[Snyk] Fix for 3 vulnerabilities

[liorkesos]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	556/1000 Why? Recently disclosed, Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	Yes	No Known Exploit
	526/1000 Why? Recently disclosed, Has a fix available, CVSS 4.8	Session Fixation SNYK-JS-PASSPORT-2840631	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: nodemon

The new version differs by 121 commits.

• 27e91c3 fix: update packge-lock
• 0144e4f fix: bump update-notifier to v6.0.0 (#2029)
• c870342 chore: update supporters
• 5c0b472 chore: add supporter
• e26aaa9 fix: support windows by using path.delimiter
• 9d1afd7 docs: add syntax highlighting to sample-nodemon.md (#1982) (#2004)
• de5d32a docs: Unified Node.js capitalization (#1986)
• e890927 docs: add note to faq with example showing how to watch any file extension ([Snyk] Security upgrade meanio from 0.8.85 to 0.9.2 #1931)
• bc4547b chore: update sponsors
• 07159c5 chore: add supporters
• cd100da chore: update supporters
• 6a34922 chore: supporters
• e5d6067 chore: updating supporters
• 242f9f7 Merge branch 'main' of github.com:remy/nodemon
• 141e58c chore: update supporters
• 53422af ci(release): workflow uses 'npm' cache (#1933)
• 581c641 ci(node.js): workflow uses 'npm' cache (#1934)
• cb1c8b9 docs: Fix typo in faq.md (#1950)
• 54784ab fix: bump prod dep versions
• 26db983 chore: update supporters
• 61e7abd fix: add windows signals SIGUSR2 & SIGUSR1 to terminate the process (#1938)
• b449171 docs: Fix typo in faq.md
• 0a3175f chore: update supporters
• 18516d8 chore: add supporter

See the full diff

Package name: npm

The new version differs by 178 commits.

• 1569304 3.0.0
• d67d437 [email protected]
• 2becdc3 [email protected]
• 3501f22 src: Fix one last standard style issue
• 0772c95 changelog: Add two more known bugs
• 283eef4 changelog: minor tweaks that didn't make it in prior to merging
• 064d62c changelog for 3.0.0
• a306446 test: more descriptive assertions + assertion label
• 6aa6754 uninstall: Support "no arguments"=global action semantics
• a526b60 gitignore: Ignore dev subdep unpipe
• 57328de test: Only run standard once regardless of how we invoke tests
• 65cc653 pack: fix infinite loop when packing w/ node_modules w/ dep cycles
• 532dfc1 [email protected]
• b50be6a src: make the npm source comply with `standard`
• 7c5ebe0 ls: Don't error on missing optional deps
• ae1f202 travis: Use the version of npm being tested
• 231a582 building npm: Yell if you try to package npm@3 with npm@2
• 2da0ce8 install: Run top level lifecycles AFTER rolling back failed optdeps
• 8a814a6 recalculate-metadata: don't compute missing dev deps for subdeps
• 1b71c55 install: save: Don't sort the top level package.json keys
• bc46ca9 install: Make shrinkwrap extraction work in 0.8
• 8fb8b4a install: Move more npm config into the installer object
• 3cdbce3 install: Refactor --link to behave better
• 9e030f7 publish: Throw an error if the bundled deps package.json entry is invalid

See the full diff

Package name: request

The new version differs by 31 commits.

• 02fc5b1 Update changelog
• de1ed5a 2.87.0
• a6741d4 Replace hawk dependency with a local implemenation (#2943)
• a7f0a36 2.86.1
• 8f2fd4d Update changelog
• 386c7d8 2.86.0
• 76a6e5b Merge pull request #2885 from ChALkeR/patch-1
• db76838 Merge branch 'patch-1' of github.com:ChALkeR/request
• fb7aeb3 Merge pull request #2942 from simov/fix-tests
• e47ce95 Add Node v10 build target explicitly
• 0c5db42 Skip status code 105 on Node > v10
• d555bd7 Generate server certificates for Node > v10
• 81f8cb5 Remove redundant code
• db17497 Use Buffer.from and Buffer.alloc in tests
• 0d29635 Merge pull request #2923 from gareth-robinson/cifixes
• 3745cec Correction for Windows OS identification
• 219a298 Alterations for failing CI tests
• bbb3a0b 2.85.1
• 21ef363 Update changelog
• 5dad86e 2.85.0
• 5ba8eb4 Revert "Update hawk to 7.0.7 (#2880)"
• b191514 2.84.1
• d77c839 Update changelog
• 4b46a13 2.84.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect