[Snyk] Fix for 8 vulnerabilities

[BitcoinOutput]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASHSET-1320032	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASHTEMPLATE-1088054	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Authorization Bypass Through User-Controlled Key SNYK-JS-PARSEPATH-2936439	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: cz-customizable

The new version differs by 8 commits.

• a73e0d9 fix: update critical dependencies ([Snyk] Security upgrade @angular/compiler-cli from 5.2.10 to 9.0.0 #66)
• a935f67 feat: add ticket-number question ([Snyk] Security upgrade bcrypt from 3.0.8 to 5.0.1 #51)
• 4b569b8 feat: add option to skip any questions ([Snyk] Security upgrade codecov from 2.2.0 to 3.0.1 #65)
• 67e3ab7 fix: update node and semantic release versions ([Snyk] Security upgrade gulp from 4.0.2 to 5.0.0 #60)
• 6d456b0 feat: add Typescript type definition file ([Snyk] Security upgrade gulp from 4.0.2 to 5.0.0 #59)
• 4c8736a feat: add Node v10 support ([Snyk] Fix for 1 vulnerabilities #58)
• fdbf9ae feat: able to customize length limit of subject and warn when exceed ([Snyk] Security upgrade gulp from 4.0.2 to 5.0.0 #54)
• ec4f6d7 docs(readme): fix a typo ([Snyk] Security upgrade bcoin from 0.15.0 to 1.0.2 #46)

See the full diff

Package name: lerna

The new version differs by 250 commits.

• c567a29 chore(release): v5.1.8
• f954404 fix: update git-url-parse to v12 ([REF] show no value for zero amount transactions bitpay/bitcore#3231)
• f74c08c docs: fix typo
• e4acb28 chore: fix formatting after publish
• 0e47379 chore(release): v5.1.7
• ead461e fix(run): add double quotes around script target containing colon (BWS persistent config bitpay/bitcore#3218)
• 041f581 chore: add some version e2e coverage for --conventional-prerelease and --conventional-graduate (Error "pathspec '4.0' did not match any file(s) known to git." bitpay/bitcore#3224)
• 0eb7f7b docs(website): enable search (LET SMILEY GRADUATE POWER POINT bitpay/bitcore#3222)
• 87278f0 chore: set longer jest timeout for version conventional commits e2e
• 11c8247 docs: add info about npm automation tokens (increase search input padding to avoid text and search icon overlap on desktop view bitpay/bitcore#2825)
• 808132f chore: more e2e coverage for conventional-commits ([FIX] ERC20 chain issue 2 bitpay/bitcore#3221)
• 1129224 docs: add configuration guide
• 54b693d chore: add initial coverage for version --conventional-commits (Docker Image not available  bitpay/bitcore#3213)
• 73492e2 chore: share normalization logic in jest serializers (Feature/cleanup script bitpay/bitcore#3212)
• 93d2501 chore: fix typo in getting-started.md ([FIX] Insight - LTC bitpay/bitcore#3206)
• 7493610 chore: add some initial e2e coverage for version (Insight/hashing assets bitpay/bitcore#3209)
• edf59da chore(release): v5.1.6
• f80d03c fix: lerna run parallel should maximize concurrency with useNx ([FIX] Point does not lie on the curve error bitpay/bitcore#3205)
• a8b4ce4 chore: use ssh-agent 0.5.4 in github actions ([BWS] Doge and LTC chain tests bitpay/bitcore#3204)
• f7bc7a5 chore: tweak fixture insantiation
• f1c765b chore: add contributors
• fe4be62 chore: refactor e2e test implementation (Auto load modules for configured chains bitpay/bitcore#3203)
• 18b1b54 chore: e2e test structure (Fix uncaught error in XRP ledeger query bitpay/bitcore#3200)
• ef1ff4b chore(release): v5.1.5

See the full diff

Package name: lint-staged

The new version differs by 146 commits.

• 885a644 Merge pull request Add Meteor Support bitpay/bitcore#852 from okonet/listr2
• aba3421 fix: all lint-staged output respects the `quiet` option
• b8df31a fix: do not show incorrect error when verbose and no output
• eed6198 style: simplify eslint and prettier config
• b746290 ci: replace Node.js 13 with 14, since 14 will be next LTS
• 2c6f3ad docs: improve `verbose` description
• e749a0b test: remove redundant, misbehaving test
• 16848d8 fix: use test renderer during tests and when TERM=dumb
• efffa22 test: cover `--verbose` option usage
• 1b18550 test: restore variable in test output
• 6aede38 test: add test for error during merge state restoration
• b565481 test: integration test targets the full Node.js API instead of just `runAll`
• a3bd9d7 feat: allow specifying `cwd` using the Node.js API
• 85de3a3 feat: add `--verbose` to show output even when tasks succeed
• d69c65b fix: log task output after running listr to keep everything
• e95d1b0 refactor: move skip and enable cheks of listr tasks to separate file
• 6da7667 refactor: move messages to separate file
• 6392480 refactor: use symbols for errors
• 8f32a3e feat: replace listr with listr2 and print errors inline
• c9adca5 fix: use stash create/store to prevent files from disappearing from disk
• e093b1d fix(deps): update dependencies
• 6066b07 fix: pass correct path to unstaged patch during cleanup
• 0bf1fb0 fix: allow lint-staged to run on empty git repo by disabling backup
• 1ac6863 Merge pull request Browser Compatibility bitpay/bitcore#837 from okonet/serial-git-add

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Server-side Request Forgery (SSRF)