[Snyk] Fix for 2 vulnerabilities

[pantsel]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	753/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: grunt-contrib-jst

The new version differs by 11 commits.

• 376f0d0 fix up the line endings on windows
• ed88af9 v2.0.0
• 1bd3d2a Merge pull request adding basic auth support in the konga dashboard , #65 from shailesh-kanzariya/upgrade_lodash_to_4.17.20
• 0d595c2 updated ci script
• e659f27 modified engine prop to nodejs 4.x
• af22b11 bumped lodash, modified jst and test cases to work with latest lodash version
• 719a961 Normalize line endings.
• 285f3ec Trying to fix Windows tests; one is left broken.
• 806ddbe Minor lint tweaks.
• adb8c04 Add AppVeyor support.
• c8bf51f Update grunt-contrib-internal

See the full diff

Package name: sails

The new version differs by 250 commits.

• 6e73a65 1.0.0
• 5f1d8b3 1.0.0-49
• 616e4e1 Insist on the latest sails-generate.
• 6ab0a5a 1.0.0-48
• 1e28823 Lifting with --redis now sets @ sailshq/connect-redis and @ sailshq/socket.io-redis.
• 9f29a03 Change approach from what was begun in 520a3c8cac5db1d9698c50efff82e476ec64fca8 so that we maintain the correct package name for the purpose of require().
• 520a3c8 Tolerate '@ sailshq/connect-redis' as session adapter.
• e2813f5 1.0.0-47
• 6768743 Tweak warning message.
• ce95c84 Update comments to reflect that req.setLocale() is fully supported as of Sails v1.0 and beyond.
• 0753a99 Trivial
• 3bdd786 Tweak troubleshooting tips.
• e8f9bee Check dev-dependencies for sails-hook-grunt
• e8493a6 1.0.0-46
• d1b6061 run tests on Node 9
• b3afed7 Fix issue with CSRF black/whitelists and routes containing optional params when the requested URL contains a querystring but NOT the optional param (whew!)
• 663527f Fix test error output
• 69ead96 Revert 35ae3ccba472bf4a8edb8ffd7d579d18391d1ba0 in favor of clarifying some of the wording.
• 35ae3cc Experiment with customizable www path
• a89d7a4 extrapolate www path
• a2a0789 Tolerate sails-hook-grunt specified in devDependencies when running sails www
• 0b42c59 Don't attempt to create a Redis connection if "client" is provided.
• 1700788 Update LICENSE.md
• 9c532dc Merge pull request #4267 from luislobo/patch-3

See the full diff

Package name: sails-disk

The new version differs by 85 commits.

• 15faa44 1.0.0
• a2b7ee6 1.0.0-12
• 9d7118c Only set footprint keys for uniqueness violations.
• a2c2261 Add some assertions.
• a222824 Update gitignore and scripts
• 3b3c334 1.0.0-11
• cef95b4 Support updating the primary key value, as long as it's not using _id as the column.
• aad2a15 Set _id column to value of primary key when creating records.
• 333e2d1 1.0.0-10
• c8a26c5 Add shim to replicate MongoDB's behavior w/ `{ $ne: null }` and empty arrays.
• bf92cb8 1.0.0-9
• af97943 Workaround issue with projections including only `_id`
• b5b985b Relax restrictions on using `_id` column in sails disk.
• f4adfd7 Add an entry in the `refCols` dictionary for every model, so we don't have to short-circuit checks for it later
• b494fd9 In `find`, deserialize Buffer objects into `ref` attributes where possible.
• 7aaaaa4 Merge pull request Cannot assign ACL plugin to existing API #58 from balderdashy/expose-lib
• 70ead96 (whoops) Add back 0.10 and 0.12 in appveyor.yml
• beabe7a Merge pull request Can not access the konga #57 from balderdashy/expose-lib
• 9c80187 1.0.0-8
• f7a349d Actually, don't expose the static lib. (No reason to do so, and better to not introduce something experimental if there's any chance it could make an app dependent on random stuff in a dev-only adapter)
• 2d4d97e 1.0.0-7
• f2dd761 Rename afterwards function to avoid perceived scope conflict (whether or not it'd ever actually be a big deal, this avoids any potential future scope issues from refactoring, etc).
• 4051e5e 1.0.0-6
• 250c32e Handle stray error (and a couple of other trivial changes just from when I was reading through the code)

See the full diff

Package name: sails-mysql

The new version differs by 202 commits.

• e9ca5d0 1.0.0
• 1c8eba9 1.0.0-17
• 2384285 Same as 2cc4850eb0fc3ff58eeaef044c2b14379af1be32 but for 2 other occurrences.
• 2cc4850 Apply fix from eslint to properly pass through compileStatement() errors
• ba40d9a Update eslint
• ed86ee1 1.0.0-16
• 227e9ba Bump versions of mariadb tests-- and explicitly test node 8
• 917db33 Use mp-mysql@3 (see https://github.com/Memory leak balderdashy/sails#4264#issuecomment-353152823)
• 5e8ed7e Follow-up to 075d7590dfb5fc51ee7c3084df87261b46ea5356
• 075d759 Update machine runner to v15. (refs https://github.com/Memory leak balderdashy/sails#4264)
• 0d0503c Even better
• 6186297 Update language in config errors
• d1f0791 1.0.0-15
• d511f24 Allow `ref` type attributes to represent any object, not just Buffers.
• 3a62cf5 1.0.0-14
• b8c74aa Merge pull request does konga support cassandra or can we integrate cassandra #349 from balderdashy/revert-utf8mb4-default
• b98a2f0 Revert code that defaults to the `utf8mb4` character set.
• 987f467 Merge pull request Doesn't work properly with 1.1.0rc1 #346 from balderdashy/support-emojis
• 3adc445 1.0.0-13
• 65aa28f lint fix
• 9fd09c9 1.0.0-12
• e9cbd78 Change default charset to support emojis. This also adds some comments and notes for the future.
• 6efdddc 1.0.0-11
• 056b12b use LONGTEXT by default because mysql truncates data silently

See the full diff

Package name: sails-postgresql

The new version differs by 250 commits.

• e9728fe 1.0.0
• 3ee54ac 1.0.0-13
• a2b0da4 Bump mp-postgresql version
• 0266a58 Update `.exec({...})` to `.switch({...})`
• 50a8e22 Update helpers to work w/ new machine runner
• cf3a294 Bypass `bigint` validation for auto timestamps
• b9352bd If invalid model definitions are detected, just return an error message _without_ a stack trace.
• 296f538 Coerce empty string to zero when bigint column type is in use
• 6dea61c Throw an error if `type: 'number'` is used with `columnType: 'bigint'`
• 24164da Update language in config errors
• 67aa86b 1.0.0-12
• cae9019 Stringify strings before using them as values for JSON attributes
• beb7415 1.0.0-11
• 2691491 Allow `ref` type attributes to represent any object, not just Buffers.
• bdf2b7d 1.0.0-10
• 1b34e1f use column name when parsing values
• b004869 1.0.0-9
• a4c8d2c Merge pull request A help message was inverted for the cors plugin #270 from balderdashy/fixes
• 8765654 bump min wl-util version
• 913cad6 key orm by identity rather than table name
• a0ae8a2 add depth validation to pre-process
• 1196975 make sure to process each record when no child statements are needed
• 2c894d2 pass true to process each record deep to show it uses column names
• 5822b3d include strategy type when building the query cache

See the full diff

Package name: sails-sqlserver

The new version differs by 21 commits.

• 5815e09 chore: version bump 2.0.1
• 2f5fd9d fix: add machinepack-mssql dependency
• 5bec31a Merge pull request Konga crashes when adding API key to consumer with no prior keys #4 from intel/sails-v1
• e0c4b0b refactor: use WATERLINE_ADAPTER_TESTS_URL
• d72e2d7 refactor: unused/unneeded references
• 36747d6 feat: support for sails-v1
• 726ecdf chore: add .npmrc to .gitignore
• 0cc307f major version update
• 655da19 feat: update dependencies and improve join performance
• 71a6291 Merge pull request backendURL in frontend config incorrect #1 from jkeczan/master
• a94851c Merge pull request Fixes typo. #3 from peoplewareDo/master
• c2a8582 Merge pull request frontend model npm install error #2 from kdelmonte/master
• dbc4d96 fixed insert returning wrong id
• f693b74 update mssql v4.0.1 dependency
• 789d1de Fix issue were insert would break if the PK was a GUID due to the adapter adding an SET IDENTITY_INSERT clause which should only be used with integer PKs
• f764cfb Merge pull request Make konga work with relative paths #21 from RubiconInternational/master
• 5068798 Merge pull request Unable to login with docker instance #28 from keeganmccallum/master
• 5587101 Allow using the meta "schemaName" property to override schema
• b420eee Merge pull request When changing kong nodes / adding new onces consumers are not listed #23 from some-say/master
• d120f0b issue orm fail when kill sails.js
• 53bdeaa fix issue with string literal values not prepended with 'N' before the delimeter, which is imperative for unicode values

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic