[Snyk] Fix for 1 vulnerabilities

[kissofire]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	823/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.6	Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: npm

The new version differs by 250 commits.

• 30a9844 7.21.0
• 0b2cd9d update AUTHORS
• 06461ec docs: changelog for v7.21.0
• 771a1cb chore(tests): fix snapshots
• 71cdfd8 spdx-license-ids@3.0.10
• 94f92de make-fetch-happen@9.0.5
• 7ac621c smart-buffer@4.2.0
• 218caca is-core-module@2.6.0
• ff6626a fix(docs): update npm-publish access flag info
• b6f40b5 tar@6.1.10
• e9e5ee5 @ npmcli/arborist@2.8.2
• 991a3bd read-package-json@4.0.0
• f077724 init-package-json@2.0.4
• 68a19bb fix(error-message): look for er.path not er.file
• ff34d6c feat(cache): initial implementation of ls and rm
• 8183976 normalize-package-data@3.0.3
• df57f0d @ npmcli/run-script@1.8.6
• 487731c fix(logging): sanitize logged argv
• 7a58264 chore(ci): check that docs are up to date in ci
• 22f3bbb chore(docs): add more 'autogenerated' comments
• 4314490 fix(docs): revert auto-generated portion of docs
• 32e88c9 fix(did-you-mean): switch levenshtein libraries
• 59b9851 7.20.6
• 2591e67 update AUTHORS

See the full diff

Package name: npminstall

The new version differs by 112 commits.

• b0e785d Release 6.5.0
• 0d880c6 📦 NEW: Use urllib@3 (cnpm install webpack -g，报错: 'husky' 不是内部或外部命令，也不是可运行的程序 cnpm/cnpm#407)
• 4eb3207 Release 6.4.0
• 91ced98 feat: save dep with tag if install with tag (material-vite-ts仓库npm i --registry=https://registry.npmmirror.com正常；cnpm i页面会报错 cnpm/cnpm#408)
• 0432f13 Release 6.3.0
• 3787df9 👌 IMPROVE: Remove mz modules deps (BREAKING CHANGE: use npminstall v7 cnpm/cnpm#405)
• dbb3b7a Release 6.2.1
• ce04b97 🐛 FIX: Remove disk cache when version not found (fix: Back to npminstall v6 cnpm/cnpm#404)
• dbceaee deps: Security upgrade pacote from 11.3.5 to 13.0.0 (👌 IMPROVE: Try npminstall beta version cnpm/cnpm#402)
• d8a095d Release 6.2.0
• dad3dcf feat: add download url and size for ShasumNotMatchError (next / pre 版本经常延迟很长时间甚至直接不同步，都要手动点一下 sync 才行 cnpm/cnpm#400)
• f692927 🤖 TEST: CI add Node.js 18 (npmmirror.com的证书过期了 cnpm/cnpm#397)
• 1364e29 🤖 TEST: Run action on 5.x
• fee11d6 Release 6.1.0
• c05046a 📦 NEW: Support override custom scripts on bug-versions (📦 NEW: Use urllib v3 cnpm/cnpm#393)
• d760c2b chore: update contributors
• d358658 Release 6.0.0
• 0dc0f9e feat: upgrade node-gyp@9 to support python3 (https://npmmirror.com/mirrors/node-sass/v4.11.0/win32-x64-83_binding.node 访问内容为空 cnpm/cnpm#392)
• 74a13b7 Release 5.7.3
• 161d297 Revert "feat: upgrade node-gyp@8 to support python3 (Closed cnpm/cnpm#385)" (最低支持的node版本应为14.15.0 cnpm/cnpm#391)
• 9381c66 Release 5.7.2
• 9a60297 fix: use pacote@^11 for Node.js@^10 (安装依赖报错 self signed certificate in certificate chain cnpm/cnpm#390)
• d23122b Release 5.7.1
• b220ec3 🐛 FIX: Reduce http request retry warning message log (electron release 历史版本镜像还会更新吗？ cnpm/cnpm#389)

See the full diff

Package name: urllib

The new version differs by 22 commits.

• 53a32c3 Release 3.0.0
• 20944ee 📦 NEW: Support request and response events
• f01c264 📦 NEW: Support HttpClient with rejectUnauthorized
• 61a915c 📦 NEW: Support options.auth
• cb084d9 📦 NEW: Support custom lookup and checkAddress
• cc1c854 📦 NEW: Support options.opaque = object
• f07c9f8 📦 NEW: Support options.timing = true
• 70a75c6 📦 NEW: Support options.compressed instead of gzip
• 936bc01 👌 IMPROVE: Support Node.js 14
• eb6c319 📦 NEW: Support auto retry like HttpClient2
• b07a45e 👌 IMPROVE: Use brotli instead of deflate
• a8876f2 🤖 TEST: Big stream timeout
• 6b5a4f1 📦 NEW: Use request instead of fetch
• c1218c5 🐛 FIX: Try to use Readable first
• a67d9d1 🐛 FIX: Dont parse empty data to json
• 2882f0e 🤖 TEST: Error cases for stream and writeStream
• 57ccc7e 📦 NEW: Support options.streaming = true
• f2ca7eb 📦 NEW: Support fixJSONCtlChars
• f5390f2 📦 NEW: TS compiler both Commonjs and ESM support
• c3cc765 📦 NEW: Support upload file by args.files
• 70a238d 🤖 TEST: Use jest and ts
• 26c44b7 📦 NEW: [BREAKING] Refactor impl base on undici

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)

---

This change is