[Snyk] Fix for 1 vulnerabilities

[peterjoseph]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

As this is a private repository, Snyk-bot does not have access. Therefore, this PR has been created automatically, but appears to have been created by a real user.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: ava

The new version differs by 250 commits.

• 9bc615e 4.0.0
• f09742f Clean up documentation in preparation for AVA 4
• 0187779 Dependency updates
• 29024af Test compatibility with TypeScript 4.5
• 8df118b Use AVA 4 for the self-hosted tests
• bedd1d0 Remove dependency on `equal-length`
• d4ec097 Improve wording in TypeScript recipe
• b3a1b72 Mention experimental specifier resolution in TypeScript recipe
• 77623a5 Handle path sources
• 5cdeb9d 4.0.0-rc.1
• 88e7680 Final ESM tweaks
• 60b7cf8 Align shared worker protocol identifier with provider protocols
• ad521af Graduate shared workers to be non-experimental
• 0edfd00 Skip flaky tests in CI
• c4f6723 Use thread IDs
• af30e73 Remove dead code and obsolete TODOs
• 6ed3ad1 Reduce XO exceptions
• 5a48893 Update XO and fix problems
• a7737cd Update dependencies
• dc405ef Fix Mongoose recipe
• c214512 Find ava.config.* files outside of project directory
• 44aebd9 Exclude more files from code coverage
• def2885 Improve handling of temporary file changes in watch mode
• 1a62f15 Switch to .xo-config.cjs

See the full diff

Package name: jsonwebtoken

The new version differs by 17 commits.

• e1fa9dc Merge pull request from GHSA-8cf7-32gw-wr33
• 5eaedbf chore(ci): remove github test actions job (#861)
• cd4163e chore(ci): configure Github Actions jobs for Tests & Security Scanning (#856)
• ecdf6cc fix!: Prevent accidental use of insecure key sizes & misconfiguration of secrets (#852)
• 8345030 fix(sign&verify)!: Remove default `none` support from `sign` and `verify` methods, and require it to be explicitly configured (#851)
• 7e6a86b Upload OpsLevel YAML (#849)
• 74d5719 docs: update references vercel/ms references (#770)
• d71e383 docs: document "invalid token" error
• 3765003 docs: fix spelling in README.md: Peak -> Peek (#754)
• a46097e docs: make decode impossible to discover before verify
• 15a1bc4 refactor: make decode non-enumerable
• 5f10bf9 docs: add jwtid to options of jwt.verify (#704)
• 88cb9df Replace tilde-indexOf with includes (#647)
• a6235fa Adds not to README on decoded payload validation (#646)
• 5ed1f06 docs: fix tiny style change in readme (#622)
• 9fb90ca style: add missing semicolon (#641)
• a9e38b8 ci: use circleci (#589)

See the full diff

Package name: node-sass

The new version differs by 88 commits.

• c167004 6.0.1
• 911d4db remove mkdirp dep (#3108)
• 30a52f7 build(deps): bump meow from 3.7.0 to 9.0.0
• 7e08463 build(deps-dev): bump mocha from 8.4.0 to 9.0.1
• cfcbb2c chore: Use default Apline version from docker-node (#3121)
• 886319b chore: Drop Node 10 support
• c908f4f fix: Bump OSX minimum to 10.11
• 8ab02da fix: Remove old compiler gyp settings
• 3d7b9d0 chore: Add Node 16 support
• 4115e9d build(deps): bump actions/setup-node from v2.1.4 to v2.1.5
• 06f3ab4 Update TROUBLESHOOTING.md
• c1cb367 build(deps): bump actions/setup-node from v2.1.3 to v2.1.4
• 769f3a6 build(deps): bump actions/setup-node from v2.1.2 to v2.1.3
• a2a3a78 chore: Bump dependabot limit
• 7105b0a 5.0.0 (#3015)
• 0648b5a chore: Add Node 15 support (#2983)
• e2391c2 Add a deprecation message to the readme (#3011)
• 6a33e53 chore: Don't upload artifacts on PRs
• d763506 chore: Only run coverage on main repo
• d4ebe72 build(deps): update actions/setup-node requirement to v2.1.2
• 2bebe05 build(deps-dev): bump rimraf from 2.7.1 to 3.0.2
• f877689 chore: Don't double build DependaBot PRs
• b48fac4 chore: Add weekly DependaBot updates
• 91c40a0 Remove deprecated process.sass API

See the full diff

Package name: passport-jwt

The new version differs by 31 commits.

• fed94fa 4.0.1 release
• cfb5566 Merge pull request #248 from mikenicholson/update-minmatch
• 8e4ad5b Address minmatch vulnerability
• e9cf2ce Merge pull request #247 from mikenicholson/jsonwebtoken-9
• bfbc6cc Update jsonwebtoken to 9.0.0
• a49b43e Update minimist due to prototype pollution vulnerability in previous version
• a5137c6 Merge pull request #192 from markhoney/patch-1
• ea824cd Update jsonwebtoken and run npm audit fix
• 8e57eec Remove older node versions shiping npm without support for "ci"
• 3ab9305 Add CI workflow in GitHub Actions
• 96a6e55 Merge pull request #218 from Sambego/patch-1
• 809cdbf Update Auth0 sponsorship link
• ec35fa4 Add nodejs 13 & 14 to CI
• 2cab4dd Update mocha to resolve vulnerabilities
• b196eb8 Use nyc for coverage
• ddafcd2 Fix typo
• 6b92631 Merge pull request #176 from epicfaace/patch-1
• 154af70 Stop building for Node v5 and earlier
• d311551 Add newer node versions to Travis CI build
• 0e39a48 Update dependencies to resolve vulnerabilities.
• d488147 Update URLs to reference new GitHub username
• 89152d5 Rename extrators-test.js to extractors-test.js
• 0bb68bf Clarify use of custom extractor function.
• 499bd4a Add js formatting to extractor example in README.

See the full diff

Package name: passport-local-mongoose

The new version differs by 31 commits.

• 7ae942a chore(release): 6.0.0
• a5cc105 chore: switch to prettier and prettify
• e37894e chore: switch to latest 4x version on fastdl downloads
• 2c5d46d chore: renovate build matrix
• 6e5297e chore: remove cross-env and revert version to last released version
• b76a22e chore: remove default option for npm i
• 09d6c2b chore: bump dependencies in example package-lock.json
• 2e66b35 chore: bump dependencies in example
• feb196a chore: update dependencies
• 63ad94e chore: remove the never released 6.0.0 version from the changelog
• bc3122d chore: move updating from 1.0 to 2.0 near to end of readme
• 10f522a chore: remove codellama badge
• 1b74a3d chore: fix deprecated connect
• e190a3a chore: update drop-mongodb-collections
• c9b0a78 fix: make debug a dev dependency
• 83e5ad3 chore: add error messages to login form of example (#284)
• 40a1fc2 chore: more descriptive customValidator docs in readme (#285)
• aa3d16f chore: Add convenient link to API documentation (#287)
• ff7d718 chore: switch example from jade to pug
• 8215074 chore: update dependencies, npm audit fix (#282)
• 9ff1921 chore: update login example dependencies (#281)
• faa856a chore(release): 6.0.0
• 37375b8 fix: use Buffer.from instead of new Buffer
• 807d9cf fix: update dependencies and specify server port in tests

See the full diff

Package name: sass-loader

The new version differs by 61 commits.

• 3b51d47 chore(release): 8.0.1
• 6c59e37 fix: support webpack@5 (#794)
• 5611f73 docs: improved documentation after breaking changes in release version 8.0.0 (#780)
• 4834287 refactor: use startsWith (#792)
• 22c597b refactor: use Array.includes (#777)
• ed345fa chore(deps): switch to memfs (#791)
• 2e14b68 chore: removed the duplicated prettier config (#781)
• 9274387 chore(deps): update (#772)
• 6d11b7b docs: overhaul readme (#771)
• 185ba80 test: sass modules "@ use" (#770)
• aa9b53b chore(release): 8.0.0
• 45ad0be chore: next (#748)
• 194fea4 chore(release): 7.3.1
• 1175920 fix: minimum `node` version in `package.json` (#733)
• a3ac649 chore(release): 7.3.0
• 6f4ea37 feat: `webpackImporter` option (#732)
• 0330253 docs: standardize readme (#730)
• 997a255 fix: handle module import ending `/` as module (#728)
• 071fa88 test: alias on directory with `_index` file (#727)
• 6be93c8 test: import without quotes (#726)
• dc23895 refactor: code (#725)
• 97c93dd test: manual test (#724)
• b2af379 fix: use "compressed" output when mode is "production" (#723)
• 3545434 refactor: code

See the full diff

Package name: sequelize

The new version differs by 250 commits.

• 901bceb 6.1.0
• 6b32821 6.0.0-beta.7
• 0ca8d72 docs: prepare for v6 release (#12416)
• 663261b feat(sequelize): allow passing dialectOptions.options from url (#12404)
• c6e4192 fix(postgres): parse enums correctly when describing a table (#12409)
• e33d2bd fix(reload): include default scope (#12399)
• 5611ef0 build: update dependencies (#12395)
• e80501d fix(types): transactionType in Options (#12377)
• 4914367 fix(types): add clientMinMessages to Options interface (#12375)
• b71cd05 fix(query): preserve cls context for logger (#12328)
• 95f7fb5 fix(mssql): empty order array generates invalid FETCH statement (#12261)
• ed2d7a9 fix(model.destroy): return 0 with truncate (#12281)
• 72925cf fix: add missing fields to 'FindOrCreateType' (#12338)
• f367191 fix(query-generator): do not generate GROUP BY clause if options.group is empty (#12343)
• 7afd589 docs(sequelize): omitNull only works for CREATE/UPDATE queries
• f9e660f docs: update feature request template
• 2bf7f7b fix(typings): add support for optional values in "where" clauses (#12337)
• 65a9e1e fix(types): add Association into OrderItem type (#12332)
• 1b86729 docs: responsive (#12308)
• 59b8a7b fix(include): check if attributes specified for included through model (#12316)
• 6d87cc5 docs(associations): belongs to many create with through table
• a2dcfa0 fix(query): ensure correct return signature for QueryTypes.RAW (#12305)
• 0769aea refactor: cleanup query generators (#12304)
• 4d9165b feat(postgres): native upsert (#12301)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)