[Snyk] Security upgrade serialize-javascript from 2.1.0 to 3.1.0

[ekmixon]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • community-modules/react/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	706/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.7	Arbitrary Code Injection SNYK-JS-SERIALIZEJAVASCRIPT-570062	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: serialize-javascript

The new version differs by 25 commits.

• b54341e v3.1.0
• 7cee7e4 Revert "support for bigint ([Snyk] Security upgrade @angular-devkit/build-angular from 0.900.7 to 0.1102.11 #80)"
• 026a445 Bump mocha from 7.1.2 to 7.2.0 ([Snyk] Security upgrade @vue/cli-plugin-unit-jest from 3.12.1 to 4.0.0 #83)
• 5130a71 support for bigint ([Snyk] Security upgrade @angular-devkit/build-angular from 0.900.7 to 0.1102.11 #80)
• ea76b23 Bump mocha from 7.1.1 to 7.1.2 ([Snyk] Security upgrade @vue/cli-plugin-unit-jest from 3.12.1 to 4.0.0 #82)
• 073c8d8 Bump nyc from 15.0.0 to 15.0.1 ([Snyk] Security upgrade image-webpack-loader from 6.0.0 to 8.0.0 #81)
• f21a6fb Don't replace regex / function placeholders within string literals ([Snyk] Security upgrade optimize-css-assets-webpack-plugin from 5.0.4 to 5.0.5 #79)
• 1ac487e [Security] Bump minimist from 1.2.0 to 1.2.5 ([Snyk] Fix for 2 vulnerabilities #78)
• c795cef Bump mocha from 7.1.0 to 7.1.1 ([Snyk] Security upgrade optimize-css-assets-webpack-plugin from 5.0.4 to 5.0.5 #77)
• 3064431 Bump mocha from 7.0.1 to 7.1.0 ([Snyk] Security upgrade cssnano from 4.1.11 to 5.0.0 #74)
• 9dbe8f6 Update example in README ([Snyk] Security upgrade @angular-devkit/build-angular from 0.900.7 to 0.1102.11 #73)
• f5957ee v3.0.0
• eed510c Introduce support for Infinity ([Snyk] Fix for 1 vulnerabilities #72)
• 82bb2d2 Bump mocha from 7.0.0 to 7.0.1 ([Snyk] Fix for 1 vulnerabilities #71)
• fdfb10a Test on Node.js v12 ([Snyk] Security upgrade jest from 25.5.4 to 26.0.0 #70)
• 2f5f126 Bump mocha from 6.2.2 to 7.0.0 ([Snyk] Security upgrade karma from 4.1.0 to 5.0.8 #69)
• 35062c0 Bump nyc from 14.1.1 to 15.0.0 ([Snyk] Fix for 1 vulnerabilities #68)
• 6c43b02 v2.1.2
• 3e05a3f Ignore .nyc_output ([Snyk] Security upgrade jest from 25.5.4 to 26.0.0 #64)
• 3c46e8e Bump mocha from 6.2.0 to 6.2.2 ([Snyk] Fix for 1 vulnerabilities #62)
• 433fc9c 2.1.1
• 16a68ab Merge pull request from GHSA-h9rv-jmmf-4pgx
• 3bab6de Bump mocha from 6.2.1 to 6.2.2 ([Snyk] Fix for 1 vulnerabilities #60)
• 7a6b13d Bump mocha from 6.2.0 to 6.2.1 ([Snyk] Security upgrade lerna from 3.22.1 to 4.0.0 #59)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Arbitrary Code Injection

[secure-code-warrior-for-github]

Micro-Learning Topic: Code injection (Detected by phrase)

Matched on "Code Injection"

What is this? (2min video)

Code injection happens when an application insecurely accepts input that is subsequently used in a dynamic code evaluation call. If insufficient validation or sanitisation is performed on the input, specially crafted inputs may be able to alter the syntax of the evaluated code and thus alter execution. In a worst case scenario, an attacker could run arbitrary code in the server context and thus perform almost any action on the application server.

Try a challenge in Secure Code Warrior

Helpful references

• OWASP Command Injection - OWASP community page with comprehensive information about Code Injection, and links to various OWASP resources to help detect or prevent it.
• SEI CERT Oracle Coding Standard for Java - Prevent Code Injection - Carnegie Mellon University Software Engineering Institute guidance on preventing code injection vulnerabilities in Java.