[Snyk] Fix for 13 vulnerabilities

[baby636]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • demos/DonateNow/front/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Cross-site Request Forgery (CSRF) SNYK-JS-AXIOS-6032459	No	Proof of Concept
	526/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.1	Arbitrary Code Injection SNYK-JS-EJS-1049328	No	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-EJS-2803307	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTMLMINIFIER-3091181	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASHTEMPLATE-1088054	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-NTHCHECK-1586032	No	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @nuxtjs/axios

The new version differs by 88 commits.

• 99d7876 chore(release): 5.11.0
• 07ca13c feat: experimental runtimeConfig support
• 89b4dbf chore(deps): update dependency @ nuxtjs/proxy to v2 (Bump grunt from 1.0.4 to 1.5.3 in /demos/DonateNow/front tronprotocol/sun-network#372)
• e848b9d fix(plugin): always get global `$nuxt` while loading (http://freewallet.org/id/wrathchylde1975 tronprotocol/sun-network#364)
• 0957082 feat(types): add typings to axios config in `nuxt.config` (update logo tronprotocol/sun-network#357)
• 0f20c51 chore(release): 5.10.3
• 12da6c8 fix: globalName fallback for nuxt < 2.2.0
• b0483da chore(release): 5.10.2
• 95c6010 chore(deps): update dependency axios-retry to ^3.1.8 (Bump ajv from 6.10.2 to 6.12.6 in /demos/TinyDice/front tronprotocol/sun-network#353)
• 47788bd fix(plugin): add missing $ prefix to globalName (Invitation tronprotocol/sun-network#356)
• b46693b docs: add algolia search (Sun-Network Aufträge  tronprotocol/sun-network#355)
• ba71853 revert: add brotli test back
• ca320f1 chore(release): 5.10.1
• 7baaf5a revert: revert node brotli support (V103 upgrade tronprotocol/sun-network#276)
• 86d16cf chore(release): 5.10.0
• 8be99d1 test: remove brotli test
• 074f98c feat(plugin): enable server brotli if supported (closes V103 upgrade tronprotocol/sun-network#276)
• 18afe5c fix(module): browserBaseURL as empty string (fixes Bump http-proxy from 1.17.0 to 1.18.1 in /demos/DonateNow/front tronprotocol/sun-network#303)
• 6c5605d fix(plugin): preserve default headers (fixes Bump lodash from 4.17.15 to 4.17.21 in /demos/TinyDice/front tronprotocol/sun-network#323)
• fd1f8ec fix(plugin): use `globalName` instead of `$nuxt` (fixes Bump node-fetch from 2.6.0 to 2.6.7 in /demos/TinyDice/front tronprotocol/sun-network#345)
• 7dec0a0 chore: update yarn.lock
• a9d3e55 chore(deps): update all non-major dependencies (Bump node-sass from 4.12.0 to 7.0.0 in /demos/DonateNow/front tronprotocol/sun-network#350)
• d6b1043 chore(deps): update dependency defu to v2 (Bump pathval from 1.1.0 to 1.1.1 in /demos/DonateNow/front tronprotocol/sun-network#351)
• 509e43f Vue School links (Bump handlebars from 4.2.1 to 4.7.7 in /demos/DonateNow/front tronprotocol/sun-network#352)

See the full diff

Package name: eslint

The new version differs by 242 commits.

• 80b8d5d 5.5.0
• b68e403 Build: changelog update for 5.5.0
• 6e110e6 Fix: camelcase duplicate warning bug (fixes #10801) (#10802)
• 5103ee7 Docs: Add Brackets integration (#10813)
• b61d2cd Update: max-params to only highlight function header (#10815)
• 2b2f11d Upgrade: babel-code-frame to version 7 (#10808)
• 2824d43 Docs: fix comment placement in a code example (#10799)
• 10690b7 Upgrade: devdeps and deps to latest (#10622)
• 80c8598 Docs: gitignore syntax updates (fixes #8139) (#10776)
• cb946af Chore: use meta.messages in some rules (1/4) (#10764)
• a857cd9 5.4.0
• 8dee250 Build: changelog update for 5.4.0
• a70909f Docs: Add jscs-dev.github.io links (#10771)
• 034690f Fix: no-invalid-meta crashes for non Object values (fixes #10750) (#10753)
• 11a462d Docs: Broken jscs.info URLs (fixes #10732) (#10770)
• 985567d Chore: rm unused dep string.prototype.matchall (#10756)
• f3d8454 Update: Improve no-extra-parens error message (#10748)
• 562a03f Fix: consistent-docs-url crashes if meta.docs is empty (fixes #10722) (#10749)
• 6492233 Chore: enable no-prototype-builtins in codebase (fixes #10660) (#10664)
• 137140f Chore: use eslintrc overrides (#10677)
• 2af6f4f 5.3.0
• 11e70c7 Build: changelog update for 5.3.0
• dd6cb19 Docs: Updated no-return-await Rule Documentation (fixes #9695) (#10699)
• 6009239 Chore: rename utils for consistency (#10727)

See the full diff

Package name: globby

The new version differs by 33 commits.

• 878ef6e 10.0.0
• 3706920 Upgrade `fast-glob` package to v3 ([Snyk] Security upgrade babel-eslint from 8.2.6 to 9.0.0 #126)
• 8aadde8 Add `globby.stream` ([Snyk] Fix for 1 vulnerabilities #113)
• 2dd76d2 Remove `**/bower_components/**` as a default ignore pattern
• 9f781ce Require Node.js 8
• 04d51bf Upgrade `ignore` package ([Snyk] Security upgrade babel-loader from 8.0.6 to 9.1.3 #120)
• 2b61484 Readme tweaks
• ff3e1f9 Tidelift tasks
• 31f18ae Create funding.yml
• 33ca01c Fix using the `gitignore` and `stats` options together ([Snyk] Security upgrade nodemon from 1.19.1 to 3.0.0 #121)
• c737820 Minor TypeScript definition improvements
• 82db101 Add Node.js 12 to testing ([Snyk] Security upgrade nuxt from 2.8.1 to 2.11.0 #117)
• 766b728 9.2.0
• dc0a49c Refactor TypeScript definition to CommonJS compatible export ([Snyk] Security upgrade nuxt from 2.8.1 to 3.4.3 #115)
• 89cee24 9.1.0
• 59f4b48 Add check to ensure `cwd` is a directory ([Snyk] Fix for 1 vulnerabilities #110)
• 9a9cf1e Add TypeScript definition ([Snyk] Fix for 1 vulnerabilities #111)
• eb26c7e Meta tweaks
• d77a623 Add failing test for [Snyk] Security upgrade nuxt from 2.8.1 to 2.16.0 #105 ([Snyk] Security upgrade vconsole from 3.3.2 to 3.15.1 #108)
• 2294618 Deduplicate identical file patterns ([Snyk] Fix for 1 vulnerabilities #102)
• ba9c267 Add failing test for [Snyk] Fix for 1 vulnerabilities #97 ([Snyk] Security upgrade nuxt from 2.8.1 to 2.13.0 #100)
• 71b9c58 9.0.0
• 39ad0d9 Update dependencies
• d804228 Fix compatibility with latest `dir-glob` release ([Snyk] Fix for 1 vulnerabilities #99)

See the full diff

Package name: grunt

The new version differs by 29 commits.

• 27bc5d9 Merge pull request #1714 from gruntjs/release-1.2.0
• 64a3cf4 Release v1.2.0
• 0d23eff Merge pull request #1570 from bhldev/feature-options-keys
• ee70306 Merge pull request #1697 from philz/1696
• 05c0634 Merge pull request #1712 from gruntjs/fix-lint
• cdd1c19 fix lint in file.js
• bc168e3 Merge pull request #1283 from greglittlefield-wf/recognize-relative-links
• 5f16b5a Merge pull request #1675 from STRML/remove-coffeescript
• 58f80ae Merge pull request #1677 from micellius/monorepo-support
• 1f61427 Add CODE_OF_CONDUCT.md
• 4c6fcd9 Merge pull request #1709 from NotMoni/patch-1
• 169d496 add link to license
• 288ea76 add license link
• d5cdac0 Merge pull request #1706 from gruntjs/tag-neew
• 4674c59 v1.1.0
• 6124409 Merge pull request #1705 from gruntjs/mkdirp-update
• 0a66968 Fix up Buffer usage
• 4bfa98e Support versions of node >= 8
• f1898eb Update to mkdirp ~1.0.3
• 7985b19 Avoiding infinite loop on very long command names.
• 75da17b HTTPS link to gruntjs.com (#1683)
• 5a0a02b support monorepo (relative path)
• 6795d31 Update js-yaml dependecy to ~3.13.1 (#1680)
• 66fc8fa support monorepo (test case)

See the full diff

Package name: grunt-cli

The new version differs by 5 commits.

• 2293dc5 1.4.0
• bbc4400 Update changelog
• 3fa5bf6 Ignore package-lock
• c271173 Update deps, switch to actions ([Snyk] Security upgrade sunweb from 1.0.7 to 1.0.8 #141)
• 84ebcb8 Bump deps, required node version and ci ([Snyk] Fix for 1 vulnerabilities #137)

See the full diff

Package name: node-sass

The new version differs by 121 commits.

• 3b556c1 7.0.2
• c716359 Bump sass-graph@^4.0.1 (#3292)
• 24741b3 docs(readme): fix docpad plugin link
• 1523330 feat: Drop Node 12
• 365d357 update https://registry.npm.taobao.org to https://registry.npmmirror.com
• 1456114 build(deps): bump actions/upload-artifact from 2 to 3
• b465b69 chore: bump GitHub Actions to Windows 2019 (#3254)
• e6194b1 build(deps): bump make-fetch-happen from 9.1.0 to 10.0.4
• 4edf594 build(deps): bump node-gyp from 8.4.1 to 9.0.0
• 29e2344 build(deps): bump actions/checkout from 2 to 3
• 85b0d22 build(deps): bump actions/setup-node from 2 to 3
• 3bb51da Use make-fetch-happen instead of request (#3193)
• adc2f8b build(deps): bump true-case-path from 1.0.3 to 2.2.1 (#3000)
• 77d12f0 chore: disable Apline for Node 16/17 builds
• 308d533 ci: use Python 3 for Node 12
• c818907 ci: unpin actions/setup-node to v2
• 99242d7 7.0.1
• 77049d1 build(deps): bump sass-graph from 2.2.5 to 4.0.0 (#3224)
• c929f25 build(deps): bump node-gyp from 7.1.2 to 8.4.1 (#3209)
• 918dcb3 Lint fix
• 0a21792 Set rejectUnauthorized to true by default (#3149)
• e80d4af chore: Drop EOL Node 15 (#3122)
• d753397 feat: Add Node 17 support (#3195)
• dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0

See the full diff

Package name: nodemon

The new version differs by 14 commits.

• 9a67f36 feat: update chokidar to v3
• 6781b40 docs: add license file
• 0e6ba3c fix: wait for all subprocesses to terminate (fixes issue #1476)
• b58cf7d chore: Merge branch 'master'
• 95a4c09 docs: add to faq
• 3a2eaf7 choe: merge master
• 3d90879 chore: add logo to site
• 7d6c1a8 fix: Replace `jade` references by `pug`
• 74c8749 chore: test funding.yml change
• c1a8b75 chore: update funding
• d5b9891 test: ensure ignore relative paths
• eead311 fix: to avoid confusion like in #1528, always report used extension
• 12b66cd fix: langauge around "watching" (#1591)
• 2e6e2c4 docs: README Grammar (#1601)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Cross-site Request Forgery (CSRF)
🦉 Arbitrary Code Injection
🦉 More lessons are available in Snyk Learn