.0.5, npm/strip-indent@1.0.1, npm/sver-compat@1.5.0, npm/tar@2.2.1, npm/through2-filter@2.0.0, npm/to-absolute-glob@2.0.2, npm/to-object-path@0.3.0, npm/to-regex-range@2.1.1, npm/to-regex@3.0.2, npm/to-through@2.0.0, npm/tough-cookie@2.3.3, npm/trim-newlines@1.0.0, npm/tunnel-agent@0.6.0, npm/tweetnacl@0.14.5, npm/typedarray@0.0.6, npm/undertaker-registry@1.0.1, npm/undertaker@1.2.0, npm/union-value@1.0.0, npm/unique-stream@2.2.1, npm/unset-value@1.0.0, npm/upath@1.1.0, npm/urix@0.1.0, npm/use@3.1.1, npm/uuid@3.1.0, npm/v8flags@3.1.1, npm/validate-npm-package-license@3.0.1, npm/value-or-function@3.0.0, npm/verror@1.10.0, npm/vinyl-fs@3.0.3, npm/vinyl-sourcemap@1.1.0, npm/which-module@1.0.0, npm/which@1.3.0, npm/wide-align@1.1.2, npm/wrap-ansi@2.1.0, npm/y18n@3.2.1, npm/yallist@2.1.2, npm/yargs@7.1.0

View full report↗︎