[Snyk] Fix for 1 vulnerabilities

[ajesse11x]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	718/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.5	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: browser-sync

The new version differs by 35 commits.

• 2b55728 v2.26.9
• 2bf8812 v2.26.8
• 0f3cc0b fix: npm audit fixes (root)
• ba1f09f fix: npm audit fixes
• d89252a Merge pull request #1749 from ProLoser/securityFix
• df81272 Merge pull request #1771 from tolulawson/master
• 64f87b9 Merge pull request #1768 from fozzleberry/bump-http-proxy-1.18.1
• 43dc459 Merge pull request #1725 from nitinbansal1989/master
• 894d031 -- Corrected codesync tagline
• 0667104 used correct syntax on bump
• 938e611 bumped node engines to >= 8.0.0
• 20a0334 bumped http proxy to >=1.18.1
• c103029 Security fix for #1649
• 864c9f1 upgrade chokidar version
• 2191369 v2.26.7
• 53f9b36 docs: readme
• 0b3d98b v2.26.6
• fdfc681 tests: add e2e tests to package.json
• c56cfd9 Merge pull request #1698 from emeitch/fix_deprecated_header
• 2fd598f Merge pull request #1690 from XhmikosR/xmr-ci
• 841ccd5 Merge pull request #1694 from coliff/patch-1
• 209c9c1 Merge pull request #1697 from gaards/update-localtunnel
• 87bee4b Use getHeaders or _headers
• 77abfd3 Update localtunnel

See the full diff

Package name: gulp-sass

The new version differs by 15 commits.

• 5775044 Update CHANGELOG.md
• 978b8f6 Update to major version 5 (#802)
• 10eae93 Update changelog for 4.1.1
• 947b26c Upgrade lodash to fix a security issue (#776)
• 8d6ac29 Update changelog
• 43c0547 4.1.0
• ebe3ec6 Set appropriate file stat times (#763)
• 7ab018e Migrate to the lodash package
• fa670c6 4.0.2
• fefa00e Revert package.json version bump
• 98254d2 Fix README typos
• 8a14419 Continue loading Node Sass by default
• 938afbe Add a note about synchronous versus asynchronous speed
• 7cc2db1 Make this package implementation-agnostic
• 643f73b Add documentation for synchronous code options

See the full diff

Package name: understrap

The new version differs by 250 commits.

• 1a9747b Merge pull request #1279 from understrap/release/0.9.6
• a2d77e7 Merge pull request #1273 from schnoggo/master
• 032d711 Updates version umber and changelog.
• 2169a04 Merge remote-tracking branch 'remotes/origin/includes' into release/0.9.6
• b67af17 Use get_theme_file_path() to make include files child theme friendly.
• a415b82 Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/ua-parser-js-0.7.28' into update/dependencies
• 5033d8a Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/lodash-4.17.21' into update/dependencies
• a504ac2 Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/hosted-git-info-2.8.9' into update/dependencies
• c53120c Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/postcss-8.2.10' into update/dependencies
• 78ed1e1 Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/browserslist-4.16.6' into update/dependencies
• b40ada9 Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/ws-7.4.6' into update/dependencies
• dc0f6e0 Make the credits links https.
• 2b7720e Merge pull request #1270 from understrap/point-release
• 9789232 increments version number.
• 60fff40 Bump ws from 7.4.3 to 7.4.6
• c7990df Bump browserslist from 4.16.1 to 4.16.6
• 78da2f7 Bump postcss from 8.2.9 to 8.2.10
• 8f761fc Bump hosted-git-info from 2.8.8 to 2.8.9
• 068e3af Bump lodash from 4.17.20 to 4.17.21
• 0dc4cc1 Bump ua-parser-js from 0.7.23 to 0.7.28
• 44edc3d Merge pull request #1251 from IanDelMar/deps
• 6f7e7dd Bump @ babel/preset-env from 7.13.12 to 7.13.15
• aa35e25 Bump @ babel/core from 7.13.14 to 7.13.15
• 34c6599 Bump squizlabs/php_codesniffer from 3.5.8 to 3.6.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled Resource Consumption ('Resource Exhaustion')