[Snyk] Fix for 4 vulnerabilities #12

cdegraftjohnson · 2024-02-02T19:05:56Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
63/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 942, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.67, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-D3COLOR-1076592	Yes	Proof of Concept
159/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00171, Social Trends: No, Days since published: 1109, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.64, Score Version: V5	Prototype Pollution SNYK-JS-IMMER-1019369	Yes	Proof of Concept
137/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00252, Social Trends: No, Days since published: 884, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.62, Likelihood: 2.42, Score Version: V5	Prototype Pollution SNYK-JS-IMMER-1540542	Yes	Proof of Concept
45/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00102, Social Trends: No, Days since published: 568, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 1.89, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-TERSER-2806366	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: react-flow-renderer

The new version differs by 250 commits.

4e9cc37 chore(node-edges): add data-testid
23d1dd0 fix(edge-renderer): fallback to default edge if type is invalid
0891b83 chore(isInputDOMNode): add event.target as fallback
d22bf9e Merge pull request #2416 from jwm0/main
ceced01 Merge pull request #2410 from wardoost/node-snap-relative-to-center
a766ba3 Use event.composedPath for getting event target
ac11a18 Snap node to grid relative to 0,0 instead of relative to starting point of node
147656b chore: release v10.3.16
e0751cb fix(deps): put react types in devDependencies closes #2368
2ca2996 chore: release v10.3.15
d074cba chore(deps): add types to dependencies closes #1015, closes #2362
cb69897 refactor(useUpdateNodeInternals): make it easier to use #2008
bb00e87 fix(useReactFlow): prevent unnecessary re-renderings
196f225 chore(issue-templates): always use title case
8bbead4 Merge pull request #2352 from wbkd/chrtze-patch-1
df5929f Update and rename feature_request.md to feature_request.yml
d21815d Update feature_request.md
ba64946 Merge pull request #2350 from wbkd/chrtze-patch-1
5ff801b Update issue templates
e93db69 chore: release v10.3.14
daf677d fix(store): set domNode
46ba0de chore: release v10.3.13
d07e760 fix(minZoom,maxZoom): pass min- maxZoom for initial view closes #2343
9f5d610 Merge pull request #2324 from fbieler/main

See the full diff

Package name: react-scripts

The new version differs by 113 commits.

221e511 Publish
6a3315b Update CONTRIBUTING.md
5614c87 Add support for Tailwind (#11717)
657739f chore(test): make all tests install with `npm ci` (#11723)
20edab4 fix(webpackDevServer): disable overlay for warnings (#11413)
69321b0 Remove cached lockfile (#11706)
3afbbc0 Update all dependencies (#11624)
f5467d5 feat(eslint-config-react-app): support ESLint 8.x (#11375)
e8319da [WIP] Fix integration test teardown / cleanup and missing yarn installation (#11686)
c7627ce Update webpack and dev server (#11646)
f85b064 The default port used by `serve` has changed (#11619)
544befe Update package.json (#11597)
9d0369b Fix ESLint Babel preset resolution (#11547)
d7b23c8 test(create-react-app): assert for exit code (#10973)
1465357 Prepare 5.0.0 alpha release
3880ba6 Remove dependency pinning (#11474)
8b9fbee Update CODEOWNERS
cacf590 Bump template dependency version (#11415)
5cedfe4 Bump browserslist from 4.14.2 to 4.16.5 (#11476)
50ea5ad allow CORS on webpack-dev-server (#11325)
63bba07 Upgrade jest and related packages from 26.6.0 to 27.1.0 (#11338)
960b21e Bump immer from 8.0.4 to 9.0.6 (#11364)
134cd3c Resolve dependency issues in v5 alpha (#11294)
b45ae3c Update CONTRIBUTING.md