[Snyk] Security upgrade linkinator from 2.13.1 to 4.0.0

[dmvol81]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	556/1000 Why? Recently disclosed, Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: linkinator

The new version differs by 108 commits.

• 2cab633 feat: create new release with notes (Missed slash in "if" and minor formatting github/docs#508)
• a376199 fix!: stream CSV results (repo sync github/docs#507)
• 18d808c chore(deps): update dependency @ types/update-notifier to v6 (repo sync github/docs#503)
• 0ee27e0 chore(deps): update dependency got to 11.8.5 [security] (Update testing-webhooks.md github/docs#505)
• 5ef0e1e build!: drop support for nodejs 12.x (docs: add tnir as a contributor github/docs#506)
• eeebebd build(deps-dev): bump semantic-release from 19.0.2 to 19.0.3 (Multiple deploy keys github/docs#501)
• da166dd build(deps): bump semver-regex from 3.1.3 to 3.1.4 (Multiple Unique Deployment Keys on One Server. github/docs#500)
• 4c63eb8 build(deps): bump npm from 8.3.1 to 8.12.0 (Fix and extend push webhook documentation. github/docs#499)
• 5ca5a46 feat: allow --skip to be defined multiple times (https://github.com/github/docs/pull/398#issue-501049475 github/docs#399)
• 9c2b5d8 chore(deps): update dependency sinon to v14 (Update defining-the-mergeability-of-pull-requests.md github/docs#398)
• d334dc6 fix(deps): upgrade node-glob to v8 (.Update keyboard-shortcuts.md github/docs#397)
• ba3b9a8 fix(deps): upgrade to htmlparser2 v8.0.1 (Translation of the last line into Portuguese github/docs#396)
• 48af50e fix(deps): update dependency gaxios to v5 (Repairing .allcontributorsrc github/docs#391)
• 78ae8b5 chore(deps): update github/codeql-action action to v2 (Update autolinked-references-and-urls.md github/docs#393)
• 0b31851 chore(deps): update dependency mocha to v10 (Update identifying-and-authorizing-users-for-github-apps.md github/docs#394)
• e586584 build(deps): bump minimist from 1.2.5 to 1.2.6 (docs: Add Chinese translation github/docs#387)
• 1cc3a88 docs: Update latest major version specified in SECURITY.md (repo sync github/docs#380)
• 833fd33 chore(deps): update actions/checkout action to v3 (#385)
• 1835248 chore(deps): update actions/setup-node action to v3 (#383)
• 4a16353 build(deps): bump simple-get from 3.1.0 to 3.1.1 (repo sync github/docs#379)
• 65dfb90 chore(deps): update dependency simple-get to 3.1.1 [security] (Neftali github/docs#378)
• 96d3ddf chore(deps): update dependency nanoid to 3.1.31 [security] (repo sync github/docs#377)
• ad1e73e build(deps): bump node-fetch from 2.6.1 to 2.6.7 (API Libraries Design update github/docs#376)
• 9b287c3 chore(deps): update dependency sinon to v13 (repo sync github/docs#375)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect

[sonatype-lift]

Critical OSS Vulnerability:

pkg:npm/linkinator@4.0.0

1 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components

pkg:npm/minimist@1.2.5

CRITICAL Vulnerabilities (1)




[CVE-2021-44906] Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

CVSS Score: 9.8

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-1321

pkg:npm/node-fetch@2.6.7

SEVERE Vulnerabilities (1)




[sonatype-2022-3677] CWE-200: Information Exposure

node-fetch - Exposure of Sensitive Information to an Unauthorized Actor

An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.

CVSS Score: 4.2

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE: CWE-200

Reply with "@sonatype-lift help" for info about LiftBot commands.
Reply with "@sonatype-lift ignore" to tell LiftBot to leave out the above finding from this PR.
Reply with "@sonatype-lift ignoreall" to tell LiftBot to leave out all the findings from this PR and from the status bar in Github.

When talking to LiftBot, you need to refresh the page to see its response. Click here to get to know more about LiftBot commands.

---

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]