[Snyk] Fix for 2 vulnerabilities

[MrBrain295]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @npmcli/run-script

The new version differs by 11 commits.

• f3b5a17 2.0.0
• 20214a8 feat: update to node-gyp@8 (colors@1.1.2 npm/cli#39)
• baf9478 chore: update settings.yml (testing branch dupe bug npm/cli#38)
• 7e7b52a 1.8.6
• 45ad116 chore: remove infer-owner from dependencies (Improved repository examples npm/cli#36)
• c785d52 chore(package-lock): rebuild package-lock
• 47a4d53 1.8.5
• 420d215 tap@15.0.4
• 988cd66 fix: windows ComSpec env variable name
• 2a2f1b6 1.8.4
• eeeb3f4 remove puka

See the full diff

Package name: node-gyp

The new version differs by 16 commits.

• 989abc7 v8.0.0: bump version and update changelog
• 0da2e01 gyp: update gyp to v0.8.1 (remove some unused modules npm/cli#2355)
• 0093ec8 gyp: Improve our flake8 linting tests
• 06ddde2 deps: sync mutual dependencies with npm
• a5fd1f4 doc: add downloads badge (error cb() never called! npm/cli#2352)
• 0d8a6f1 ci: update actions/setup-node to v2 (refactor deprecate command and add tests npm/cli#2302)
• 1bd18f3 lib: drop Python 2 support in find-python.js (Release/v7.1.2 npm/cli#2333)
• e81602e lib: migrate requests to fetch ([BUG] postpack script runs BEFORE the tarball has been generated and moved to its final destination. npm/cli#2220)
• a78b584 gyp: remove support for Python 2 ([BUG] npm config removes _auth from .npmrc npm/cli#2300)
• 392b776 lib: avoid changing process.config ([BUG] NPM UPDATE removes dependencies npm/cli#2322)
• c3c510d gyp: update gyp to v0.8.0 (Error when running 'npx cypress open' npm/cli#2318)
• cc1cbce doc: update macOS_Catalina.md (test: add lib/shrinkwrap.js tests npm/cli#2293)
• 9e1397c gyp: update gyp to v0.7.0 ([BUG] Config environment variable forwarding breaks with false config values npm/cli#2284)
• 6287118 doc: updated README.md to copy easily ([BUG] cb() never called! npm/cli#2281)
• 15a5c7d ci: migrate deprecated grammar ([BUG] <title>npm ERR! cb() never called! npm/cli#2285)
• 66c0f04 doc: add missing `sudo` to Catalina doc

See the full diff

Package name: pacote

The new version differs by 30 commits.

• fcecf0e 12.0.0
• cbc75af deps: @ npmcli/run-script@2.0.0
• a0d4c60 fix: drop node 10 support (Fix link as code in npm-ci npm/cli#94)
• 4217bee chore: update settings.yml (Changes error code to when test is undefined npm/cli#91)
• 80cce46 chore(package-lock): rebuild package-lock
• 3557b0e 11.3.5
• e7e6f0d Merge pull request Use native fs.writeFile in lib/install/save.js npm/cli#84 from npm/lk/handle-pathspec-error
• ac56329 Merge pull request Close the file descriptor if exiting upload via an error. npm/cli#80 from npm/isaacs/unpack-no-mtime
• 7660b0b Merge pull request feat(cli, outdated): Adds 'Homepage' to outdated --long output. npm/cli#81 from npm/isaacs/include-all-dep-types-when-preparing
• c76c279 rethrow git pathspec errors when cloning from a hosted service
• 6ad9ede Merge pull request Note that "prepare" runs when installing git dependencies npm/cli#82 from npm/lk/handle-git-errors
• c285551 @ npmcli/git@2.1.0, update tests to work with latest hosted-git-info
• 0328fe0 fix: do not do dry-run/package-lock installs for preparation
• b76f51a fix: include all dep types when building for prepare
• 2ed5b64 fix: do not set mtime when unpacking
• 745265a 11.3.4
• bec3715 npm-registry-fetch@11.0.0
• 9629c64 11.3.3
• d97e2fb Merge pull request Correct spelling mistakes npm/cli#78 from npm/gar/normalize-manifest
• 14264d2 fix(registry): normalize registry manifests
• 42e977a 11.3.2
• 4311985 update tap, test on node 16
• e0128a7 npm-registry-fetch@10.0.0
• 500a34f Cache the tarballs in pacote

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)
🦉 Prototype Pollution