[Snyk] Fix for 1 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • cvat-canvas/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: eslint

The new version differs by 250 commits.

• 145aec1 7.16.0
• 83518a5 Build: changelog update for 7.16.0
• a62ad6f Update: fix false negative of no-extra-parens with NewExpression (#13930)
• f85b4c7 Fix: require-atomic-updates false positive across await (fixes #11954) (#13915)
• 301d0c0 Fix: no-constant-condition false positives with unary expressions (#13927)
• 555c128 Fix: false positive with await and ** in no-extra-parens (fixes #12739) (#13923)
• d93c935 Docs: update JSON Schema links (#13936)
• 8d0c93a Upgrade: table@6.0.4 (#13920)
• 9247683 Docs: Remove for deleted npm run profile script (#13931)
• ab240d4 Fix: prefer-exponentiation-operator invalid autofix with await (#13924)
• dc76911 Chore: Add .pre-commit-hooks.yaml file (#13628)
• 2124e1b Docs: Fix wrong rule name (#13913)
• 06b5809 Sponsors: Sync README with website
• 26fc12f Docs: Update README team and sponsors
• 902a032 7.15.0
• 6356778 Build: changelog update for 7.15.0
• 5c11aab Upgrade: @ eslint/esintrc and espree for bug fixes (refs #13878) (#13908)
• 0eb7957 Upgrade: file-entry-cache@6.0.0 (#13877)
• 683ad00 New: no-unsafe-optional-chaining rule (fixes #13431) (#13859)
• cbc57fb Fix: one-var autofixing for export (fixes #13834) (#13891)
• 110cf96 Docs: Fix a broken link in working-with-rules.md (#13875)
• 0cb81a9 7.14.0
• fb3a594 Build: changelog update for 7.14.0
• 5f09073 Update: fix 'skip' options in no-irregular-whitespace (fixes #13852) (#13853)

See the full diff

Package name: nodemon

The new version differs by 23 commits.

• ee92ee4 test: split require tests
• 33ae6da test: fix failing test when required
• a4490e2 fix: package.json & package-lock.json to reduce vulnerabilities
• 9bd07eb docs: changed verbose logging and CLI documentation to reflect support single file watch functionality
• c279760 test: make sigint test to actually check child pid (how can an annotator search for a label in the dropdown list when the number of labels is very large? cvat-ai/cvat#1656)
• cd45d74 test: fix fork test
• 496c335 chore: undo change to spawn code
• 47dfb8b fix: pipe stderr correctly
• ed91703 fix: ubuntu loop waiting for sub processes
• 9a67f36 feat: update chokidar to v3
• 6781b40 docs: add license file
• 0e6ba3c fix: wait for all subprocesses to terminate (fixes issue Annotation templates for complex objects cvat-ai/cvat#1476)
• b58cf7d chore: Merge branch 'master'
• 95a4c09 docs: add to faq
• 3a2eaf7 choe: merge master
• 3d90879 chore: add logo to site
• 7d6c1a8 fix: Replace `jade` references by `pug`
• 74c8749 chore: test funding.yml change
• c1a8b75 chore: update funding
• d5b9891 test: ensure ignore relative paths
• eead311 fix: to avoid confusion like in Integrate virus scanning of uploaded files  cvat-ai/cvat#1528, always report used extension
• 12b66cd fix: langauge around "watching" (update https install section cvat-ai/cvat#1591)
• 2e6e2c4 docs: README Grammar (Merge pull request #1 from opencv/develop cvat-ai/cvat#1601)

See the full diff

Package name: webpack-cli

The new version differs by 250 commits.

• fb50f76 chore(release): publish new version
• 2c75aeb chore: new version of the packages
• 0d05c30 chore(release): publish %s
• 3f9e151 chore: fix lerna config
• 2c1e34c tests(generator): enhance init generator tests (couldn't connet to server when create superuser cvat-ai/cvat#1236)
• 6ee61b9 Fix loader-generator and plugin-generator tests (Exception: filename collision: when uploading remote-files with the same basename cvat-ai/cvat#1250)
• 52956a2 Fixing the typos and grammatical errors in Readme files ([WIP] Fixed security warnings in CVAT server cvat-ai/cvat#1246)
• 7faaed2 chore: update Bug_report & Feature_request Templates (Move annotation formats to dataset manager cvat-ai/cvat#1256)
• 7a5b33d feat(webpack-cli): added mode argument (Bug: Occluded Objects Still Appear In YOLO output! cvat-ai/cvat#1253)
• 3715756 tests(webpack-cli): add test case for defaults flag (Feature requests: Let the user delete last point when drawing a polygon cvat-ai/cvat#1254)
• a7cba2f chore: project maintanance and typescript fix (fixed git sync app cvat-ai/cvat#1247)
• 7748472 chore: ignore package-lock.json and remove its references (All annotations have disappeared cvat-ai/cvat#1252)
• a014aa7 docs: fix supported arguments & commands link in README (Fixed security issues in Datumaro cvat-ai/cvat#1244)
• 06129a1 feat(webpack-cli): add progress bar for progress flag (Release 0.6.0 cvat-ai/cvat#1238)
• 6cc6a49 chore: post refactor CLI (Converting DEXTR model to Inference Engine format cvat-ai/cvat#1237)
• 358651e chore: move cli under lerna package (React UI: Filters history cvat-ai/cvat#1225)
• 2dc495a fix(init): fix webpack config scaffold (Remote access results in 404 Not Found error (nginx/1.16.1) cvat-ai/cvat#1231)
• 1ab62d2 tests(generator): add tests for plugin generator (Some debian package manager tweaks cvat-ai/cvat#1235)
• d2dd0c1 tests(sourcemap): fix flaky stats statement ([Datumaro] Optimize mask operations cvat-ai/cvat#1232)
• f6dc680 tests(loader-generator): add tests for loader generator (Task button doesn't work cvat-ai/cvat#1234)
• 35d1381 tests(generator): enable init generator test ([Datumaro] Label remapping transform cvat-ai/cvat#1233)
• 66cdcb6 chore(generator): remove transpiled tests (Az/fix annotation dump upload cvat-ai/cvat#1229)
• f29a170 fix(init): fix the invalid package name (Action recognition: 1D intervals cvat-ai/cvat#1228)
• 8c3a66d chore(cli): updated changelog of v3 (auto-annotation fails for large videos cvat-ai/cvat#1224)

See the full diff

Package name: webpack-dev-server

The new version differs by 250 commits.

• c9271b9 chore(release): 4.0.0
• 18bf369 test: fix stability (Is there a way of passing a group_id back into CVAT after automatic annotation? cvat-ai/cvat#3676)
• cdcabb2 fix: respect protocol from browser for manual setup (uploading CVAT 1.1 XML file cvat-ai/cvat#3675)
• 1768d6b fix: initial reloading for lazy compilation (Upload Datumaro 1.0 Annotations cvat-ai/cvat#3662)
• 4f5bab1 docs: improve examples ([Snyk] Upgrade antd from 4.16.12 to 4.16.13 cvat-ai/cvat#3672)
• f2d87fb fix: improve https CLI output ([Snyk] Upgrade react-awesome-query-builder from 4.4.2 to 4.4.3 cvat-ai/cvat#3673)
• 0277c5e chore: remove redundant console statements ([Snyk] Upgrade: react, react-dom cvat-ai/cvat#3671)
• 16fcdbc docs: add `ipc` example (Migration to the latest version of Cypress cvat-ai/cvat#3667)
• 8915fb8 test: add e2e tests for built in routes (Add a missing comma cvat-ai/cvat#3669)
• 4d1cbe1 docs: ask `version` information in issue template (Frames fail to load for some videos with Chrome 92 but not with Chrome 91 cvat-ai/cvat#3668)
• b6c1881 chore(deps-dev): bump core-js from 3.16.1 to 3.16.2 ([Snyk] Security upgrade sqlparse from 0.3.1 to 0.4.2 cvat-ai/cvat#3666)
• ffa8cc5 chore(deps-dev): bump supertest from 6.1.5 to 6.1.6 (About background labels cvat-ai/cvat#3665)
• f1fdaa7 chore(release): 4.0.0-rc.1
• c4678bc fix: legacy API (Could not fetch frame data from the server cvat-ai/cvat#3660)
• d8bdd03 test: fix stability (Runs slow when a image size too big cvat-ai/cvat#3661)
• 22b1414 refactor: remove `killable` (Copy/paste for multiple selected shapes cvat-ai/cvat#3657)
• 75bafbf test: add e2e tests for module federation (Remove save interpolated shapes cvat-ai/cvat#3658)
• 493ccbd chore(deps): update `ws` (Click on the bouding box without releasing the mouse, press delete key, the annotation page will be stuck cvat-ai/cvat#3652)
• ae8c523 test: add e2e test for universal compiler (My 3d object will have a broken image like a rocket launch, I can’t find the reason, please help me cvat-ai/cvat#3656)
• f94b84f chore(deps): update (#3655)
• 1923132 test: fix cli
• 2adfd01 test: fix todo (Order of instances in xml  cvat-ai/cvat#3653)
• 6e2cbde fix: proxy logging and allow to pass options without the `target` option (Added documentation for GPU support in WSL cvat-ai/cvat#3651)
• c9ccc96 fix: respect infastructureLogging.level for client.logging (After Import Task an error message is displayed for the next issues cvat-ai/cvat#3613)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic