[Snyk] Fix for 2 vulnerabilities

[geekshiv-JC]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/node/base/package.json
  • packages/node/base/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	No	Proof of Concept
	763/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.4	Path Traversal SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @angular-devkit/build-angular

The new version differs by 250 commits.

• 7a901a6 release: cut the v15.2.11 release
• 61f92fd build: update ng-dev config to work with Node.js 18.19
• a398d2f test: disable failing test
• c6feb0b fix(@ angular-devkit/build-angular): `update webpack-dev-middleware` to `6.1.2`
• b479063 release: cut the v15.2.10 release
• bfc1f0f test: install specific npm version in npm version E2E test
• 05213c9 fix(@ angular-devkit/build-angular): update dependency postcss to v8.4.31
• 00d9708 release: cut the v15.2.9 release
• f36e38a fix(@ angular/cli): update direct semver dependencies to 7.5.3
• cdb34b5 release: cut the v15.2.8 release
• 069dcdf docs: improve wording in doc command version description
• 51cf97f release: cut the v15.2.7 release
• d9aefd6 fix(@ schematics/angular): replace vscode launch type from `pwa-chrome` to `chrome`
• f4a6dac fix(@ angular/cli): process keeps running when analytics are enabled
• d9e9f74 refactor(@ angular/cli): update E2E command alias
• 037d84a ci: update CI `.bazelrc` to better support CI systems.
• f9b2fb1 perf(@ angular/cli): register CLI commands lazily
• 4d81cb4 release: cut the v15.2.6 release
• f0b257e fix(@ schematics/angular): ignore hidden directories when running browserlist migration
• 162484b release: cut the v15.2.5 release
• db173d7 fix(@ angular/cli): collect tech information
• a8376e2 ci: disable windows job on PRs
• 85a048b release: cut the v15.2.4 release
• f74bfea fix(@ angular-devkit/build-angular): update `webpack` dependency to `5.76.1`

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Path Traversal

[geekshiv-JC]

Checkmarx One – Scan Summary & Details – e5f9735b-6a5e-49fb-8978-b9ffaafcff54

New Issues

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2023-42282	Npm-ip-1.1.5	Vulnerable Package
	CVE-2024-27088	Npm-es5-ext-0.10.53	Vulnerable Package
	CVE-2024-27351	Python-Django-1.2	Vulnerable Package
	Cxab55612e-3a56	Npm-braces-3.0.2	Vulnerable Package
	Cxab55612e-3a56	Npm-braces-2.3.2	Vulnerable Package
	Cxca84a1c2-1f12	Npm-micromatch-3.1.10	Vulnerable Package
	Cxca84a1c2-1f12	Npm-micromatch-4.0.4	Vulnerable Package
	CVE-2023-26159	Npm-follow-redirects-1.14.6	Vulnerable Package
	CVE-2024-25710	Maven-org.apache.commons:commons-compress-1.15	Vulnerable Package
	CVE-2024-25710	Maven-org.apache.commons:commons-compress-1.20	Vulnerable Package
	CVE-2024-28849	Npm-follow-redirects-1.14.6	Vulnerable Package
	Unpinned Actions Full Length Commit SHA	/pull_request.yaml: 14	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
	Unpinned Actions Full Length Commit SHA	/semgrep.yml: 14	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
	Unpinned Actions Full Length Commit SHA	/build.yaml: 15	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...

Fixed Issues

Severity	Issue	Source File / Package
	CVE-2021-3765	Npm-validator-8.2.0
	CVE-2022-25858	Npm-terser-5.10.0
	CVE-2022-25858	Npm-terser-5.9.0
	CVE-2023-28154	Npm-webpack-5.64.1
	Cx4615fedd-34f3	Npm-validator-8.2.0
	Cxd312845a-fedc	Npm-validator-8.2.0
	CVE-2021-23566	Npm-nanoid-3.1.30
	CVE-2023-44270	Npm-postcss-7.0.39
	CVE-2023-44270	Npm-postcss-8.3.11
	Cx14b19a02-387a	Npm-body-parser-1.19.0
	CVE-2023-5752	Python-pip-22.2