[Snyk] Fix for 25 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • test/fixtures/qs-package/node_modules/clite/package.json
  • test/fixtures/qs-package/node_modules/clite/.snyk

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	Yes	No Known Exploit
	509/1000 Why? Has a fix available, CVSS 5.9	Denial of Service (DoS) SNYK-JS-JSYAML-173999	Yes	No Known Exploit
	619/1000 Why? Has a fix available, CVSS 8.1	Arbitrary Code Execution SNYK-JS-JSYAML-174129	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
	541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	635/1000 Why? Has a fix available, CVSS 8.2	Information Disclosure SNYK-JS-SEMANTICRELEASE-1041706	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:hoek:20180212	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
	576/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.1	Uninitialized Memory Exposure npm:tunnel-agent:20170305	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: semantic-release

The new version differs by 250 commits.

• c8d38b6 style: removed line breaks to align with xo rule ([Snyk] Security upgrade nyc from 2.4.0 to 5.0.0 #1689)
• ca90b34 fix: mask secrets when characters get uri encoded
• 63fa143 docs(plugins): add listing for new plugin ([Snyk] Security upgrade tap from 0.3.3 to 1.0.8 #1686)
• 2bf3771 fix: use valid git credentials when multiple are provided ([Snyk] Fix for 3 vulnerabilities #1669)
• 77a75f0 fix: don't parse port as part of the path in repository URLs ([Snyk] Security upgrade boxen from 0.3.1 to 1.2.0 #1671)
• d74ffef docs: add npm-deprecate-old-versions in plugins list ([Snyk] Fix for 1 vulnerabilities #1667)
• 3abcbaf Revert "feat: throw an Error if package.json has duplicate "repository" key ([Snyk] Fix for 1 vulnerabilities #1656)"
• b8fb35c feat: throw an Error if package.json has duplicate "repository" key ([Snyk] Fix for 1 vulnerabilities #1656)
• 18e35b2 docs: reorder default plugins list ([Snyk] Fix for 1 vulnerabilities #1650)
• e35e5bb docs(contributing): fix commit message examples ([Snyk] Security upgrade tap from 1.4.1 to 18.0.0 #1648)
• 311c465 docs(README): welcome @ travi, add alumni section
• b4c5d0a fix: add logging for when ssh falls back to http ([Snyk] Fix for 1 vulnerabilities #1639)
• c982249 docs(contributing): typo fix ([Snyk] Security upgrade tap from 0.7.1 to 18.0.0 #1638)
• 9635f50 docs: improve github actions recipe on git plugin ([Snyk] Security upgrade eslint from 3.19.0 to 6.0.0 #1626)
• d036a89 ci(docs): use actions/checkout@v2 ([Snyk] Security upgrade tap from 0.2.6 to 1.0.8 #1620)
• 9303d1d docs(resources.md): added more sematnic release article ([Snyk] Security upgrade tap from 1.4.1 to 16.0.0 #1610)
• b72cdb3 docs(configuration.md): Updated documentation for dry-run feature of semantic Release ([Snyk] Fix for 6 vulnerabilities #1607)
• ee44ee8 docs(github-actions): suggest action_dispatch as trigger ([Snyk] Security upgrade ms from 1.0.0 to 2.0.0 #1605)
• b24d247 docs: add `semantic-release-rubygem` to community plugins ([Snyk] Security upgrade mocha from 2.5.3 to 4.0.0 #1602)
• 6d118c6 docs: be clear about what module of semantic-release handles updating the package.json ([Snyk] Security upgrade browserify from 10.2.6 to 12.0.0 #1601)
• b5c9dea docs: update github documentation to `docs.github.com`
• 1405b94 docs: added recipe for Jenkins CI configuration ([Snyk] Upgrade @octokit/rest from 18.5.4 to 18.5.6 #1) ([Snyk] Fix for 26 vulnerabilities #1591)
• 0f0c650 fix: use correct ci branch context ([Snyk] Fix for 1 vulnerabilities #1521)
• a465801 feat(bitbucket-basic-auth): support for bitbucket server basic auth ([Snyk] Security upgrade tap from 11.1.3 to 16.0.0 #1578)

See the full diff

Package name: tap

The new version differs by 250 commits.

• eaa0084 14.6.8
• e7cff4d update deps to node >=8 requirements
• b9e53c2 update cli doc
• 9917a7a 14.6.7
• 125aae3 async-hook-domain@1.1.1
• ce0c629 update cli doc
• eb2bded 14.6.6
• 7f453f5 Set nyc color watermarks based on check-coverage levels
• 28e7db5 update cli doc
• fb852ee 14.6.5
• eeb423a minipass@2.8.3
• 5b83028 watch: add --no-clean to nyc args on change tests
• 6a4d64b track thrown error when timeout/throws happen during promise waiting
• 5b977e1 update cli doc
• 49e9df0 14.6.4
• 6d37040 update deps, remove npm-shrinkwrap.json
• d19ab3d update cli doc
• 1436f4f 14.6.3
• a266e30 Fail if error is thrown while awaiting a Promise
• 73e7496 update cli doc
• 443786c 14.6.2
• 36d6dc5 Properly handle test aborts when awaiting promises
• 28cd2ff update cli doc
• 8d280c3 14.6.1

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:hawk:20160119	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Timing Attack npm:http-signature:20150122	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	No Known Exploit
	469/1000 Why? Has a fix available, CVSS 5.1	Remote Memory Exposure npm:request:20160119	No Known Exploit
	576/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.1	Uninitialized Memory Exposure npm:tunnel-agent:20170305	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Arbitrary Code Execution
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn