[Snyk(Unlimited)] Upgrade adm-zip from 0.4.7 to 0.4.14

[snyk-bot]

Snyk has created this PR to upgrade adm-zip from 0.4.7 to 0.4.14.

✨What is Merge Advice?

We check thousands of dependency upgrade pull requests and CI tests every day to see which upgrades were successfully merged. After crunching this data, we give a recommendation on how safe we think the change is for you to merge without causing issues. Learn more, and share your feedback to help improve this feature. 🙏

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 6 versions ahead of your current version.
• The recommended version was released 3 months ago, on 2020-02-06.

The recommended version fixes:

Severity	Issue	Exploit Maturity
	GPL-2.0 license snyk:lic:npm:goof:GPL-2.0	No Data
	Arbitrary File Write via Archive Extraction (Zip Slip) npm:adm-zip:20180415	Mature
	MPL-2.0 license snyk:lic:npm:symbol:MPL-2.0	No Data
	Arbitrary Code Injection SNYK-JS-MORGAN-72579	Proof of Concept

Release notes

Package name: adm-zip

• 0.4.14 - 2020-02-06
• 0.4.13 - 2018-11-13
• 0.4.11 - 2018-05-12
• 0.4.10 - 2018-05-12
• 0.4.9 - 2018-04-25
• 0.4.8 - 2018-04-23
• 0.4.7 - 2015-02-09

from adm-zip GitHub release notes

Commit messages

Package name: adm-zip

• 81d09ca Merge pull request [Snyk-local(Unlimited)] Upgrade color-convert from 1.9.2 to 1.9.3 #266 from Dewep/master
• f66dc60 Merge pull request [Snyk-local(Unlimited)] Upgrade from thebespokepixel/meta to thebespokepixel/meta #263 from leonaves/jsdoc/fix-typings
• 4cc87b9 Merge pull request [Snyk-local(Unlimited)] Upgrade sgr-composer from 0.5.0 to 0.5.3 #270 from nleclerc/fixEmptyEntryError
• 8176b02 Merge pull request [Snyk(Unlimited)] Upgrade from thebespokepixel/string to thebespokepixel/string #301 from RocketChat/zip64
• 0a4e8ca Iterate over entries without storing their metadata
• d7a748c Add partial support for zip64 (larger number of entries)
• ff17ae8 Merge pull request [Snyk-local(Unlimited)] Upgrade lodash from 4.17.10 to 4.17.11 #267 from teppeis/fix-crc
• 237bb7f fix accent filename
• e64e32c Removed improperly raised error while decompressing empty file asynchronously.
• ed5fd83 fix: CRC is unexpectedly changed after zip is re-created
• 20c9cb8 Add async version of addLocalFile
• aafa8f8 Fix jsdoc typings for functions.
• cb300c9 Merge pull request [Snyk-local(Unlimited)] Upgrade term-ng from 0.8.1 to 0.8.5 #260 from devsnd/master
• da9a6a1 fixed Utils.FileSystem overwriting 'fs' module even when 'original-fs' is broken
• 044a235 fix race-condition crash when extracting data and extracted files are (re)moved
• c309c92 Merge pull request [Snyk(Unlimited)] Upgrade node-uuid from 1.4.0 to 1.4.8 #239 from keyesdav/bug-234-fix
• 6306ee9 Merge branch 'master' into bug-234-fix
• 83d44ba Merge pull request [Snyk(Unlimited)] Upgrade color-convert from 1.9.2 to 1.9.3 #232 from kevincharm/feature/handle-callback-err
• 74bdec6 Merge pull request [Snyk(Unlimited)] Upgrade from thebespokepixel/string to thebespokepixel/string #240 from realtebo/master
• 5e4c8ad Merge pull request [Snyk-local] Fix for 4 vulnerable dependencies #258 from Congelli501/patch-1
• aec5998 Merge pull request [Snyk(Unlimited)] Upgrade node-uuid from 1.4.0 to 1.4.8 #251 from warbaby/utf8_name
• 92023f7 Merge pull request [Snyk(Unlimited)] Upgrade node-uuid from 1.4.0 to 1.4.8 #254 from honzajavorek/patch-1
• a097034 Merge pull request [Snyk(Unlimited)] Upgrade color-convert from 1.9.2 to 1.9.3 #217 from rafaelc0sta/master
• c31dcd4 Merge pull request [Snyk(Unlimited)] Upgrade qs from 0.0.6 to 0.6.6 #238 from apexearth/master

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs