[Snyk] Security upgrade johnny-five from 0.8.106 to 0.12.0

[robtarr]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	461/1000 Why? Recently disclosed, Has a fix available, CVSS 3.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-DEBUG-3227433	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: johnny-five

The new version differs by 250 commits.

• 89ea5ef v0.12.0
• 8bb887b ci: remove "npm cache clean" from appveyor
• b35fc65 Deps: drop es6-shim
• a9b5cca Deps: serialport ~6.0.x
• 1f7ad6c Deps: serialport 6
• 0f3c84a Readme: fix gitter link
• 608fe55 Tests: Explicit strict mode
• 641e9fb Accelerometer: update tests and digital.all/integral/fractional
• 966ef76 Merge branch 'accelerometer-fixed-point-values' of https://github.com/dnlup/johnny-five into dnlup-accelerometer-fixed-point-values
• 6b7eedd Require pins
• 3976817 Accelerometer: set fractional value
• b37458c Merge branch 'master' of github.com:rwaldron/johnny-five into accelerometer-fixed-point-values
• 0ad2a59 Accelerometer: remove toFixed call from x,y,z getters
• aa0f2bf Fix datasheet unsecure link in comment
• 0d666f1 Add doc expander ADS1115
• e5e3cdd Add example expander ADS1115
• a1920fa Add component expander ADS1115
• 4504b41 move Board options up
• 3fe0961 fix: Switch defaults to NO
• 9732d51 test/animation.js: fix indent
• 73f6a7c Fix sycnchronous animation queues
• fd59d4a Accelerometer: modify MPU6050 `toGravity` to return values with 3 decimals
• 31cdd0d IMU: Fn.{s32, u32} => s32, u32
• 2b04a0b Stepper: pin correction

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[socket-security]

Socket Security Pull Request Report

Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.

📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package	Script field	Source
[email protected] (upgraded)	install	package.json via [email protected], [email protected]
[email protected] (upgraded)	install	package.json via [email protected]

Pull request report summary

Issue	Status
Install scripts	⚠️ 2 issues
Native code	✅ 0 issues
Bin script confusion	✅ 0 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] [email protected]

• @SocketSecurity ignore [email protected]
• @SocketSecurity ignore [email protected]

⚠️ Please accept the latest app permissions to ensure bot commands work properly. Accept the new permissions here.

Powered by socket.dev