[Snyk] Fix for 2 vulnerabilities

[harunpehlivan]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	753/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: elasticsearch

The new version differs by 75 commits.

• 60935ae version 12.0.0
• ef905ce [test/clientManager] remove incorrect use of snapshot arg
• 6bff091 [api] regenerate
• b526bb0 [api/generate] add overrides for 5.0/2.4 changes
• b298867 pin filterPath reference to 5.0 for now
• c8a34fb Backport Bump eslint from 3.19.0 to 4.18.2 datacamp/rdocumentation-app#448
• a15b454 [docs] filterPath reference to current es vs master
• 67c931c Merge pull request Update Snowplow tracking datacamp/rdocumentation-app#440 from tylersmalley/release-docs
• 26e9b92 Document fixing tags for preprease
• c1afa53 Version 12.0.0-rc5
• 3270ab4 Merge pull request hide user email in RDocument example datacamp/rdocumentation-app#439 from tylersmalley/master-regenerate
• d3bffda [apis] regenerate
• 8eeb039 Merge pull request Redirects in pretty much all of ggplot2 pkg fail datacamp/rdocumentation-app#428 from elastic/proxy-get-client
• dc16822 pass client instance to namespaceFactory
• 22febcb [api] add the special "" option for refresh
• fc04071 [generate] support extending the rest-api specs via merge+concat
• 913469b [client action] add a test to prove 21b2176
• 21b2176 [client action] compare the options in an enum as strings
• 6e83395 [generate] ensure that all api definitions use strings for their options
• ca9f294 [api] 2.x -> 2.4 & regenerate
• 241aaff Merge pull request Continous parser api datacamp/rdocumentation-app#375 from orangejulius/use_json_stringify
• d935883 Update CONTRIBUTING.md
• dbfe236 Merge pull request Stats no longer updating datacamp/rdocumentation-app#418 from lukasolson/docs/contributing
• 713cabc Remove unnecessary instructions

See the full diff

Package name: grunt-contrib-coffee

The new version differs by 38 commits.

• 40bfa6b add back internal ci (make the index page look better in Rstudio datacamp/rdocumentation-app#198)
• f9eec6e updating to coffeescript 2 (solved media-tag problem with keyword search datacamp/rdocumentation-app#196)
• 72e1818 Merge pull request keyword press doesn't work in Rstudio datacamp/rdocumentation-app#193 from Florian-R/coffee-1.11.1
• 634e41f Bump coffee-script to 1.11.1
• c643075 Remove trailing spaces.
• 9bcddc1 Update grunt-contrib-internal to v1.1.0.
• bdc062c Update grunt to 1.0.0
• dbb494f Update CHANGELOG.
• bd39fc5 Update dependencies.
• 1651944 v1.0.0
• 854b051 Update docs message to be Grunt >= 0.4
• b0a355a Update travis and appveyor for supported node versions
• 01e92e7 Add grunt >= 0.4.5 peerDep
• 5e75633 Updating dependencies
• 5d2b2c0 Merge pull request Issue169 datacamp/rdocumentation-app#183 from aleclarson/master
• f2341cb Merge pull request versionNumber replace hyphens datacamp/rdocumentation-app#192 from sodle/patch-1
• 3d47cf8 Point main to task
• 11bcc13 Remove peerDeps. Ref Remove peerDependencies from plugins gruntjs/grunt#1116
• 2fa7ca1 Update copyright to 2016
• 2b7fc62 CI: Remove node.js '0.12' and add '5'.
• ce0b9a9 Compilation loop is skipped if no files matched.
• 8e8dd94 Update docs.
• cb02b25 Update coffee-options.md
• 3a1110c Update test files.

See the full diff

Package name: grunt-contrib-uglify

The new version differs by 74 commits.

• d7704c4 v0.11.1
• c129bf6 Merge pull request Source code page design datacamp/rdocumentation-app#377 from avdg/fix-screw-ie8-option-crash
• d74556f Merge pull request rdocumentation.org is not showing new packages(anymore) yet again. datacamp/rdocumentation-app#387 from joeldenning/patch-1
• 758b7d5 Merge branch 'master' of github.com:gruntjs/grunt-contrib-uglify
• 92c84c8 Point main to task
• 0b00c0b Remove peerDeps. Ref Remove peerDependencies from plugins gruntjs/grunt#1116
• 52cc6ae Merge pull request rdocumentation.org is not showing new packages(anymore) - stopped Wed Oct 25 2017 datacamp/rdocumentation-app#388 from swarajgiri/bump-dependencies
• 2ff0283 Update lodash, maxmin and dev dependencies
• 6352022 Improve documentation for conditional compilation
• a6dd1cb Merge pull request RDocumentation outdated for package surveillance datacamp/rdocumentation-app#386 from ramswaroop/master
• f3c4592 Update README.md
• ea77dde Merge pull request Continous parser api datacamp/rdocumentation-app#375 from jrhite/master
• 63279df Update copyright to 2016
• 71bf6f5 Merge branch 'master' of https://github.com/vibornoff/grunt-contrib-uglify into fix-screw-ie8-option-crash
• be7de43 CI: Remove node.js '0.12' and add '5'.
• 8578547 add handling of mangle_properties regex option in uglifyjs
• 1deb3be v0.11.0
• 13e95a2 Bump uglify-js to v2.6.0.
• 17ee505 Revert "Do not use "^" versions, ever, use ~"
• 2562bb2 v0.10.1
• 326f932 Merge pull request R Docs light api and use datacamp/rdocumentation-app#369 from Rialgar/patch-1
• 7276245 Do not use "^" versions, ever, use ~
• b8bd228 v0.10.0
• e47d9e1 Merge pull request Update inlineMath field of mathjax config datacamp/rdocumentation-app#361 from UltCombo/patch-1

See the full diff

Package name: grunt-sync

The new version differs by 17 commits.

• ca10eb6 Bumping deps
• ab914cb Merge pull request [Snyk] Fix for 1 vulnerabilities #46 from tomusdrw/fix-28
• 1152ae9 Bumping version. Fixing convert when string given
• 3be053b Merge branch 'master' of github.com:victoriauniversity/grunt-sync into fix-28
• ca3cb3f [HOTFIX] Adds missing callback function 'return'.
• 9ea3b7f Converts destination paths in expanded mode safely and independently on user's OS.
• 9ec3d10 Bumping grunt-sync version
• 72862aa Bumping lodash to newest version
• 845643c Merge pull request [Snyk] Fix for 3 vulnerabilities #43 from tomusdrw/rmdir-sync
• 1e979b3 Synchronous removal of directories. Fixes [Snyk] Fix for 2 vulnerabilities #41
• 79415ee Fixing issue with system specific path starting with /
• 4b3f9b6 Adding better support for ignoreInDest patterns.
• b80ffe9 Updating readme for newest version. Added contributors
• eb6d407 Merge pull request [Snyk] Fix for 1 vulnerabilities #34 from janeklb/compareUsing-md5
• 5e90d32 Can compare using md5 hash instead, via compareUsing option
• 7606c38 Fixing readme. Closes [Snyk] Fix for 2 vulnerabilities #30
• 65782f8 Convert expanded desination path to system specific. [Snyk] Fix for 1 vulnerabilities #28

See the full diff

Package name: sails

The new version differs by 250 commits.

• 6e73a65 1.0.0
• 5f1d8b3 1.0.0-49
• 616e4e1 Insist on the latest sails-generate.
• 6ab0a5a 1.0.0-48
• 1e28823 Lifting with --redis now sets @ sailshq/connect-redis and @ sailshq/socket.io-redis.
• 9f29a03 Change approach from what was begun in 520a3c8cac5db1d9698c50efff82e476ec64fca8 so that we maintain the correct package name for the purpose of require().
• 520a3c8 Tolerate '@ sailshq/connect-redis' as session adapter.
• e2813f5 1.0.0-47
• 6768743 Tweak warning message.
• ce95c84 Update comments to reflect that req.setLocale() is fully supported as of Sails v1.0 and beyond.
• 0753a99 Trivial
• 3bdd786 Tweak troubleshooting tips.
• e8f9bee Check dev-dependencies for sails-hook-grunt
• e8493a6 1.0.0-46
• d1b6061 run tests on Node 9
• b3afed7 Fix issue with CSRF black/whitelists and routes containing optional params when the requested URL contains a querystring but NOT the optional param (whew!)
• 663527f Fix test error output
• 69ead96 Revert 35ae3ccba472bf4a8edb8ffd7d579d18391d1ba0 in favor of clarifying some of the wording.
• 35ae3cc Experiment with customizable www path
• a89d7a4 extrapolate www path
• a2a0789 Tolerate sails-hook-grunt specified in devDependencies when running sails www
• 0b42c59 Don't attempt to create a Redis connection if "client" is provided.
• 1700788 Update LICENSE.md
• 9c532dc Merge pull request #4267 from luislobo/patch-3

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic