[Snyk] Fix for 4 vulnerabilities

[teelee7133]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	591/1000 Why? Recently disclosed, Has a fix available, CVSS 6.1	Open Redirect SNYK-JS-EXPRESS-6474509	Yes	No Known Exploit
	601/1000 Why? Recently disclosed, Has a fix available, CVSS 6.3	Improper Encoding or Escaping of Output SNYK-JS-KATEX-6483831	No	No Known Exploit
	561/1000 Why? Recently disclosed, Has a fix available, CVSS 5.5	Incomplete List of Disallowed Inputs SNYK-JS-KATEX-6483834	No	No Known Exploit
	611/1000 Why? Recently disclosed, Has a fix available, CVSS 6.5	Unchecked Input for Loop Condition SNYK-JS-KATEX-6483835	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gatsby

The new version differs by 250 commits.

• f1d3f7b chore(release): Publish
• 6e6ea56 chore(release): Publish rc
• df50ce7 fix(gatsby): Add dir=ltr to Fast Refresh overlay (#29900) (#29908)
• 83adec5 chore(docs): update readme (#29837) (#29909)
• b2628da will git stop being weird (#29897) (#29907)
• c98c87f chore(release): Publish rc
• c8bf571 fix(gatsby-source-wordpress): image fixes (#29813) (#29886)
• 85bb8ea fix(gatsby-plugin-image): Update peerdeps (#29880) (#29888)
• c266b83 fix(gatsby): Remove `react-hot-loader` deps & other unused deps (#29864) (#29876)
• 222ca3f fix(gatsby): with some custom babel configs array spreading with Set is not safe (#29885) (#29889)
• ea31900 chore(release): Publish rc
• f070422 fix(gatsby): Fix various small DEV_SSR bugs exposed in development_runtime tests (#29720) (#29866)
• cb3b1ca chore: update peerdeps to latest major versions (#29857) (#29867)
• 8639f7b fix(create-gatsby): Use legacy peer deps (#29856) (#29862)
• fdc1fe2 fix(gatsby): fix some css HMR edge cases (#29839) (#29865)
• e8a7e3b fix(gatsby-plugin-preact): fix fast-refresh (#29831) (#29860)
• e7453c3 fix(gatsby): Improve Fast Refresh overlay styles (#29855) (#29861)
• 76f4f96 chore: upgrade postcss & plugins (#29793)
• de6cba6 chore(release): Publish rc
• aafe584 fix: query on demand loading indicator always active on preact. (#29829) (#29836)
• 34f5b8c fix(hmr): accept hot updates for modules above page templates (#29752) (#29835)
• b8d21f8 fix(gatsby): workaround graphql-compose issue (#29822) (#29834)
• 32fee71 fix(gatsby): eslint linting (#29796) (#29814)
• bca7951 fix(gatsby-source-wordpress): HTML image regex's (#29778) (#29816)

See the full diff

Package name: gatsby-cli

The new version differs by 250 commits.

• c1e67a2 chore(release): Publish
• 0c45654 chore: remove tracedSVG (#37093) (#37137)
• d7edf95 chore(release): Publish
• 2d00ea0 fix(gatsby-plugin-mdx): Do not leak frontmatter into page (#35859) (#35913)
• 4997d63 chore(release): Publish
• ff94ed5 fix(gatsby-plugin-mdx): don't allow JS frontmatter by default (#35830) (#35834)
• 36f21b0 chore: Removate validate-renovate from v3-latest branch (#34460)
• 1acb1bc chore(release): Publish
• 1589bd8 fix(gatsby): ensure that writing node manifests to disk does not break on Windows (#33853) (#34020)
• 9694010 fix(gatsby-source-drupal): Ensure all new nodes are created before creating relationships (#33864) (#34019)
• 76deb39 fix(gatsby-source-drupal): searcParams missing from urls (#33861) (#34018)
• f74cc8f feat(gatsby-source-drupal): Add node manifest support for previews (#33683) (#34017)
• 476a591 chore(release): Publish
• 35b48f8 fix(gatsby-plugin-image): GatsbyImage not displaying image in IE11 (#33416) (#33806)
• 880022e fix(gatsby-plugin-image): flickering when state changes (#33732) (#33807)
• c0d07e7 feat(gatsby-source-wordpress): Update supported-remote-plugin-versions.ts (#33801) (#33804)
• 3d9a702 chore(release): Publish
• 84053a2 fix(gatsby-plugin-sharp): pass input buffer instead of readStream when processing image jobs (#33685) (#33703)
• 4722a0d fix(gatsby-source-drupal): Add timeout in case of stalled API requests (#33668) (#33705)
• 857a628 fix(gatsby): single page node manifest accuracy (#33642) (#33698)
• 6bfd0f1 Properly set the pathPrefix and assetPrefix in the pluginData (#33667) (#33702)
• 26c51c0 fix(gatsby-source-drupal): cache backlink records (#33444) (#33701)
• b80c53a fix(gatsby-source-drupal): Correctly update nodes with changed back references so queries are re-run (#33328) (#33699)
• e29a194 chore: use gatsby-dev-cli@latest-v3 in tests

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect