[Snyk] Fix for 2 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change	Exploit Maturity
	Prototype Pollution SNYK-JS-AJV-584908	Yes	No Known Exploit
	Insecure Randomness SNYK-JS-CRYPTOJS-548472	No	No Known Exploit

Commit messages

Package name: ccxt

The new version differs by 250 commits.

• 310d123 1.18.609
• 8e50b4d Merge branch 'frosty00-vendor-cryptojs' #4875 fix #5180
• 8ca3989 Merge branch 'vendor-cryptojs' of https://github.com/frosty00/ccxt into frosty00-vendor-cryptojs
• 325cbca 1.18.608
• ebdca74 removed a reference to node 'constants' from Node-RSA.js
• 4a02c13 oceanex py/php files
• 281c710 remove a reference to node 'constants' from node-rsa pkcs1.js
• dbc66b6 Update pkcs1.js
• 7a6c56d revert .travis.yml
• c2f5ce6 cleanup .travis.yml cache
• fbfa5dc 1.18.607
• ede89d7 bx.in.th minor edit
• e8b5e75 Merge branch 'master' of github.com:ccxt/ccxt
• 662ff7a 1.18.606
• 8ebd879 Merge pull request #5219 from npomfret/master
• a2b09c6 quotes in Exchange.js
• 31e92dd livecoin LEO → LeoCoin fix #5226
• f877a0a bx.in.th LEO → LeoCoin fix #5226
• 98a43f3 bittrex parseTransaction minor edit
• 79952d0 Update bittrex.js
• 2b7977f bittrex v3 hostname support
• 2e6c547 bittrex fetchClosedOrdersV3 cleanup
• eedc5c1 bittrex parseOrderV3 minor edits
• f5866ce bittrex v3 minor edits

See the full diff

Package name: file-loader

The new version differs by 5 commits.

• 1451b1e chore(release): 1.1.7
• 98bf052 fix(index): don't concat `options.outputPath` and `options.publicPath` (Parabolic SAR strategy DeviaVir/zenbot#246)
• 9ee8332 docs(README): add `regExp` option (`options.regExp`) (funds on hold forever DeviaVir/zenbot#244)
• f62bc44 chore(package): update `schema-utils` v0.3.0...0.4.5 (Bitfinex extension PR DeviaVir/zenbot#245)
• ef5688e docs(README): correct default value for `digestType` (`hashes`) (Arbitrage 4.x DeviaVir/zenbot#239)

See the full diff

Package name: har-validator

The new version differs by 10 commits.

• a38c067 5.1.3
• 45c48fa chore(deps): lock file maintenance ([Snyk] Fix for 1 vulnerabilities #106)
• 957913b chore(release): 5.1.2 [skip ci]
• 1764b7c fix(docs): update badge links
• 75dfab0 chore(release): 5.1.1 [skip ci]
• fd01aff fix(scaffold): update project scaffold template
• 759bffe Update AJV to version 6 ([Snyk] Security upgrade echarts from 5.3.0 to 5.5.1 #109)
• e0fee11 chore(deps): update dependency tap to v12 ([Snyk] Fix for 1 vulnerabilities #108)
• d09cc80 Prefer const over let ([Snyk] Security upgrade setuptools from 40.5.0 to 70.0.0 #111)
• a19a82d build(renovate): replace dependencies.io with Renovate app

See the full diff

Package name: postcss-loader

The new version differs by 6 commits.

• 6ddc2bb chore(release): 2.1.0
• 410bbf9 chore(package): update dependencies
• 56232e7 feat(index): pass AST (`result.root`) && Messages (`result.messages`) as metadata to other loaders (Gemini exchange DeviaVir/zenbot#322)
• 4e8e20c ci(travis): add node `stable` && `lts/*`
• 8242689 test(watch): linting && structure
• a8921cc fix(index): continue watching after dependency `{Error}` (add xmpp messaging DeviaVir/zenbot#332)

See the full diff

Package name: style-loader

The new version differs by 11 commits.

• 5d73db7 chore(release): 0.20.0
• 08ce425 chore(package): update dependencies
• 28f603f refactor: remove comments from bundle source code
• dda8b89 test: rename && update HMR tests
• 23c3567 fix(options): add `transform` option validation (`{String}`)
• e0c4b19 fix(options): support passing a `{Function}` (`options.insertInto`)
• ac8430c ci(travis): update `node` v4.3.0...4.8.0
• 0eb8fe7 feat: support passing a `{Function}` (`options.insertInto`) (Run time error "cannot find module concat-map" DeviaVir/zenbot#279)
• 3a4cb53 fix(index): enable HMR in case `locals` (`css-modules`) are unchanged (Implement genetic algo for fine tuning strategy parameters DeviaVir/zenbot#298)
• 9b46128 fix(addStyles): check if `HTMLIFrameElement` exist (sim and trade differ DeviaVir/zenbot#296)
• a7734e6 chore(package): update repository url (Wording in conf.js DeviaVir/zenbot#290)

See the full diff

Package name: url-loader

The new version differs by 11 commits.

• 0eeaaa9 chore(release): 1.0.0
• 0390cdb test: standardize (`@webpack-contrib/test-utils`) ([Snyk] Security upgrade bootstrap from 4.6.0 to 5.0.0 #114)
• 457618b fix(index): use `Buffer.from` instead of deprecated `new Buffer` ([Snyk] Security upgrade bootstrap from 4.6.0 to 5.0.0 #113)
• b4be0c8 ci(circle): Fix rebuild issues
• 4a62cd5 ci(circle): Generate checksum from lock file
• 5aeba3e chore: Update to defaults rc.1
• 3c87902 chore(release): 1.0.0-beta.0
• b61859c chore: Fix package.json prop ordering
• f9174d2 docs(readme): Updates coverage badge
• 5ce17f7 docs(readme): Update CI status badge
• 073b588 refactor: apply `webpack-defaults` ([Snyk] Security upgrade express from 4.17.2 to 4.19.2 #102)

See the full diff

Package name: webpack

The new version differs by 62 commits.

• f010546 update examples
• bc840ec 3.11.0
• 9323ee6 Merge pull request #6398 from addaleax/no-binding
• c7cbc35 Merge pull request #6430 from jbottigliero/update/ajv
• 61b75b7 update ajv + ajv-keywords
• 8da8b93 Work around Node environment variable bug
• ddb1fad Merge pull request #6408 from ocombe/fix/#6407-empty-array
• 2aebfbe fix(ConcatenatedModule): don't throw on arrays with empty values
• 3972d9a Merge pull request #6391 from nerdkid93/patch-1
• e4375f8 Avoid relying on Node’s internals
• 0dd1727 change polymer loader link
• 33f518b Merge pull request #6300 from nename0/fix-6243
• 80ed1c4 Merge pull request #6335 from Connormiha/banner-plugin-optimize
• 5d93c53 Minor optimize banner plugin
• 1895b76 Add Tests checking chunkhash of runtime chunk only changes if needed
• dc7ebeb Fix #6243: Don't include initial chunks in chunkhash computation
• b545b51 Merge pull request #6242 from nename0/6239-require-ensure-initial-chunks
• b059e07 Merge pull request #6176 from mikegreiling/fix-no-fail-on-child-compilation-error
• 64c4350 Update StatsTestCases
• 8b0a2ad Merge pull request #6225 from neeharv/feature/async-script-type
• d1e0bec Fix: the require-ensure only includes non-initial chunks
• 21b5a02 stringify jsonpScriptType option
• 8eb0bb6 move default script type option to WebpackOptionsDefaulter
• be327f9 lint fixes

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic