[Snyk] Fix for 28 vulnerabilities

[aliceUnhinged613]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • deps/npm/docs/package.json
  • deps/npm/docs/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-CSSWHAT-1298035	Yes	No Known Exploit
	909/1000 Why? Mature exploit, Has a fix available, CVSS 9.6	Heap-based Buffer Overflow SNYK-JS-CWEBPBIN-5923346	No	Mature
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Arbitrary File Write via Archive Extraction (Zip Slip) SNYK-JS-DECOMPRESSTAR-559095	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-EVENTSOURCE-2823375	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	No	Proof of Concept
	484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	No	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-NTHCHECK-1586032	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Authorization Bypass Through User-Controlled Key SNYK-JS-PARSEPATH-2936439	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	No	Proof of Concept
	536/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-1047770	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-1584358	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-1585624	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-2824151	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-TRIM-1017038	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Prototype Pollution SNYK-JS-XML2JS-5414874	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gatsby

The new version differs by 250 commits.

• 8d07242 chore(release): Publish
• 0790895 chore(gatsby): Update README (events: set target property to null nodejs/node#33615)
• 06760d7 chore(gatsby): Change comment format in actions/public (src: don't use semicolon outside function nodejs/node#33592)
• 7d66a23 feat(gatsby): capture number of ssg,dsg,ssr pages in telemetry ([v12.x] deps: update to ICU 67.1 nodejs/node#33337)
• 98a843c fix(gatsby): use lmdb.removeSync so getNode can't return deleted nodes (src: use MaybeLocal.ToLocal instead of IsEmpty nodejs/node#33554)
• 4d8e40b fix(gatsby-source-wordpress): Add steps for `refetch_ALL` (#33264)
• 4761dc3 fix(gatsby): restore onPreBuild to being called right after bootstrap finishes (async-resource-vs-destroy benchmark is broken locally nodejs/node#33591)
• 1cdbab6 fix(deps): update starters and examples gatsby packages to ^3.14.3 ([v12.x] deps: V8: cherry-pick 548f6c81d424 nodejs/node#33553)
• 0f421db chore(release): Publish next
• 7d6a0aa fix(gatsby): fix page-tree in ink-cli (deps: update V8 to 8.4 nodejs/node#33579)
• 3993819 chore(gatsby): Add `assetPrefix` to `IGatsbyConfig` (async_hooks: improve resource stack performance nodejs/node#33575)
• 6cc964a fix(gatsby-source-wordpress): restore PQR support (support util.promisify for fs.readv nodejs/node#33590)
• 9eef270 specifying what actually changed (v14.3.0 proposal nodejs/node#33452)
• 2975c4d feat(gatsby,gatsby-link): add queue to prefetch (doc: outline when origin is set to unhandledRejection nodejs/node#33530)
• 68fe836 fix(gatsby): temporary workaround for stale jobs cache (Use stream._construct nodejs/node#33586)
• a800d9d fix(gatsby): Update internal usage of .runQuery (New label suggestion: awaiting release nodejs/node#33571)
• 677760c chore(docs): Clarify SEO component guide (src: add default: case to silence compiler warning nodejs/node#33451)
• ccca4b3 fix(gatsby): only remove unused code when apis got removed (lib: initial experimental AbortController implementation nodejs/node#33527)
• 8dbf550 fix(gatsby): assign correct parentSpans to PQR activities (support nested headers in http2 nodejs/node#33568)
• 31d5a5e fix(gatsby-dev-cli): resolve correct versions of packages with unpkg (http: simplify Agent initialization nodejs/node#33551)
• 5110074 fix(gatsby-plugin-gatsby-cloud): emit file nodes after source updates (doc: fix misc. mislabeled code block info strings nodejs/node#33548)
• d2329df fix(gatsby): make sure 404 and 500 page inherit stateful status from original page (wasi: allow WASI stdio to be configured nodejs/node#33544)
• 68e5b90 chore(docs): Update query var in part-7 tutorial (feature-request fs.fileWrite with option.mkdirp nodejs/node#33559)
• a8cab55 chore(gatsby-plugin-react-helmet): Update Examples (src: use NewFromUtf8Literal in GetLinkedBinding nodejs/node#33552)

See the full diff

Package name: gatsby-plugin-sharp

The new version differs by 250 commits.

• c1e67a2 chore(release): Publish
• 0c45654 chore: remove tracedSVG (CONTRIBUTING.md nodejs/node#37093) (just some practice nodejs/node#37137)
• d7edf95 chore(release): Publish
• 2d00ea0 fix(gatsby-plugin-mdx): Do not leak frontmatter into page (ESM importing a CommonJS calls getters nodejs/node#35859) (fix comment nodejs/node#35913)
• 4997d63 chore(release): Publish
• ff94ed5 fix(gatsby-plugin-mdx): don't allow JS frontmatter by default (zlib: test BrotliCompress throws invalid arg value nodejs/node#35830) (#35834)
• 36f21b0 chore: Removate validate-renovate from v3-latest branch (src: guard against nullptr deref in TimerWrapHandle::Stop nodejs/node#34460)
• 1acb1bc chore(release): Publish
• 1589bd8 fix(gatsby): ensure that writing node manifests to disk does not break on Windows (Why the http client does not support the keep alive feature? nodejs/node#33853) (tls: add getter and setter for session ticket number. nodejs/node#34020)
• 9694010 fix(gatsby-source-drupal): Ensure all new nodes are created before creating relationships (Rename default branch from "master" to "main" nodejs/node#33864) (quic: fix lint error in node_quic_crypto nodejs/node#34019)
• 76deb39 fix(gatsby-source-drupal): searcParams missing from urls (Value display error nodejs/node#33861) (fix drain() function for "Piping to writable streams from async iterators" nodejs/node#34018)
• f74cc8f feat(gatsby-source-drupal): Add node manifest support for previews (src: remove unnecessary ToLocalChecked call nodejs/node#33683) (timers: allow timers to be used as primitives nodejs/node#34017)
• 476a591 chore(release): Publish
• 35b48f8 fix(gatsby-plugin-image): GatsbyImage not displaying image in IE11 (module: CJS exports detection for modules with __esModule export nodejs/node#33416) (VM aborts when error thrown when in property setter nodejs/node#33806)
• 880022e fix(gatsby-plugin-image): flickering when state changes (lib/internal/util.js#join function is slower than the built-in Array#join nodejs/node#33732) (v8: implement v8.takeCoverage() and v8.stopCoverage() nodejs/node#33807)
• c0d07e7 feat(gatsby-source-wordpress): Update supported-remote-plugin-versions.ts (async_hooks: callback trampoline for MakeCallback nodejs/node#33801) (n-api: document nextTick timing in callbacks nodejs/node#33804)
• 3d9a702 chore(release): Publish
• 84053a2 fix(gatsby-plugin-sharp): pass input buffer instead of readStream when processing image jobs (build: fix node.gyp config nodejs/node#33685) (node --jitless segfault on mipsel or mips64el nodejs/node#33703)
• 4722a0d fix(gatsby-source-drupal): Add timeout in case of stalled API requests (invalid syntax for loop in python  nodejs/node#33668) (doc: UNABLE_TO_VERIFY_LEAF_SIGNATURE/unable to verify the first certificate error not documented nodejs/node#33705)
• 857a628 fix(gatsby): single page node manifest accuracy (benchmark: fix async-resource benchmark nodejs/node#33642) (Unexpected performance penalty when using field initialiser nodejs/node#33698)
• 6bfd0f1 Properly set the pathPrefix and assetPrefix in the pluginData (doc:  nodejs/node#33667) (deps: V8: re-enable interpreted frames native stack on S390 nodejs/node#33702)
• 26c51c0 fix(gatsby-source-drupal): cache backlink records (src: use enum for refed flag on native immediates nodejs/node#33444) (#33701)
• b80c53a fix(gatsby-source-drupal): Correctly update nodes with changed back references so queries are re-run (src: forbid lt and gt in url host code point nodejs/node#33328) (Why does HTTP1 module lack support for certain request methods? nodejs/node#33699)
• e29a194 chore: use gatsby-dev-cli@latest-v3 in tests

See the full diff

Package name: gatsby-transformer-remark

The new version differs by 250 commits.

• e98cb62 chore(release): Publish
• 164f9a1 fix(gatsby-source-contentful): De-dupe type names (test: scale keepalive timeouts for slow machines nodejs/node#30834) (Assertion `!flush_tasks_' failed in parallel/test-worker-memory nodejs/node#30850)
• 0b99d00 fix(gatsby): webpack warnings are no longer in object format by default (doc: fix recommendation of setImmediate() over process.nextTick() nodejs/node#30801) (FinalizationGroup in combination with buffers seems to allocate memory without releasing it nodejs/node#30853)
• f561724 fix(gatsby): lower memory pressure in SSR (#30793) (stream: error state timing nodejs/node#30851)
• 96805d5 fix(gatsby-source-wordpress): change `console.warning` to `console.warn` (assert,util: always verify both sides nodejs/node#30764) (console: unregister temporary error listener nodejs/node#30852)
• e40c83d chore(release): Publish next
• a5b5cf8 feat: upgrade to remark 13 (Impossible to catch error during tls.connect(duplex) nodejs/node#29678)
• 172cf4d chore(docs): Add link to perf implications siteContext (lib: delay access to CLI option to pre-execution nodejs/node#30778)
• 4336d04 fix(gatsby-plugin-gatsby-cloud): Add missing index.js (so the plugin can be resolved in workspaces) (test: increase debugging information in subprocess test nodejs/node#30761)
• 2bdd5a5 fix(gatsby-source-wordpress): only log out duplicate node if we have all the data we want to log (src: improve node_crypto.cc memory allocation nodejs/node#30751)
• 1a9b830 fix(gatsby-plugin-image): Don't inherit all img styles (test: use block-scoping in test-net-server-address nodejs/node#30754)
• e0df4cc chore(docs): Change "whitelist" to "allow list" (doc: revise addons introduction for brevity and clarity nodejs/node#30756)
• 81ec270 chore: Add backport script (inspector: do not access queueMicrotask from global nodejs/node#30732)
• 63cc8fa fix(docs): Copy edits for debugging html doc + add React-specific example (wasi: use memory-tracking allocator nodejs/node#30745)
• eed1d43 fix(docs): Add link to how to enable DEV_SSR for fixing inconsistent css styles between dev/prod (doc: clarify text about using 'session' event for compatibility nodejs/node#30746)
• ecd823f perf(gatsby): cache babel config items (doc: amplify warning for execute callback nodejs/node#28738)
• a60e92f chore(release): Publish next
• dd9e95c docs(gatsby-plugin-image): Note on tracedSVG options name change (stream: improve write performance nodejs/node#30736)
• a5869e3 fix(gatsby-plugin-image): Use bare GATSBY___IMAGE global (deps: V8: cherry-pick 0dfd9ea51241 nodejs/node#30713)
• 0f3fa4e fix(contentful): make gatsby-plugin-image a peer dependency (vm: introduce vm.Context nodejs/node#30709)
• 6b2fd94 fix(gatsby-source-wordpress): pass missing property helpers to gql fetch util ([v8.x backport] Windows CI job update changes nodejs/node#30727)
• c6fa488 chore(docs): Update wording of tutorial part 8 (DanFruth test edit nodejs/node#30606)
• a777367 fix(gatsby-cli): Update docs links in error-map (deps: update nghttp2 to 1.40.0 nodejs/node#30493)
• c473abf chore(docs): include autoprefixer in tailwind install command (tls: introduce ERR_TLS_INVALID_CONTEXT nodejs/node#30718)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn