[Snyk] Fix for 21 vulnerabilities

[novalina26]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	504/1000 Why? Has a fix available, CVSS 5.8	Prototype Pollution SNYK-JS-HIGHLIGHTJS-1045326	Yes	No Known Exploit
	703/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-INI-1048974	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Validation Bypass SNYK-JS-KINDOF-537849	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-MIXINDEEP-450212	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Directory Traversal SNYK-JS-MOMENT-2440688	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-SETVALUE-1540541	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-SETVALUE-450213	Yes	Proof of Concept
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit
	410/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: hexo

The new version differs by 250 commits.

• 1489074 release: 5.0.0 (Update Launching Browsers Guide to List all Edge Browser Variants cypress-io/cypress-documentation#4423)
• add6c00 chore(deps): update hexo-cli from 3.0.0 to 4.0.0 (Fix links to GitHub PRs in 9.5.2 cypress-io/cypress-documentation#4445)
• 8404b3c chore(deps): update hexo-front-matter from 1.0.0 to 2.0.0 (Add cy.origin command API page cypress-io/cypress-documentation#4439)
• 562e97e Merge pull request Update links to reflect ownership transfer cypress-io/cypress-documentation#4443 from curbengh/rexcerpt
• de63ab9 fix(excerpt): stricter regex
• 49ff2b2 refactor(meta_generator): no longer ignore empty head (Wrong key property for Mouse-Events from a specific button cypress-io/cypress-documentation#4442)
• a29d609 perf(external_link): optimized regexp (#4440)
• 9076422 chore(deps): update hexo-util from 2.0.0 to 2.2.0 (Bugfix: Position is not an option but an argument to click() cypress-io/cypress-documentation#4438)
• 12c3536 perf(tag): rendering optimization (CLOUD-538: Update GitHub Enterprise docs to remove reference to Preview cypress-io/cypress-documentation#4418)
• f1eb90c perf(external_link): regexp & condition (add my cypress network exercises course cypress-io/cypress-documentation#4436)
• a34a7e2 merge(CLOUD-351: Update GitHub Enterprise docs minimal repository permissions screenshot cypress-io/cypress-documentation#4420): from SukkaW/tag-error-source
• 3a56d29 test(benchmark): optimize for local & render post support (docs: update mount api doc for ct changes cypress-io/cypress-documentation#4428)
• 850ffbc refactor(external_link): migrate config during load_config (docs: Document Cypress.Commands.addAll() cypress-io/cypress-documentation#4414)
• 97cb698 feat(post_link): better error message for post not found (docs: update mount partial for new imports cypress-io/cypress-documentation#4426)
• b8b9d4a Update test case
• 2a92807 post_link should throw error if no slug/post found
• 821ef12 feat(tag): show source of the error & beautify
• 064daa4 test(mocha): run tests in parallel (UDX-133-content-partials cypress-io/cypress-documentation#4374)
• 5b2808c merge(docs: updates to ct framework config for new ct arch cypress-io/cypress-documentation#4422): from sukkaw/test-coverage-2
• 0b28f80 test: improve coverage
• 27684d0 fix(migrator): fix help message
• a8d918b test: improve coverage (docs: adding ct beta alert box to needed pages cypress-io/cypress-documentation#4421)
• 89b2a9a perf(titlecase): lazy require (CLOUD-539: Update GitLab Self-managed docs to remove reference to Preview cypress-io/cypress-documentation#4417)
• e3baad9 merge(Docs incorrectly refer to starting server in plugins as anti-pattern cypress-io/cypress-documentation#4416): from sukkaw/lazy-require

See the full diff

Package name: hexo-cli

The new version differs by 86 commits.

• 737b96e Merge pull request Fix its apostrophe cypress-io/cypress-documentation#195 from curbengh/4.0.0
• d454da5 release: 4.0.0
• b8ecb86 chore: requires Node 10.13+
• 9dbfead chore(deps-dev): bump eslint from 7.4.0 to 7.5.0 (Installing Cypress guide improvment cypress-io/cypress-documentation#221)
• 64a8ba6 merge(Develop cypress-io/cypress-documentation#223): from curbengh/gh-action
• 32da61c docs: add git submodule instruction
• 2db127e ci: add GitHub Actions
• 639662e chore(deps): bump hexo-util from 2.0.0 to 2.1.0 (Develop cypress-io/cypress-documentation#196)
• 49a7252 chore(deps): bump hexo-fs from 3.0.1 to 3.1.0 (Update tutorials filename from 'introduction' to be less generic filename for cypress.on linking cypress-io/cypress-documentation#201)
• 9ae7f2c chore(deps-dev): bump eslint from 7.2.0 to 7.4.0 (Adding form submission video page to the tutorial cypress-io/cypress-documentation#219)
• ceaf1fc chore(deps): bump acorn from 7.2.0 to 7.3.1 (Create page for data loading step in React todo tutorial cypress-io/cypress-documentation#210)
• c567236 chore(deps): [security] bump lodash from 4.17.14 to 4.17.19 (Issue 194 cypress-io/cypress-documentation#220)
• 4c7babf chore(deps): bump hexo-log from 1.0.0 to 2.0.0 (Emphasize default method for cy.route() is GET cypress-io/cypress-documentation#217)
• 02e8273 chore(deps-dev): bump hexo-renderer-marked from 2.0.0 to 3.0.0 (Add assertions to '.select()' doc cypress-io/cypress-documentation#216)
• 2b07acb fix(permission): caused by The documentation should indicate where to download a cypress archive and how to download it in a specific version. cypress-io/cypress-documentation#200 (Create page for smoke tests step in React todo tutorial cypress-io/cypress-documentation#213)
• 7407649 chore(deps): bump chalk from 4.0.0 to 4.1.0 (Add docs on using the official Cypress docker images cypress-io/cypress-documentation#208)
• 6506e26 chore(deps-dev): bump nyc from 15.0.1 to 15.1.0 (Develop cypress-io/cypress-documentation#205)
• ce3ed5f chore(deps-dev): bump eslint from 7.0.0 to 7.2.0 (Issue 150 cypress-io/cypress-documentation#207)
• b43f94a chore(deps): remove acorn (Create page for item updates step in React todo tutorial cypress-io/cypress-documentation#211)
• af92881 fix(init): init error with a number target project name (The documentation should indicate where to download a cypress archive and how to download it in a specific version. cypress-io/cypress-documentation#200)
• a6d44ce chore(deps-dev): bump mocha from 7.2.0 to 8.0.1 (Create page for form submission step in React todo tutorial cypress-io/cypress-documentation#209)
• f518198 feat: detailed information for `hexo not found` (Need support for CI/CD using bamboo cypress-io/cypress-documentation#206)
• 1acb025 chore(deps-dev): bump mocha from 7.1.2 to 7.2.0 (Update tutorials filename + add redirects for tutorials cypress-io/cypress-documentation#203)
• 71debfb chore(deps): bump acorn from 7.1.1 to 7.2.0 (Numbered videos and updated summary title to whats covered cypress-io/cypress-documentation#198)

See the full diff

Package name: hexo-renderer-marked

The new version differs by 106 commits.

• c742ef2 Merge pull request #95 links to cy website close #95 cypress-io/cypress-documentation#155 from curbengh/v3.0.0
• bfa348b release: 3.0.0
• 411bfd6 chore: requires Node 10+
• 2aaaba7 ci(travis): drop deprecated Node 13
• a2cf33e Merge pull request Binding to events section missing? cypress-io/cypress-documentation#152 from hexojs/dependabot/npm_and_yarn/mocha-8.0.1
• 27a9820 chore(deps-dev): bump mocha from 7.2.0 to 8.0.1
• 3f5c08f Merge pull request outside work -> outside world cypress-io/cypress-documentation#154 from curbengh/fix-test
• b6dd143 test: fix failing test after deps update
• 75956a0 chore(deps): bump hexo-util from 1.9.0 to 2.1.0 (Screenshot in repo's readme.md file contains typo cypress-io/cypress-documentation#148)
• dc20bdb chore(deps-dev): bump eslint from 6.8.0 to 7.2.0 (Please don't use implicit variable declarations! cypress-io/cypress-documentation#151)
• 54a2e8c ci(travis): drop Node 8 and add Node 14 (fix typo in why-cypress close #144 cypress-io/cypress-documentation#146)
• 024f6d1 revert: feat: promisify (Remove package-lock.json cypress-io/cypress-documentation#145)
• f685924 chore(deps): bump marked from 0.8.2 to 1.0.0 (Typo in "What You'll Learn" section on "Why Cypress?" page cypress-io/cypress-documentation#144)
• 40d8ca4 chore(deps-dev): bump mocha from 6.2.2 to 7.0.0 (Change all occurrences of "must simpler" to "much simpler". cypress-io/cypress-documentation#135)
• c8cc683 refactor: remove marked.setOptions.highlight (Our marketing team would like it as "Sauce Labs" cypress-io/cypress-documentation#134)
• 7c7f513 Merge pull request Our marketing team would like Sauce Labs to be spaced cypress-io/cypress-documentation#133 from curbengh/marked-filter-docs
• 3877cb0 style: minor typo
• cc9be71 Merge pull request Docs: key differences cypress-io/cypress-documentation#127 from curbengh/modifyAnchors-type
• b8f4a3c docs: marked:renderer filter
• a93ebeb Merge pull request Create doc for (upcoming) plugins/preprocessors API cypress-io/cypress-documentation#132 from curbengh/async
• 2b85dd0 fix: register renderer in async mode
• 262324d test: remove extra async keyword
• f5ee328 chore(dev-deps): update eslint-config-hexo from 4.0 to 4.1
• a9afdd9 feat: promisify

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Validation Bypass
🦉 More lessons are available in Snyk Learn