[Snyk] Fix for 8 vulnerabilities

[usernamerandom11]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	No	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-URLPARSE-1078283	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-URLPARSE-1533425	No	Proof of Concept
	641/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.4	Access Restriction Bypass SNYK-JS-URLPARSE-2401205	No	Proof of Concept
	641/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.4	Authorization Bypass SNYK-JS-URLPARSE-2407759	No	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Improper Input Validation SNYK-JS-URLPARSE-2407770	No	Proof of Concept
	631/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.2	Authorization Bypass Through User-Controlled Key SNYK-JS-URLPARSE-2412697	No	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-XSS-1584355	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: farmhash

The new version differs by 19 commits.

• 388f326 Release v3.2.2
• d1512f3 CI: use gcc 10
• e6db7a0 CI: use Node.js 16, correct -march flag
• 67f139a Optimise binaries for size
• 77daa32 Bump deps
• 32cc972 Release v3.2.1
• 75f1f07 List files to publish (rather than files not to)
• add2801 Bump deps
• 07fb23d binding: add support for AppleSilicon chips ([Snyk] Upgrade xss from 1.0.8 to 1.0.14 #37)
• 84406e8 CI: do not publish config to npm
• ddcb784 Release v3.2.0
• 02abeee Release v3.2.0-alpha3
• 16fb2b4 Release v3.2.0-alpha2
• 1e35b72 CI: fix prebuild conditional
• 2425de4 CI: migrate Linux, macOS, Windows x64 to GitHub Actions
• 539dc41 Release v3.1.1
• 9656350 CI: Upgrade Windows environment
• dc4dd9e CI: add Node.js 15
• 57a29dd Bump deps

See the full diff

Package name: url-parse

The new version differs by 59 commits.

• ad23357 1.5.9
• 0e3fb54 [fix] Strip all control characters from the beginning of the URL
• 61864a8 [security] Add credits for CVE-2022-0686
• bb0104d 1.5.8
• d5c6479 [fix] Handle the case where the port is specified but empty
• 4f2ae67 [security] Add credits for CVE-2022-0639
• 8b3f5f2 1.5.7
• ef45a13 [fix] Readd the empty userinfo to `url.href` (#226)
• 88df234 [doc] Add soft deprecation notice
• 78e9f2f [security] Fix nits
• e6fa434 [security] Add credits for incorrect handling of userinfo vulnerability
• 4c9fa23 1.5.6
• 7b0b8a6 Merge pull request API should automatically add date <meta> tags to the docs on each recompile Sv443-Network/JokeAPI#223 from unshiftio/fix/at-sign-handling-in-userinfo
• e4a5807 1.5.5
• 193b44b [minor] Simplify whitespace regex
• 319851b [fix] Remove CR, HT, and LF
• 4e53a8c [doc] Document that the returned hostname might be invalid
• 9be7ee8 [fix] Correctly handle userinfo containing the at sign
• f7774f6 [security] Fix typos in SECURITY.md
• 82c4908 [dist] 1.5.4
• e324874 [doc] Remove dependency status badge
• 5e8a444 [ci] Test on node 17
• a72a5c6 [doc] Remove "made by" and IRC badges
• e9a8353 [ci] Update coverallsapp/github-action action to version 1.1.3

See the full diff

Package name: xss

The new version differs by 108 commits.

• 380a4ba publish: v1.0.10
• 699acde fix: Version 2.4.0 - The Big Caching Fix Sv443-Network/JokeAPI#239 stripCommentTag DoS attack
• 9cbe2f1 Create SECURITY.md
• bdd1b03 chore: fix nodejs.yml remove node-version 8.x
• 3be6a07 chore: update devDependencies to latest version
• 948dfb1 docs: update CI badge
• 831a6a2 chore: github action nodejs.yml run test-cov instead of test
• 0ba3cdb chore: remove .travis.yml
• cdee88e chore: fix github action nodejs.yml
• 624aba9 chore: add github action nodejs.yml
• 901b771 style: reformat all source code by prettier
• 0b15109 docs: update changelog
• 3e153f5 fix: typings `onTag` options
• 82cb63f docs: update changelog
• a1d9b44 fix: typings IWhiteList allow any tag name
• 005098b feat: Add `<strike>` to default whitelist
• dcf1486 feat: Add `<audio crossorigin muted>`, `<video crossorigin muted playsinline poster>` to default whitelist
• f4c0b29 Merge pull request Reporting Joke 79 Sv443-Network/JokeAPI#220 from daraz999/patch-1
• 2f5dd55 fix: recover `<summary>` on the default whitelist
• d94ac2a publish: v1.0.9
• 4452638 chore: add package-lock.json to .ignore
• cff16d9 chore: build dist
• 730a0b5 Merge pull request Error 106 when using format=txt on endpoint /joke (reported through Discord) Sv443-Network/JokeAPI#218 from TomAnthony/fix-whitespace-bypass
• 6586f49 Merge pull request Bump dependency-cruiser from 9.16.0 to 9.21.1 Sv443-Network/JokeAPI#216 from spacegaier/patch-1

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 Regular Expression Denial of Service (ReDoS)