[Snyk] Fix for 6 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

  • package.json
  • package-lock.json

• Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
  Find out more.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-ASYNCVALIDATOR-2311201	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-1579269	No	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-1016634	No	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-1035544	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Directory Traversal SNYK-JS-MOMENT-2440688	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: antd

The new version differs by 250 commits.

• 870b72a docs: 4.17.0 changelog (#32859)
• 3a5b6b8 chore(deps-dev): bump stylelint-config-standard from 23.0.0 to 24.0.0 (#32866)
• 7e2dc80 chore(.gitignore):add ignore for pnpm (#32860)
• 491cc4f fix: borderLeftRadius error for Input.Search #32808 (#32812)
• 958df3d docs: add demo for Input.Group (#32837)
• ce006bd docs: Version Robin (#32830)
• 3f495bb chore: Upgrade react router v6 (#32821)
• 43569b9 docs: update customize-theme-variable.zh-CN.md
• 7ed7c60 style: fix Tree icon align bug (#32822)
• 01887b4 fix: if breadcrumbRender return false, breadcrumb will hidden (#32738)
• 5f642cb fix: tag animation demo (#32804)
• 852a451 chore(Tag): update tween-one (#32800)
• 90aff3a docs: fix Spin API ts description (#32786)
• 8a3b5d9 fix: Form horizontal broken style when select item is too long (#32778)
• a73f4a3 docs: Fix the link in Table's API doc (#32779)
• ecc54dd fix: codepen demo error using hooks (#32766)
• cf15379 docs: add 4.17.0-alpha.10 changelog (#32775)
• f7380b7 chore(deps-dev): bump eslint-plugin-unicorn from 37.0.1 to 38.0.0 (#32765)
• b1ea2e4 fix: opening animation of the bottom drawer (#32761)
• 10a8578 fix: Spin tip can be react node (#32733)
• fa65cd3 chore(deps-dev): bump @ types/gtag.js from 0.0.7 to 0.0.8 (#32746)
• f88bd4d refactor: Move part mixins less to theme instead (#32763)
• 5360722 chore: update form demo
• ea52572 chore(💄): fix issue template

See the full diff

Package name: axios

The new version differs by 41 commits.

• e367be5 [Releasing] 0.21.3
• 83ae383 Correctly add response interceptors to interceptor chain (Recycle gunicorn workers getredash/redash#4013)
• c0c8761 [Updating] changelog to include links to issues and contributors
• 619bb46 [Releasing] v0.21.2
• 82c9455 Create SECURITY.md (Mattermost needs whitespace to use heading getredash/redash#3981)
• 5b45711 Security fix for ReDoS (Shared dashboard footer should be always aligned to the bottom getredash/redash#3980)
• 5bc9ea2 Update ECOSYSTEM.md (Redsah returns HTTP 500 after PostgreSQL connection was closed getredash/redash#3817)
• e72813a Fixing README.md (select column from mysql there is no result getredash/redash#3818)
• e10a027 Fix README typo under Request Config (Include bigquery_gce.png in db-logos getredash/redash#3825)
• e091491 Update README.md (M23 rebase getredash/redash#3936)
• b42fbad Removed un-needed bracket
• 520c8dc Updating CI status badge (Remove time from Date column in filters getredash/redash#3953)
• 4fbeecb Adding CI on Github Actions. (Add 'connection_source' property in presto query runner getredash/redash#3938)
• e9965bf Fixing the sauce labs tests (delete variable getredash/redash#3813)
• dbc634c Remove charset in tests (Integration tests for query runners (data sources) getredash/redash#3807)
• 3958e9f Add explanation of cancel token ("Now" in DateTime parameter isn't working getredash/redash#3803)
• 69949a6 Adding custom return type support to interceptor (Migrate Embed Query Dialog to React getredash/redash#3783)
• 49509f6 Create FUNDING.yml (Search dropdown parameters getredash/redash#3796)
• 199c8aa Adding parseInt to config.timeout (Add presetted ranges to DateRange and DateTimeRange inputs getredash/redash#3781)
• 94fc4ea Adding isAxiosError typeguard documentation (Embeds with no parameters are not working getredash/redash#3767)
• 0ece97c Fixing quadratic runtime when setting a maxContentLength (How Can i run redash in docker stack ? getredash/redash#3738)
• a18a0ec Updating `lib/core/README.md` about Dispatching requests (Provide help strings for Data Source configuration fields getredash/redash#3772)
• 59fa614 [Updated] follow-redirects to the latest version (Split Data Sources (and Alert Destinations) setup to regular and advanced getredash/redash#3771)
• 7821ed2 Feat/json improvements (Weekly Digest (29 April, 2019 - 6 May, 2019) getredash/redash#3763)

See the full diff

Package name: dompurify

The new version differs by 250 commits.

• 7923e10 chore: Preparing 2.2.2 release
• 7719c5b test: Added test cases for reported bypasses
• e43de71 fix: squished another variation of the mXSS
• 0771f47 chore: Preparing 2.2.1 release
• ee33fae fix: Fixed a mXSS bypass reported in Feature: CORS support for the Query Result API to allow embedding in other domains getredash/redash#482
• e95b0de see Feature: support for multiple domains with Google OAuth getredash/redash#480
• 83b7acb See Feature: improved error reporting and new log information support for the Python query runner getredash/redash#479
• 0e31dce chore: preparing 2.2.0 release
• 307c7d0 test: added tests to cover new RETURN_DOM_IMPORT default being true
• 5aab0bb fix: fixed a typo in the config option logic for DOM_RETURN_IMPORT
• 8f15cd1 fix: changed RETURN_DOM_IMPORT flag to true in config block
• 1aecfe7 fix: xExperimentally set RETURN_DOM_IMPORT to true by default
• 02ae0af Merge pull request bootstrap.sh: 102: bootstrap.sh: Bad substitution getredash/redash#474 from MatmaRex/patch-1
• 89a0539 Remove mention of the removed SAFE_FOR_JQUERY flag in README
• 461589a chore: prepared 2.1.1 release
• 32b3241 chore: preparing 2.1.1 release
• daf4c05 docs: updated acknowledgements on README
• b552659 fix: re-enabled the mXSS check for old Chrome at the right place
• aec12c4 fix: Re-added an mXSS check for old Chrome
• 4586294 test: removed Node 15 again from test matrix
• 495c948 test: Added Node 14.x and 15.x to test jobs
• 075e58a fix: changed short comment to long to avoid micro-mutations
• 0228425 test: stripped SAFE_FOR_JQUERY from several tests
• 4eb5d93 test: removed a Safari 8 specific test

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)
🦉 Cross-site Scripting (XSS)
🦉 Directory Traversal