[Snyk] Fix for 1 vulnerabilities

[one3chens]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: hexo-cli

The new version differs by 114 commits.

• 0335fce Merge pull request Duplicated categories hexojs/hexo#101 from curbengh/3.0.0
• 3ae4402 chore(deps-dev): bump mocha from 6.2.0 to 6.2.1 (TagCloud hexojs/hexo#117)
• 01a87f7 chore(deps-dev): bump eslint from 6.4.0 to 6.5.1 (Create API hexojs/hexo#119)
• 10326e8 Merge pull request github page 上 hexo 切换phase主题出现问题 hexojs/hexo#114 from hexojs/dependabot/npm_and_yarn/sinon-7.5.0
• fd09efb Merge pull request Fixed #105. hexojs/hexo#115 from hexojs/dependabot/npm_and_yarn/acorn-7.1.0
• 979b89e Merge pull request window下deploy不成功 到输入username那里卡死 hexojs/hexo#116 from hexojs/dependabot/npm_and_yarn/hexo-util-1.3.1
• 1f25ab8 chore(deps): bump hexo-util from 1.2.0 to 1.3.1
• 82409a2 chore(deps): bump acorn from 7.0.0 to 7.1.0
• 968a6a7 chore(deps-dev): bump sinon from 7.4.2 to 7.5.0
• ae2fb4a Merge pull request Index页面重复出现链接相同的文章 hexojs/hexo#113 from hexojs/dependabot/npm_and_yarn/hexo-log-1.0.0
• 9cb01b6 Bump hexo-log from 0.2.0 to 1.0.0
• 5f33447 fix(console): formatting output (【light主题】photo layout的内容如果是空的，post内将会显示layout等设置信息 hexojs/hexo#111)
• da3b091 Bump eslint from 6.3.0 to 6.4.0 (Tags bottom page hexojs/hexo#110)
• bc68c5c Bump hexo-util from 1.1.0 to 1.2.0 (貌似不能忽略以~结尾的备份文件 hexojs/hexo#109)
• 8085f61 Bump hexo-util from 1.0.1 to 1.1.0 (light主题的photo layout显示有误 hexojs/hexo#108)
• 39f7e71 Bump sinon from 7.4.1 to 7.4.2 ([Q] Source folder.htaccess hexojs/hexo#107)
• 396f5aa Bump hexo-fs from 1.0.2 to 2.0.0 (v1.0.4 generate时报错 hexojs/hexo#106)
• c183d2b Bump eslint from 6.2.2 to 6.3.0 (hexo deploy 提示 'github' does not appear to be a git repository hexojs/hexo#105)
• 9939cb6 [Security] Bump mixin-deep from 1.3.1 to 1.3.2 (生成的 permalink 与设置不符 hexojs/hexo#103)
• 7394f7f Bump hexo-util from 1.0.0 to 1.0.1 (中文乱码 hexojs/hexo#104)
• 1b3c068 Bump eslint from 6.2.1 to 6.2.2 (TagCloud font-size hexojs/hexo#102)
• 673e6b8 release: 3.0.0
• 43a34b8 fix(doc): Moved travis-ci from .org to .com (文章網址格式 hexojs/hexo#100)
• 8aef007 Merge pull request How to upgrade to new version? hexojs/hexo#99 from hexojs/dependabot/npm_and_yarn/hexo-renderer-marked-2.0.0

See the full diff

Package name: hexo-fs

The new version differs by 68 commits.

• 780a5a9 Merge pull request 生成Tag错误问题 hexojs/hexo#46 from curbengh/2.0.0
• b108888 release: 2.0.0
• 3cde091 Refactor(test): tuple to map (0.4.5又出现了偶尔generate报错的问题 hexojs/hexo#45)
• 2d2efcd Merge pull request 生成url的空格问题 hexojs/hexo#44 from segayuu/Refactor-test-1
• 7d600ad Destructuring path module
• ba54c11 Refactor test
• bca03f3 Merge pull request windows 7下generate出错 hexojs/hexo#43 from segayuu/Refactor-useful-chai-as-promised
• 21da957 Fix test: Usefull chai-as-promised
• afc4e3e Install chai-as-promised
• 0154d8a Merge pull request 無法安裝 hexo-renderer-discount 插件 hexojs/hexo#41 from curbengh/badge
• 8fec0e0 Merge pull request 在Archives中点击文章标题，出现链接失效。。。 hexojs/hexo#42 from hexojs/dependabot/npm_and_yarn/escape-string-regexp-tw-2.0.0
• 9071966 Update escape-string-regexp requirement from ^1.0.5 to ^2.0.0
• 060fcba docs(readme): fix appveyor badge
• 726da41 docs(readme): add npm link and fix appveyor link
• 719038e Merge pull request scripts功能 hexojs/hexo#37 from hexojs/dependabot/npm_and_yarn/eslint-tw-6.0.1
• d2100fb Merge pull request tag bug hexojs/hexo#38 from curbengh/nyc
• 8c83d6e fix: hasOwnProperty syntax
• 35df948 chore: deprecate npmignore (在批量生成报错的时候不知道具体出问题的文件名 hexojs/hexo#40)
• 6e32aed chore: add node 12 to appveyor (rsync deploy的时候会有短暂的页面不存在错误 hexojs/hexo#39)
• 1716d2a test: replace istanbul with nyc
• 29643ad eslint fiixes
• 491ae31 Update eslint requirement from ^5.16.0 to ^6.0.1
• 571e1b9 fix chokidar update by removing support for nodejs 6 (bash: 未预期的符号 `newline' 附近有语法错误 hexojs/hexo#34)
• 20cb85a Revert "Update escape-string-regexp requirement from ^1.0.5 to ^2.0.0" (改寫彙整布局 hexojs/hexo#33)

See the full diff

Package name: nunjucks

The new version differs by 250 commits.

• 53d1223 Release v3.2.1
• 93129bf Replace yargs with commander
• 17691da Chokidar bump
• 40dfdf0 Remove dead link
• cefb1cf Prevent optional dependency Chokidar from loading when not watching
• 1485a44 Add badges in README.md
• 2246457 Add Mozilla Code of Conduct file
• ff5571c Release v3.2.0
• f997a52 Add NodeResolveLoader
• 34b0a26 Fix syntax typos in CONTRIBUTING.md
• 55e0b7a Set dash as joiner element
• c99154e Update faq.md
• 1338712 Emit 'load' events on Loader and Environment instances
• 057e7b3 Add test for line/column info in user-function exception
• bcf38f3 Emit line and column info for functions
• fbddcd5 lexer more accurately tracks token line and column information
• 889ef80 Add nodejs versions 10 and 11 to CI, remove 6 and 9
• b828158 Fix documentation typo
• 1370361 v3.1.7
• 0a65e1f Fixes for replace example
• 2946fb4 Removed postinstall-build in favor of npm prepare script
• 9fd5bdb Add link to Plugin syntax highlighting for VSCode
• 68ba15c Fix bug where exceptions were silently swallowed with synchronous render
• 7c187ac tests: fix issue running tests on node 10.x

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic