[Snyk] Fix for 1 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • deps/npm/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: hosted-git-info

The new version differs by 95 commits.

• a810463 chore(release): 3.0.8
• bede0dc fix: simplify the regular expression for shortcut matching
• afe2808 chore(release): 3.0.7
• eb5bd5a fix: correctly filter out urls for tarballs in gitlab
• d30f96e chore(release): 3.0.6
• c067102 fix: support to github gist legacy hash length
• c53c6ab chore(release): 3.0.5
• 167cef2 chore: properly advertise version support
• 47c931e update lru-cache to latest
• 8e0b0ec chore(release): 3.0.4
• 0835306 fix: Do not pass scp-style URLs to the WhatWG url.URL
• 6f39e93 chore(release): 3.0.3
• 31140a7 Ensure passwords in hosted Git URLs are correctly escaped
• 4636ac9 chore(release): 3.0.2
• 3e5fbec fix: do not encodeURIComponent the domain
• 97c8caa chore(release): 3.0.1
• e3e3054 fix: update pathmatch for gitlab
• af4835c test: added script to get coverage report
• d04239b test: removed unused testing structure
• 4693b9c test: moved all github url tests together
• a03d51e test: added refactered tests for bitbucket
• 0aea712 test: added ignore; for 100% testing (this seems wonky)
• b473c55 test: added basic test for ._fill() method
• fa87af7 fix: updated pathmatch for gitlab

See the full diff

Package name: init-package-json

The new version differs by 39 commits.

• 1703339 2.0.1
• a99f769 npm-package-arg@8.1.0
• 434ecd4 read-package-json@3.0.0
• 5ac9b2a 2.0.0
• 6396ea8 chore: changelog for v2.0.0
• f4c67c5 BREAKING: requires node10+
• 35b18fc chore: update to auto-bump on npm version system
• 786e88b chore: bump transitive deps
• 32012d9 validate-npm-package-license@3.0.4
• 5deeae9 npm-package-arg@8.0.1
• 56477ed read-package-json@2.1.2
• 68f5b77 semver@7.3.2
• 6b865ec rimraf@3.0.2
• 9a05ee4 chore: remove standard-version dev dep
• 16c52cb test: removes dev dep in npm
• c0ace81 fix: accounts dot vs dash version/license config
• b20020b mkdirp@1.0.4
• 4c22248 tap@14.10.8
• 3e772e9 Updated package-lock to v2
• 2b5d21e chore: updating package-lock.json
• 8515942 chore: update CI for current Node LTS
• b30d345 chore(release): 1.10.3
• ab26834 deps: bump devDeps
• 549cb32 deps: bump npa

See the full diff

Package name: normalize-package-data

The new version differs by 23 commits.

• e584704 3.0.0
• 6899b0c fix: broken tests w/ latest hosted-git-info
• 40d07df hosted-git-info@3.0.6
• e938119 chore: update engines
• 7e70f63 resolve@1.17.0
• 0ba7f91 semver@7.3.2
• 30afb71 chore: remove async dev dep
• db9c672 tap@14.10.8
• cc89759 chore: remove underscore dev dep
• b224ba1 chore: update to package-lock v2
• dedb606 2.5.0
• f97372c deps: use `resolve.isCore` instead of `is-builtin-module` for better data and better node compat (How about an io.js podcast to help us keep up? nodejs/node#99)
• de56d3e 2.4.2
• 96c93df deps: downgrade is-builtin-module to ^1.0.0
• 39b60ac 2.4.1
• 9d1ce80 fix: update broken url to `validate-npm-package-license` in README
• 156ad83 deps: bump devDeps
• 432f89c deps: bump deps
• f828e53 chore: update CI for current Node LTS
• df8ea05 fix(license): don't fail when license is whitespace-only field ([stream] support piping multiple streams into a single stream nodejs/node#93)
• 9948ecf 2.4.0
• f85b3f6 don't warn on missing protocol in `homepage` field
• 468c113 Add extension when requiring `typos.json`

See the full diff

Package name: npm-package-arg

The new version differs by 42 commits.

• bf86221 chore(release): 7.0.0
• 68a4fc3 deps: bump hosted-git-info to 3.0.2
• ee44e84 chore: update deps
• 1da5ca9 chore(release): 6.1.1
• 84a9569 chore: add node 12 to travis
• c5da1f4 chore: boost test coverage to 100%
• 3909203 fix: preserve drive letter on windows git file:// urls
• a5a18b3 chore: update CI for current Node LTS
• b2c1e0c deps: bump devDeps
• db7ca93 deps: bump deps
• 4760e1c chore(release): 6.1.0
• 7d0d957 deps: bump devDeps
• 4b62929 deps: bump deps
• adf41e8 docs(coc): updated CODE_OF_CONDUCT.md
• f446255 docs(contributing): updated CONTRIBUTING.md
• 861040c meta: standardise release process
• ab99f8e feat(alias): add `npm:` registry alias spec ([Snyk] Fix for 1 vulnerabilities #34)
• 647a0b3 fix(git): Fix gitRange for git+ssh for private git ([Snyk] Fix for 3 vulnerabilities #33)
• 8425a96 6.0.0
• 8c60180 deps: bump hosted-git-info and semver
• cf55b3f deps: update package-lock to latest format
• 5b2a731 Stop defaulting git-branch, return null when unset ([Snyk] Security upgrade shelljs from 0.6.1 to 0.8.5 #26)
• ba0ae6a handle case where arg is an object but not an npa instance ([Snyk] Fix for 1 vulnerabilities #29)
• 99c778e travis: test node 8 not 7

See the full diff

Package name: read-package-json

The new version differs by 17 commits.

• 9f7049d chore(release): 3.0.0
• 19d9fbe fix: check-in updated lockfile
• eef46fa chore: add engines definition
• 36b7ef7 chore: remove old .travis.yml envs
• b3a8831 globa@7.1.6
• fb3ceae json-parse-even-better-errors@2.3.1
• 78add03 npm-normalize-package-bin@1.0.1
• 7595d70 normalize-package-data@3.0.0
• 10175d8 chore(release): 2.1.2
• fdbf082 fix: even better json errors, remove graceful-fs
• e78afd6 chore(release): 2.1.1
• b8cb5fa fix: normalize and sanitize pkg bin entries
• 55382c2 chore(release): 2.1.0
• 0a176cc Add some tests and clean up error handling for non-string bins
• 76f6f42 feat: support bundleDependencies: true
• 4e1e4d2 some tests for index.js parsing
• 67f2d8d chore: update CI for current Node LTS

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic