[Snyk] Fix for 18 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

  • package.json

• Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
  Find out more.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change	Exploit Maturity
	Prototype Pollution SNYK-JS-AJV-584908	Yes	No Known Exploit
	SQL Injection SNYK-JS-KNEX-471962	Yes	No Known Exploit
	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-567746	Yes	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-73638	Yes	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	No Known Exploit
	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:fresh:20170908	No	No Known Exploit
	Prototype Pollution npm:hoek:20180212	Yes	No Known Exploit
	Prototype Pollution npm:lodash:20180130	Yes	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:moment:20170905	No	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	Yes	No Known Exploit
	Uninitialized Memory Exposure npm:mysql:20170317	Yes	Mature
	Prototype Override Protection Bypass npm:qs:20170213	No	No Known Exploit

Commit messages

Package name: cookie-session

The new version differs by 20 commits.

• 9e9c681 1.3.2
• 62a6ec8 deps: debug@2.6.9
• 3d81629 1.3.1
• 269e5dd build: Node.js@8.4
• 84414e9 docs: fix date of 1.3.0 release
• 6d6c0b5 docs: add some comparison to express-session
• 0718b0b deps: cookies@0.7.1
• 096353e 1.3.0
• dfe1279 build: supertest@1.1.0
• ef47255 build: istanbul@0.4.5
• 3cf0b6c build: support Node.js 4.x - 8.x
• 0739b01 deps: cookies@0.7.0
• f8c02a3 build: support io.js 3.x
• a53eb76 deps: on-headers@~1.0.1
• 7eb6a41 build: reduce runtime versions to one per major
• 64de88f build: mocha@2.5.3
• f11ffdc deps: debug@2.6.8
• c8867bc build: remove unnecessary Travis CI command
• 92608fb build: io.js@2.5
• e7613aa build: fix running Node.js 0.8 tests on Travis CI

See the full diff

Package name: ghost-gql

The new version differs by 4 commits.

• 27ed008 Release v0.0.6.
• 934f844 ⬆️ deps: lodash@4.17.4
• b3229ef Making GQL Compatible with Lodash v4 ([Snyk] Fix for 17 vulnerable dependencies #21)
• 1eac343 2017

See the full diff

Package name: knex

The new version differs by 131 commits.

• ca702cf Updated changelog and bumped version up
• 44ccb33 Fixes Set a sensible default sort order for post management admin TryGhost/Ghost#1303 (0.4.2 Release Candidate 1 Ready for Testing TryGhost/Ghost#2458)
• 8771bd4 Use tarn as pool (Add functional tests for admin navigation bar and menus TryGhost/Ghost#2450)
• 053736f Added info about new dialect and about minimal test cases
• 5f81e8a Add redshift support without changing cli or package.json ([Apps] Added friendly handling for nonexistent apps TryGhost/Ghost#2233)
• bf1fa63 Add queryContext to schema and query builders (No spell check and can't type on iOS mobile devices. TryGhost/Ghost#2314)
• 09eb126 Update dependencies and fix ESLint warnings accordingly (Links undefined TryGhost/Ghost#2433)
• c1997e9 Fixing issue with add columns on tables failing if using both after and collate (Bug: Invalid tokens generated for some email addresses TryGhost/Ghost#2432)
• 15706c0 2351 CLI sets exit-code 1 if the command supplied was not parseable (Adds additional fields to apps schema. TryGhost/Ghost#2358)
• 9f8d2ed Update dependencies ([Ember.js] Settings: User Tab TryGhost/Ghost#2422)
• 59f6cba Set toNative() to be not enumerable (Ember.js: User fixtures + injection + login TryGhost/Ghost#2388)
• 45f5ffb Use wrapIdentifier in columnInfo. fixes Watch changes in Ghost-UI TryGhost/Ghost#2402 (Fixed modal inconsistent fade problem TryGhost/Ghost#2405)
• 82bfdba Disable oracledb tests from non LTS nodes (Remove .bowerrc TryGhost/Ghost#2407)
• 3f89701 Shifted returning before joins for updates (MSSQL) ([Discussion] created_by/updated_by without a user TryGhost/Ghost#2399)
• 6ffcaed fixes [Ember.js] Naming convention for components & helpers TryGhost/Ghost#2373 (Specify itemView on the each helper rather than nesting a view helper TryGhost/Ghost#2374)
• 5e12b23 Incorrectly set UV_THREADPOOL_SIZE (Don't fade out notifications when the mouse is over TryGhost/Ghost#2372)
• fbf371f Added decimal variable precision / scale support (cleanup Gruntfile.js to be more maintainable TryGhost/Ghost#2353)
• aac0565 Updated change log + version for 0.14.2
• b5ba51a Fix truncate() on sqlite3 dialect (Tag API Response TryGhost/Ghost#2348)
• aeec0a2 Updated package version and changelog
• c0ac107 More pool tests and test on borrow default (Rss support for tags TryGhost/Ghost#2341)
• 95e5cf8 Support multiple searchPaths while preserving case-sensitive feature … (Add Spell Checking in the Blog Editor TryGhost/Ghost#2340)
• e405d66 Fixed passing connection errors directly to the query (Does Ghost support MSSQL? TryGhost/Ghost#2336)
• 211a611 Fixed typo in issue template

See the full diff

Package name: passport-ghost

The new version differs by 15 commits.

• 613159f release 2.3.1
• b027963 🎨 package.json: too specific versions
• d3a2319 release 2.3.0
• ffd7f56 ✨ userinfo by identity id ([Snyk] Fix for 1 vulnerable dependencies #10)
• c6f36e4 release 2.2.4
• 2aea760 🎨 make ignition dependency more relaxed
• 38f6411 release 2.2.3
• 063c5a8 🎨 optimise error messages
• 9733681 ✨ retry hook
• 5a5a32e release 2.2.2
• ba2217d 🐛 if no post body is present, do not send an empty {}
• bdee2bd 🐛 return statement was missing
• f55cb26 release 2.2.1
• 123da4d 🎨 error handling if auth url is wrong
• 24b7fba 2017

See the full diff

With a Snyk patch:

Severity	Issue	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	No Known Exploit
	Prototype Pollution npm:hoek:20180212	No Known Exploit
	Prototype Pollution npm:lodash:20180130	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	No Known Exploit

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic