[Snyk] Fix for 1 vulnerabilities

[CALISOULB]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @npmcli/run-script

The new version differs by 113 commits.

• fcebe38 chore: release 7.0.2
• 30623cf deps: bump node-gyp from 9.4.1 to 10.0.0
• 54e5bd0 chore: postinstall for dependabot template-oss PR
• 7d95e9f chore: bump @ npmcli/template-oss from 4.18.1 to 4.19.0
• 90bcf54 chore: postinstall for dependabot template-oss PR
• ba0ab48 chore: bump @ npmcli/template-oss from 4.18.0 to 4.18.1
• 43ccfc7 chore: release 7.0.1
• f61fd84 deps: bump @ npmcli/promise-spawn from 6.0.2 to 7.0.0
• 87b740b chore: release 7.0.0
• e1b1a3c fix: drop node14 support
• a8045a9 deps: bump which from 3.0.1 to 4.0.0
• c4f4fb4 chore: postinstall for dependabot template-oss PR
• dacd67e chore: bump @ npmcli/template-oss from 4.17.0 to 4.18.0
• 9d2d807 chore: postinstall for dependabot template-oss PR
• 8b21725 chore: bump @ npmcli/template-oss from 4.15.1 to 4.17.0
• d9a0cc0 chore: release 6.0.2
• 545f3be fix: handle signals more correctly (fix(packageRelativePath): fix 'where' for file deps npm/cli#142)
• 1cbd286 chore: bump @ npmcli/template-oss from 4.14.1 to 4.15.1 (access: ls-collaborators is ok with non-scoped npm/cli#151)
• 581be58 docs: fix syntax in example (Release: npm@6.7.0 npm/cli#141)
• 24f12b2 chore: release 6.0.1
• 728b270 chore: enable auto-publish (6.8.0 npm/cli#150)
• 6c1cb21 chore: bump @ npmcli/template-oss from 4.12.1 to 4.14.1 (Fixing text. npm/cli#148)
• 3a8f085 fix: remove unused dependency on minipass (install/dedupe: fix hoisting of packages with peerDeps npm/cli#147)
• 72c3e2f chore: bump @ npmcli/template-oss from 4.12.0 to 4.12.1 (test: maketest: Fix common.npm callback arguments npm/cli#144)

See the full diff

Package name: cacache

The new version differs by 76 commits.

• e962288 chore: release 17.0.2 (Set modified to undefined when not retrievable npm/cli#153)
• 4a7382f fix: replace @ npmcli/move-file with @ npmcli/fs
• 106e518 chore: postinstall for dependabot template-oss PR
• 9199635 chore: bump @ npmcli/template-oss from 4.6.2 to 4.8.0
• ec9ec61 chore: postinstall for dependabot template-oss PR
• 2eb9c4f chore: bump @ npmcli/template-oss from 4.6.1 to 4.6.2
• fe1d831 chore: postinstall for dependabot template-oss PR
• c3166ef chore: bump @ npmcli/template-oss from 4.5.1 to 4.6.1
• 3d8eab9 chore: release 17.0.1 (Fixing text. npm/cli#148)
• d3515de deps: bump unique-filename from 2.0.1 to 3.0.0
• e57ebd9 deps: bump ssri from 9.0.1 to 10.0.0
• 9dd537a deps: bump @ npmcli/move-file from 2.0.1 to 3.0.0
• c280d48 chore: bump @ npmcli/eslint-config from 3.1.0 to 4.0.0
• 33ba55b chore: release 17.0.0 (docs: scoped names can begin with '.' & '_' npm/cli#134)
• 479b135 feat: do not alter file ownership (Release: npm@6.7.0 npm/cli#141)
• f57bb4d feat: remove sync methods (doc: update package.json docs to include repository.directory details npm/cli#140)
• 295b5b1 chore: postinstall for dependabot template-oss PR
• 3519a29 chore: bump @ npmcli/template-oss from 4.4.4 to 4.5.1
• 4d24477 chore: postinstall for dependabot template-oss PR
• 3401577 chore: bump @ npmcli/template-oss from 4.3.2 to 4.4.4
• cfebcde feat!: postinstall for dependabot template-oss PR
• ea56dea chore: bump @ npmcli/template-oss from 3.5.0 to 4.3.2
• f9f6f81 chore(main): release 16.1.3 (cli,outdated: default homepage to an empty string npm/cli#124)
• 6235554 deps: bump unique-filename from 1.1.1 to 2.0.0 (Handle git branch references correctly npm/cli#123)

See the full diff

Package name: make-fetch-happen

The new version differs by 108 commits.

• db8f03c chore: release 11.0.0 (Fix: Return a value for view when in silent mode npm/cli#178)
• 727d805 chore: fix flaky test (Allow git to follow global tagsign config npm/cli#185)
• 33d972a deps: bump cacache from 16.1.3 to 17.0.0 (Fixed outdated again npm/cli#184)
• 672caac chore: postinstall for dependabot template-oss PR
• 654f976 chore: bump @ npmcli/template-oss from 4.4.4 to 4.5.1
• d63de44 docs: document cause argument to onRetry (outdated: fix rendering for global dependencies npm/cli#173)
• 2aeaae5 chore: postinstall for dependabot template-oss PR
• 6e5077d chore: bump @ npmcli/template-oss from 4.3.2 to 4.4.4
• c293053 feat!: postinstall for dependabot template-oss PR
• 729bc74 chore: bump @ npmcli/template-oss from 3.6.0 to 4.3.2
• 2631db8 chore: postinstall for dependabot template-oss PR
• 2296d79 chore: bump @ npmcli/template-oss from 3.5.0 to 3.6.0
• ea71110 chore(main): release 10.2.1 (Release: npm@6.9.0 npm/cli#167)
• e9a2a51 fix: linting (Revert "prune: Fix bug where prune --production would remove dev deps… npm/cli#166)
• ee20fc2 chore(main): release 10.2.0 (Update knownBroken version npm/cli#165)
• dae6384 feat: store link header (licensee@6.1.0 npm/cli#164)
• 27f3e2a chore(main): release 10.1.8 (updating link to RFC #10 in the changelog npm/cli#162)
• 4ae4864 fix: TypeError: SocksProxyAgent is not a constructor (Google is a groups that can be  npm/cli#161)
• e42eb5d chore(main): release 10.1.7 (doc: add npm add as alias to npm install npm/cli#160)
• 63ed403 deps: bump socks-proxy-agent from 6.2.1 to 7.0.0 (stars: Fix typo in error message npm/cli#158)
• 331f9cb fix: use hostname for socks agent (doc: add --audit-level param npm/cli#159)
• 99f44e0 chore(main): release 10.1.6 (package-lock.json no longer created when there is no package.json npm/cli#157)
• 9baa806 fix: respect given algorithms instead of always using sha512 (Dependencies updated by Dependabot npm/cli#156)
• c5251f3 chore(main): release 10.1.5 (Dependencies updated by Dependabot npm/cli#155)

See the full diff

Package name: node-gyp

The new version differs by 55 commits.

• 33391db chore: release 9.4.0
• a0b3d1c test: remove deprecated Node.js and Python ([BUG] npm audit does not exit with exit code 1 if a vulnerability is found npm/cli#2868)
• 7a3fe1c win,install: only download target_arch node.lib ([BUG] ci command says I can get more info, but I can't npm/cli#2857)
• 55048f8 fix: log statement is for devDir not nodedir ([BUG] install --only option not working as intended npm/cli#2840)
• 5df2b72 Migration from tap to mocha (chore: skip publishing some unnecessary files npm/cli#2851)
• aaa117c fix: extract tarball to temp directory on Windows ([BUG] package-lock.json integrity value for git dependencies depends on the architecture (Apple Silicon M1 differs) npm/cli#2846)
• bb76021 feat: add support for native windows arm64 build tools
• 6f3c2d3 docs: docs/README.md add advise about deprecated node-sass ([BUG] npm link confused by symlinks (windows) npm/cli#2828)
• 02480f6 update make-fetch-happen to 11.0.3 ([BUG] Failed to publish packages without repository field npm/cli#2796)
• c7927e2 doc: Update README.md (fix(diff): set option "where" for pacote npm/cli#2822)
• 337e8e6 chore: get update-gyp.py to work with Python >= v3.5 ([BUG] npx doesn't work when in child workspace npm/cli#2826)
• 41882a9 Improved advise on repacing node-sass with sass ([BUG] Can't run npm install and can't even run npm whoami without errors using GitHub Packages npm/cli#2758)
• fc0ddc6 feat: Upgrade Python linting from flake8 to ruff (Regression: 7.6.0 throws a TypeError: Cannot read property '@roundforest/***' of null error sometimes npm/cli#2815)
• 39ac2c1 chore: release 9.3.1
• 888efb9 fix: increase node 12 support to ^12.13 (all npm commands hang where outbound traffic to default registry is blocked npm/cli#2771)
• 38f01fa ci: update python test matrix ([BUG] Lost support submodules npm/cli#2774)
• ee46f9d Add Python 3.11 to the testing
• 2cc72be chore: release 9.3.0
• 713b8dc feat(gyp): update gyp to v0.14.0 (Capitalize Package in a Heading npm/cli#2749)
• 131d1a4 feat: remove support for VS2015 in Node.js >=19 (Yahya  npm/cli#2746)
• 7d0c83d feat: support IBM Open XL C/C++ on z/OS (Isaacs/hide easter egg better npm/cli#2743)
• 4bc4747 chore: release 9.2.0 ([BUG] installing a dependency in a package with a peer dependency changes the peerDependencies field npm/cli#2735)
• 33deab4 Adding tarfile member sanitization to extractall() ([BUG] npm hangs on gitlab repo install npm/cli#2741)
• a26494f feat: Add proper support for IBM i

See the full diff

Package name: npm-profile

The new version differs by 55 commits.

• dd687ac chore: release 7.0.1 (Correct spelling mistakes npm/cli#78)
• 36fa4b1 deps: bump npm-registry-fetch from 13.3.1 to 14.0.0
• 29616ad deps: bump proc-log from 2.0.1 to 3.0.0
• 6629dbe chore: bump @ npmcli/eslint-config from 3.1.0 to 4.0.0
• 769e3d1 chore: postinstall for dependabot template-oss PR
• 8287802 chore: bump @ npmcli/template-oss from 4.4.4 to 4.5.1
• 6fad3d5 chore: release 7.0.0 (install: Don't omit any deps of dev deps if --only=dev npm/cli#69)
• bac7ff1 chore: postinstall for dependabot template-oss PR
• 7295252 chore: bump @ npmcli/template-oss from 4.3.2 to 4.4.4
• e16befb feat!: postinstall for dependabot template-oss PR
• 98f044c chore: bump @ npmcli/template-oss from 3.6.0 to 4.3.2
• 7ce8a74 chore: postinstall for dependabot template-oss PR
• 86fb069 chore: bump @ npmcli/template-oss from 3.5.0 to 3.6.0
• 4cad0f7 chore(main): release 6.2.1 (version: fix -S argument passing for sign-git-commit npm/cli#58)
• b701df2 fix: remove `npm-use-webauthn` header (doc: correct npm@6.4.0 release date in changelog npm/cli#53)
• cdc4acb fix: cancel opener promise if web login fails (ci: backronym ci to clean-install npm/cli#57)
• d2076fb chore(main): release 6.2.0 (Align command descriptions in help text npm/cli#55)
• 05a7811 feat: Add export for `webauthCheckLogin` (Mention registry terms of use in manpage and registry doc npm/cli#54)
• db12188 chore: bump @ npmcli/template-oss from 3.4.3 to 3.5.0 (fix: improve quoting for run-script arguments npm/cli#52)
• 465e683 chore: bump @ npmcli/template-oss from 3.4.2 to 3.4.3 ( pack: add dryRun option to packDirectory npm/cli#47)
• 5aff31f chore(main): release 6.1.0 (Canary npm/cli#49)
• aa82de0 feat: Allow web-login donecheck to cancel opener promise (Iarna/concurrent tests npm/cli#50)
• 6bdd233 feat: set 'npm-use-webauthn' header depending on option (Update republish time and lightly reorganize republish info npm/cli#48)
• d0c2dec chore: postinstall for dependabot template-oss PR

See the full diff

Package name: npm-registry-fetch

The new version differs by 76 commits.

• 8f61d95 chore: release 14.0.0 (Check run script existence with undefined npm/cli#139)
• c1a2c5a chore: bump cacache from 16.1.3 to 17.0.0 (install/dedupe: fix hoisting of packages with peerDeps npm/cli#147)
• b5aeed0 deps: bump make-fetch-happen from 10.2.1 to 11.0.0 (Always save package_lock.json when using --package-lock-only npm/cli#146)
• c1c203e chore: postinstall for dependabot template-oss PR
• dcff56f chore: bump @ npmcli/template-oss from 4.4.4 to 4.5.1
• 8762c37 chore: postinstall for dependabot template-oss PR
• 428d241 chore: bump @ npmcli/template-oss from 4.3.2 to 4.4.4
• 104a51f feat!: postinstall for dependabot template-oss PR
• 36f576a chore: bump @ npmcli/template-oss from 3.6.0 to 4.3.2
• ed6304c chore: postinstall for dependabot template-oss PR
• 4a08dd4 chore: bump @ npmcli/template-oss from 3.5.0 to 3.6.0
• de64201 chore(main): release 13.3.1 (audit: report any errors above 400 as potentially not supporting audit npm/cli#128)
• c9a8727 fix: linting
• a72fb7c chore: rimraf@3.0.2
• 79bddb9 chore: mkdirp@1.0.4
• 8d40cbb chore(main): release 13.3.0 (misc: replace ronn with marked-man npm/cli#126)
• 42d605c feat: respect registry-scoped certfile and keyfile options (audit: env selection for report npm/cli#125)
• 43c91f5 chore(main): release 13.2.0 (cli,outdated: default homepage to an empty string npm/cli#124)
• 893ea1c chore: bump @ npmcli/template-oss from 3.4.2 to 3.4.3 (deps: spdx-license-ids@3.0.3 npm/cli#121)
• ff4ed65 feat: set 'npm-auth-type' header depending on config option (Handle git branch references correctly npm/cli#123)
• 0db6cf8 chore: postinstall for dependabot template-oss PR
• 0c1795e chore: bump @ npmcli/template-oss from 3.4.1 to 3.4.2
• 5f9f823 chore: bump @ npmcli/template-oss from 3.3.2 to 3.4.1 (chore: replace var with const/let in repo npm/cli#119)
• b9848ba chore(main): release 13.1.1 (Replace hardcoded URL to advisory with a URL from audit response npm/cli#110)

See the full diff

Package name: pacote

The new version differs by 184 commits.

• 18e760f chore: release 17.0.4
• ba8f790 deps: bump @ npmcli/promise-spawn from 6.0.2 to 7.0.0
• 2c0d3ae deps: bump @ npmcli/run-script from 6.0.2 to 7.0.0
• 7aa2062 chore: release 17.0.3
• ace7c28 deps: bump npm-packlist from 7.0.4 to 8.0.0
• f1efd0c chore: release 17.0.2
• c3b892d deps: bump sigstore from 1.3.0 to 2.0.0
• c75d7d5 chore: release 17.0.1
• 6ddae13 deps: bump npm-registry-fetch from 15.0.0 to 16.0.0
• 42bf787 deps: bump npm-pick-manifest from 8.0.2 to 9.0.0
• 9fa2de9 chore: release 17.0.0
• e9e964b deps: bump read-package-json from 6.0.4 to 7.0.0
• f69d844 chore: hosted-git-info@7.0.0
• 5d26500 deps: bump npm-package-arg from 10.1.0 to 11.0.0
• d13bb9c deps: bump @ npmcli/git from 4.1.0 to 5.0.0
• 7a25e39 deps: bump cacache from 17.1.4 to 18.0.0
• 2db2fb5 fix: drop node 16.13.x support
• 5cdbfd1 chore: release 16.0.0
• 8dc6a32 deps: bump minipass from 5.0.0 to 7.0.2
• 7cebf19 deps: bump npm-registry-fetch from 14.0.5 to 15.0.0
• 73b6297 fix: drop node14 support ([FEATURE] Provide credentials to npm trough environment variables npm/cli#290)
• 53cf17e chore: postinstall for dependabot template-oss PR
• 865d5c7 chore: bump @ npmcli/template-oss from 4.17.0 to 4.18.0
• 040add9 chore: postinstall for dependabot template-oss PR

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)