[Snyk] Fix for 9 vulnerabilities

[ajesse11x]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-AWSSDK-1059424	No	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-CONVICT-1062508	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-CONVICT-2340604	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-CONVICT-2774757	Yes	No Known Exploit
	534/1000 Why? Has a fix available, CVSS 6.4	Denial of Service (DoS) SNYK-JS-CONVICT-3228003	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Directory Traversal SNYK-JS-MOMENT-2440688	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-NATURAL-1915418	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: aws-sdk

The new version differs by 250 commits.

• 8875a35 Updates SDK to v2.814.0
• dd83d67 throw at invalid profile name in shared ini file (#3585)
• ee0c5a3 Updates SDK to v2.813.0
• 468d15b Updates SDK to v2.812.0
• c50132f Update README.md with references to JS SDK V3 (#3582)
• 3e19b08 Updates SDK to v2.811.0
• f26c00d Updates SDK to v2.810.0
• b393a6e Adds automatic PreSignedUrl generation to RDS.StartDBInstanceAutomatedBackupsReplication (#3566)
• fa57967 Updates SDK to v2.809.0
• 9a52018 Updates SDK to v2.808.0
• 1958076 Updates SDK to v2.807.0
• ffcad20 Updates SDK to v2.806.0
• 2f37893 chore: remove cognitoidentity customizations to disable auth (#3543)
• c6fe3c0 Updates SDK to v2.805.0
• 71d6fa9 Fix dual-callback case (#3537)
• b981971 Updates SDK to v2.804.0
• 332573f Updates SDK to v2.803.0
• deb7bc7 Updates SDK to v2.802.0
• b6401d0 Remove incorrectly named service named 'Profile' (#3562)
• 3364d4b Updates SDK to v2.801.0
• d400577 Updates SDK to v2.800.0
• 21c7dc0 Updates SDK to v2.799.0
• d2b8964 Updates SDK to v2.798.0
• 44ded82 fix: test IAM.getUser instead of listUsers (#3542)

See the full diff

Package name: chokidar

The new version differs by 113 commits.

• 7b8e02a Release 3.0.0.
• e7bfe2f Move stuff.
• df7f22e Remove changelog from npm, move to hidden dir.
• 3df7692 Improve naming.
• 6e94ca2 Clean-up.
• 2de2f9c test: Add testing of Node.js v12 in Travis pipeline. (#833)
• 9e0965a Fix Windows tests in Travis CI (#832)
• c95a98f Update stuff.
• 187ff2b test: Trying to fix blinked tests for Travis CI. (#825)
• db99076 fix(Windows): Add converting from windows to unix path for all ignored paths. (#824)
• 41f8782 fix(FsEvents): Remove situation with NaN depth. (#823)
• 7cf3f7e Update readdirp to stable.
• 0927a62 Bump packages.
• 11cd857 Update nyc.
• 99c14d7 Uncomment fsevents.
• cf330a5 Update fsevents.
• 0e4fca5 Fix deps.
• 9c575d4 Fix Windows version (#821)
• 3323d59 fix(Linux): Make event loop hack for keep testing valid. (#820)
• 06214c5 Update to latest readdirp.
• 793639f Rename osxfswatch.
• 078bc2d Refactor and fix freaking tests.
• 2b9bb41 Try node 11.
• 3fe3d4e Test travis.

See the full diff

Package name: convict

The new version differs by 132 commits.

• e4964f2 chore(release): publish new version 6.2.4
• fb602fb fix-imperfect-prototype-pollution-fix (Update README dadi/api#411)
• 9ca2d82 chore: Don't create CHANGELOG files manually
• 23b5722 docs: Update CONTRIBUTING about auto-CHANGELOG
• 0785e99 Fix lerna.json file
• de1629a fix: Consistent use of quotes in output (Bump logger version dadi/api#405)
• 18d9115 chore: Switch from Lerna to Workspaces+Lerna-Lite (Ensure version of @dadi/logger is up to date dadi/api#404)
• deef5d7 v6.2.3
• 5e64b53 More recent Ubuntu dist for Travis CI build
• 1ea0ab1 More more complete fix for prototype pollution
• c7acb02 Update info regarding publishing on NPM
• 4da12f8 v6.2.2
• 8ad66b5 Update CHANGELOG
• 3b86be0 More complete fix against prototype pollution
• e3173b1 Clearer variable name
• 5eb1314 v6.2.1
• 5ad62d6 Update CHANGELOG
• c682086 fix misspelling of the word optional in the error message (Ability to specify fields to return by nested keys dadi/api#397)
• bdd8a4e v6.2.0
• f693077 Provide working links in the CHANGELOG
• d90f2f8 Update CHANGELOG
• 11ef47e chore: update dependencies (Composition fails if reference field is undefined dadi/api#390)
• 41e8c4a v6.1.0
• 8d198ef Update CHANGELOG for next 6.1.0 release

See the full diff

Package name: natural

The new version differs by 142 commits.

• bc85e32 5.1.11
• 90e85af Follow up of pull request #626 (#627)
• 7689c9a Update README.md
• 93925ec Update CONTRIBUTING.md
• a82ab35 Update SECURITY.md
• d59e757 Create SECURITY.md
• bb5f854 Create codeql-analysis.yml (#624)
• c079b23 5.1.10
• 6e49236 Security patch set value (#623)
• 6320546 5.1.9
• eb43511 Bump path-parse from 1.0.6 to 1.0.7 (#622)
• 106ab78 Bumped glob-parent dependency to 5.1.2 (#621)
• d5aa79e 5.1.8
• cdf1644 Bump hosted-git-info from 2.8.8 to 2.8.9 (#620)
• 02cbe62 5.1.7
• f17611e Bump lodash from 4.17.11 to 4.17.21 (#619)
• 9cb2761 5.1.6
• 2a4a193 Bump underscore from 1.9.1 to 1.12.1 (#618)
• 9f57acc 5.1.5
• 93d8e04 Bump ssri from 6.0.1 to 6.0.2 (#617)
• d844455 5.1.4
• 51ffa5a Bump y18n from 3.2.1 to 3.2.2 (#616)
• 336594d 5.1.3
• a55aa0a Bump elliptic from 6.4.1 to 6.5.4 (#615)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Denial of Service (DoS)
🦉 Directory Traversal