[Snyk] Fix for 43 vulnerabilities

[baby636]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • deps/npm/docs/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIHTML-1296849	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	616/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.9	Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-1579269	Yes	Proof of Concept
	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Information Exposure SNYK-JS-FOLLOWREDIRECTS-2332181	Yes	Proof of Concept
	344/1000 Why? Has a fix available, CVSS 2.6	Information Exposure SNYK-JS-FOLLOWREDIRECTS-2396346	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	504/1000 Why? Has a fix available, CVSS 5.8	Prototype Pollution SNYK-JS-HIGHLIGHTJS-1045326	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	Yes	Proof of Concept
	641/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.4	Prototype Pollution SNYK-JS-JSON5-3182856	Yes	Proof of Concept
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	No	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3042992	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-LOADERUTILS-3043105	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3105943	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Yes	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASHES-2434283	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASHES-2434284	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASHES-2434285	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASHES-2434289	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	Yes	No Known Exploit
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-OBJECTPATH-1017036	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-OBJECTPATH-1569453	Yes	Proof of Concept
	590/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-OBJECTPATH-1585658	Yes	No Known Exploit
	591/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.4	Cross-site Scripting (XSS) SNYK-JS-PARSEURL-2935944	Yes	Proof of Concept
	561/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.8	Information Exposure SNYK-JS-PARSEURL-2935947	Yes	Proof of Concept
	791/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.4	Server-side Request Forgery (SSRF) SNYK-JS-PARSEURL-2936249	Yes	Proof of Concept
	591/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.4	Cross-site Scripting (XSS) SNYK-JS-PARSEURL-2942134	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	Yes	Proof of Concept
	811/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.8	Prototype Pollution SNYK-JS-PROPERTYEXPR-598800	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-TRIM-1017038	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-Y18N-1021887	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YUP-2420835	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gatsby

The new version differs by 250 commits.

• 8d07242 chore(release): Publish
• 0790895 chore(gatsby): Update README (events: set target property to null nodejs/node#33615)
• 06760d7 chore(gatsby): Change comment format in actions/public (src: don't use semicolon outside function nodejs/node#33592)
• 7d66a23 feat(gatsby): capture number of ssg,dsg,ssr pages in telemetry ([v12.x] deps: update to ICU 67.1 nodejs/node#33337)
• 98a843c fix(gatsby): use lmdb.removeSync so getNode can't return deleted nodes (src: use MaybeLocal.ToLocal instead of IsEmpty nodejs/node#33554)
• 4d8e40b fix(gatsby-source-wordpress): Add steps for `refetch_ALL` (#33264)
• 4761dc3 fix(gatsby): restore onPreBuild to being called right after bootstrap finishes (async-resource-vs-destroy benchmark is broken locally nodejs/node#33591)
• 1cdbab6 fix(deps): update starters and examples gatsby packages to ^3.14.3 ([v12.x] deps: V8: cherry-pick 548f6c81d424 nodejs/node#33553)
• 0f421db chore(release): Publish next
• 7d6a0aa fix(gatsby): fix page-tree in ink-cli (deps: update V8 to 8.4 nodejs/node#33579)
• 3993819 chore(gatsby): Add `assetPrefix` to `IGatsbyConfig` (async_hooks: improve resource stack performance nodejs/node#33575)
• 6cc964a fix(gatsby-source-wordpress): restore PQR support (support util.promisify for fs.readv nodejs/node#33590)
• 9eef270 specifying what actually changed (v14.3.0 proposal nodejs/node#33452)
• 2975c4d feat(gatsby,gatsby-link): add queue to prefetch (doc: outline when origin is set to unhandledRejection nodejs/node#33530)
• 68fe836 fix(gatsby): temporary workaround for stale jobs cache (Use stream._construct nodejs/node#33586)
• a800d9d fix(gatsby): Update internal usage of .runQuery (New label suggestion: awaiting release nodejs/node#33571)
• 677760c chore(docs): Clarify SEO component guide (src: add default: case to silence compiler warning nodejs/node#33451)
• ccca4b3 fix(gatsby): only remove unused code when apis got removed (lib: initial experimental AbortController implementation nodejs/node#33527)
• 8dbf550 fix(gatsby): assign correct parentSpans to PQR activities (support nested headers in http2 nodejs/node#33568)
• 31d5a5e fix(gatsby-dev-cli): resolve correct versions of packages with unpkg (http: simplify Agent initialization nodejs/node#33551)
• 5110074 fix(gatsby-plugin-gatsby-cloud): emit file nodes after source updates (doc: fix misc. mislabeled code block info strings nodejs/node#33548)
• d2329df fix(gatsby): make sure 404 and 500 page inherit stateful status from original page (wasi: allow WASI stdio to be configured nodejs/node#33544)
• 68e5b90 chore(docs): Update query var in part-7 tutorial (feature-request fs.fileWrite with option.mkdirp nodejs/node#33559)
• a8cab55 chore(gatsby-plugin-react-helmet): Update Examples (src: use NewFromUtf8Literal in GetLinkedBinding nodejs/node#33552)

See the full diff

Package name: gatsby-plugin-sharp

The new version differs by 250 commits.

• c1e67a2 chore(release): Publish
• 0c45654 chore: remove tracedSVG (CONTRIBUTING.md nodejs/node#37093) (just some practice nodejs/node#37137)
• d7edf95 chore(release): Publish
• 2d00ea0 fix(gatsby-plugin-mdx): Do not leak frontmatter into page (ESM importing a CommonJS calls getters nodejs/node#35859) (fix comment nodejs/node#35913)
• 4997d63 chore(release): Publish
• ff94ed5 fix(gatsby-plugin-mdx): don't allow JS frontmatter by default (zlib: test BrotliCompress throws invalid arg value nodejs/node#35830) (#35834)
• 36f21b0 chore: Removate validate-renovate from v3-latest branch (src: guard against nullptr deref in TimerWrapHandle::Stop nodejs/node#34460)
• 1acb1bc chore(release): Publish
• 1589bd8 fix(gatsby): ensure that writing node manifests to disk does not break on Windows (Why the http client does not support the keep alive feature? nodejs/node#33853) (tls: add getter and setter for session ticket number. nodejs/node#34020)
• 9694010 fix(gatsby-source-drupal): Ensure all new nodes are created before creating relationships (Rename default branch from "master" to "main" nodejs/node#33864) (quic: fix lint error in node_quic_crypto nodejs/node#34019)
• 76deb39 fix(gatsby-source-drupal): searcParams missing from urls (Value display error nodejs/node#33861) (fix drain() function for "Piping to writable streams from async iterators" nodejs/node#34018)
• f74cc8f feat(gatsby-source-drupal): Add node manifest support for previews (src: remove unnecessary ToLocalChecked call nodejs/node#33683) (timers: allow timers to be used as primitives nodejs/node#34017)
• 476a591 chore(release): Publish
• 35b48f8 fix(gatsby-plugin-image): GatsbyImage not displaying image in IE11 (module: CJS exports detection for modules with __esModule export nodejs/node#33416) (VM aborts when error thrown when in property setter nodejs/node#33806)
• 880022e fix(gatsby-plugin-image): flickering when state changes (lib/internal/util.js#join function is slower than the built-in Array#join nodejs/node#33732) (v8: implement v8.takeCoverage() and v8.stopCoverage() nodejs/node#33807)
• c0d07e7 feat(gatsby-source-wordpress): Update supported-remote-plugin-versions.ts (async_hooks: callback trampoline for MakeCallback nodejs/node#33801) (n-api: document nextTick timing in callbacks nodejs/node#33804)
• 3d9a702 chore(release): Publish
• 84053a2 fix(gatsby-plugin-sharp): pass input buffer instead of readStream when processing image jobs (build: fix node.gyp config nodejs/node#33685) (node --jitless segfault on mipsel or mips64el nodejs/node#33703)
• 4722a0d fix(gatsby-source-drupal): Add timeout in case of stalled API requests (invalid syntax for loop in python  nodejs/node#33668) (doc: UNABLE_TO_VERIFY_LEAF_SIGNATURE/unable to verify the first certificate error not documented nodejs/node#33705)
• 857a628 fix(gatsby): single page node manifest accuracy (benchmark: fix async-resource benchmark nodejs/node#33642) (Unexpected performance penalty when using field initialiser nodejs/node#33698)
• 6bfd0f1 Properly set the pathPrefix and assetPrefix in the pluginData (doc:  nodejs/node#33667) (deps: V8: re-enable interpreted frames native stack on S390 nodejs/node#33702)
• 26c51c0 fix(gatsby-source-drupal): cache backlink records (src: use enum for refed flag on native immediates nodejs/node#33444) (#33701)
• b80c53a fix(gatsby-source-drupal): Correctly update nodes with changed back references so queries are re-run (src: forbid lt and gt in url host code point nodejs/node#33328) (Why does HTTP1 module lack support for certain request methods? nodejs/node#33699)
• e29a194 chore: use gatsby-dev-cli@latest-v3 in tests

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Server-Side Request Forgery (SSRF)
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn