[Snyk] Fix for 18 vulnerabilities

[ajesse11x]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/app/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-COLORSTRING-1082939	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
	541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASHTEMPLATE-1088054	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gulp

The new version differs by 134 commits.

• 55eb23a Release: 4.0.0
• 173a532 Docs: Fix the installation instructions
• ec54d09 Docs: Improve note about out-of-date docs
• 03b7c98 Docs: Update recipes to install gulp@next
• 2eba29e Docs: Remove run-sequence from recipes
• 76eb4d6 Docs: Add installation instructions & update badges
• fbc162f Docs: Remove references to gulp-util
• 3011cf9 Scaffold: Normalize repository
• f27be05 Update: Remove graceful-fs from test suite
• 361ab63 Upgrade: Update glob-watcher
• 064d100 Build: Avoid broken node 9
• 057df59 Release: 4.0.0-alpha.3
• c1ba80c Breaking: Upgrade major versions of glob-watcher, gulp-cli & vinyl-fs
• 89acc5c Docs: Improve ES2015 task exporting examples (fix: add vendor prefix for file tab styling codesandbox/codesandbox-client#1999)
• 0ac9e04 Docs: Add "Project structure" section to CONTRIBUTING.md (Reset isForkingSandbox on error codesandbox/codesandbox-client#1859)
• 723cbc4 Docs: Fix syntax in recipe example (Fix(homepage): Second picked sandbox doesn't open in explore codesandbox/codesandbox-client#1715)
• d420a6a Docs: Have gulp.lastRun take a function to avoid task registration (Error: "Invalid regular expression... Range out of order in character class" codesandbox/codesandbox-client#1828)
• 29ece6f Upgrade: Update undertaker
• e931cb0 Docs: Fix changelog typos (Update prettier to 16.6.4 codesandbox/codesandbox-client#1696)
• 477db84 Docs: Add a "BrowserSync with Gulp 4" recipe (Stock vue template has a Babel error codesandbox/codesandbox-client#1659)
• d4ed3c7 Docs: Add options.cwd for gulp.src API (Storybook codesandbox/codesandbox-client#1645)
• 5dc3b07 Docs: Update gulp.watch API to align with glob-watcher
• 0c66069 Breaking: Replace chokidar as gulp.watch with glob-watcher wrapper
• c3dbc10 Docs: Clarify incremental builds example (Search Improvements codesandbox/codesandbox-client#1609)

See the full diff

Package name: gulp-postcss

The new version differs by 15 commits.

• 9166fdb Release 7.0.1
• 0af46f5 Merge pull request [Snyk] Fix for 47 vulnerabilities #137 from ohbarye/drop-dependency-on-gulp-util
• 6f15b51 Drop dependency on gulp-util
• 3a1d0df Merge pull request [Snyk] Fix for 1 vulnerabilities #126 from gucong3000/coverage
• 2748681 fix eslint error, add test case
• 355d90b add coverage report
• 2cb352f Release 7.0.0
• 8dd0235 Merge pull request [Snyk] Fix for 6 vulnerabilities #116 from postcss/postcss60
• 18e31d8 Use PostCSS 6.0 and drop node 0.12
• 96f6d24 Merge pull request [Snyk] Security upgrade socket.io-client from 2.5.0 to 3.0.0 #113 from gucong3000/eslint
• 7c5e513 npm install --save-dev mocha@3.3.0 sinon@2.2.0
• 2b319cb fix broke tests for node 0.12
• 4201543 add `eslint`
• dd03625 Merge pull request [Snyk] Security upgrade socket.io-client from 2.1.1 to 3.0.0 #112 from jorrit/patch-1
• 28e20ef Cleanup NPM package

See the full diff

Package name: gulp-rev

The new version differs by 21 commits.

• bb3a3fd 8.1.1
• e46406b Replace gulp-util with smaller modules (add contributing guide codesandbox/codesandbox-client#237)
• 6c9bcac Remove Code Sponsor
• fe0c551 8.1.0
• 47ffbe0 Bump `rev-path`
• fc74b5b Try out Code Sponsor
• cdf63fa Pass resolved, absolute paths to relPath() (TypeScript errors on local module imports codesandbox/codesandbox-client#220) (Add possibility to change hotkeys keymap.  codesandbox/codesandbox-client#222)
• 567c340 Update readme.md (Upgrade webpack-dev-server to 2.9.1 codesandbox/codesandbox-client#224)
• 898dffc 8.0.0
• d290ff8 Meta tweaks
• a89f0df Make tests independent of platform specific path separator (Empty (non-framework) template for JavaScript and TypeScript codesandbox/codesandbox-client#219) (Add CONTRIBUTING.md codesandbox/codesandbox-client#221)
• 71a0377 Add a note about non-deterministic streams order (Replace gh-corner codesandbox/codesandbox-client#213)
• f5ee9ee Meta tweaks
• 731be70 Move list of maintainers into the readme for visibility
• 192a075 Meta tweaks
• 7acdb13 Move tests from Mocha to AVA (Fix tests codesandbox/codesandbox-client#212)
• 82c185c More realistic example (Add .gitattributes codesandbox/codesandbox-client#203)
• 02fbeba add XO badge
• 8686e62 [breaking] ES2015ify and require Node.js 4
• ed53cef meta tweaks
• 17d6bb4 docs: change number of approaches (Sandbox preview: make navigator's back button inactive on first load codesandbox/codesandbox-client#196)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Improper Input Validation