[Snyk] Fix for 13 vulnerabilities

[sanyamason]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • server/package.json
  • server/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-ASYNC-2441827	Yes	Proof of Concept
	526/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.1	Arbitrary Code Injection SNYK-JS-EJS-1049328	No	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-EJS-2803307	No	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	No	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Directory Traversal SNYK-JS-MOMENT-2440688	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	No	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Remote Code Execution (RCE) SNYK-JS-SHARP-2848109	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090599	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090600	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090601	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090602	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:validator:20180218	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: sails

The new version differs by 39 commits.

• bdd7a1c 1.5.3
• 6f875c0 upgrade ejs to 3.1.7 (#7243)
• e4184a5 Add heading about the __Host- prefix (#7245)
• d666ada bump async to 2.6.4 (#7244)
• 555f51f upgrade minimist to v1.2.6 (#7242)
• 21b874b Documentation: add .populate() note
• c408c31 Update Travis CI config: node -> 16 (#7226)
• fc8d79b Merge pull request #7219 from pbkompasz/patch-1
• dfa9351 Remove sailsjs.com repo link from Sails readme
• 8ce1682 Update Permissions.md
• 1869f47 add notes about file uploads
• 7c5379a closes https://github.com/Prototype pollution in LoadActionModules() CVE-2021-44908 balderdashy/sails#7209
• 06ce9cf 1.5.2
• c5e98c2 Merge pull request #7203 from balderdashy/upgrade-sort-route-addresses-dependency
• ccd6d57 [email protected]
• e46c83b 1.5.1
• 023319e Update version of prompt to 1.2.1 (#7202)
• ed349a1 Add note about supported versions of Postgres
• 15b43ff Merge pull request #7181 from balderdashy/update-upgrading-to-1.0-docs
• 39e34cd Update To1.0.md
• 9c821ec Add note about undefined attributes
• 799f2c0 Update README.md
• 2533f67 Fix broken link in docs
• ead0403 1.5.0

See the full diff

Package name: sails-hook-orm

The new version differs by 9 commits.

• ce23c5e 4.0.2
• 1804d93 Merge pull request [Snyk] Security upgrade sails-hook-orm from 3.0.2 to 4.0.0 #27 from balderdashy/update-async
• 13e894e Update node versions in travis.yml
• 3e252b2 Update package.json
• 9cc202d 4.0.1
• ab0734f Bump up version of prompt to 1.2.1 ([Snyk] Fix for 12 vulnerabilities #26)
• 3a6dc7e 4.0.0
• 51aef86 Merge pull request [Snyk] Fix for 12 vulnerabilities #25 from balderdashy/upgrade-waterline-dependency
• 962fbeb waterline 0.14.0 -> 0.15.0

See the full diff

Package name: sails-hook-sockets

The new version differs by 6 commits.

• 27dc9c1 2.0.3
• 1eb301a Update package.json ([Snyk] Security upgrade sails from 1.4.4 to 1.5.7 #48)
• 042cf05 2.0.2
• e90e39e Upgrade socket.io depdenency ([Snyk] Security upgrade sails-hook-sockets from 2.0.1 to 2.0.4 #47)
• 928e865 Upgrading to socket.io v2.4.1 ([Snyk] Fix for 1 vulnerabilities #44)
• 9d65f62 Upgrading to socket.io v2.4.1 to fix vulnerability ([Snyk] Security upgrade react-scripts from 4.0.3 to 5.0.0 #43)

See the full diff

Package name: sharp

The new version differs by 197 commits.

• db654de Release v0.30.5
• a6aeef6 Install: pass `PKG_CONFIG_PATH` via env rather than substitution
• 7bf6cbd Docs: correct links to libvips documentation
• 04c31b3 Install: warn about filesystem owner running npm v8+ as root
• ee9cdb6 Bump deps
• 8960eb8 Docs: changelog entry for #3218
• 54d9dc4 Fix rotate-then-extract for EXIF orientation 2 (#3218)
• 51b4a7c Add support for --libc flag to improve cross-platform install (#3160)
• 5b03579 Docs: more details about concurrency, parallelism, threads
• 58c2af3 Docs: improve output format info for toBuffer
• ee948ac Docs: changelog and credit for #3196
• 66a3ce5 Allow installation of prebuilt libvips binary from filesystem (#3196)
• 75e5afc Docs: fix typo in gif example (#3201)
• d396a4e Release v0.30.4
• ae1dbcd Bump deps
• 4c29368 Docs: EXIF metadata unsupported for TIFF output #3074
• 36e5596 Docs: mention npm's foreground-scripts option to aid debugging
• 985e881 Bump deps
• 0b11671 Docs: changelog for #3178
• 9deac83 Add missing file name to 'Input file is missing' error message (#3178)
• 5d36f5f Improve error message for SVG render above limit #3167
• 926572b Control sensitivity to invalid images via failOn
• d0c8e95 Docs: expand info about use with worker threads
• b0ca23c Docs: changelog and credit for #3146

See the full diff

Package name: validator

The new version differs by 69 commits.

• 47ee5ad 13.7.0
• 496fc8b fix(rtrim): remove regex to prevent ReDOS attack (#1738)
• 45901ec Merge pull request #1851 from validatorjs/chore/fix-merge-conflicts
• 83cb7f8 chore: merge conflict clean-up
• f17e220 feat(isMobilePhone): add El Salvador es-SV locale
• 5b06703 feat(isMobilePhone): add Palestine ar-PS locale
• a3faa83 feat(isMobilePhone): add Botswana en-BW locale
• 26605f9 feat(isMobilePhone): add Turkmenistan tk-TM
• 0e5d5d4 feat(isMobilePhone): add Guyana en-GY locale
• f7ff349 feat(isMobilePhone): add Frech Polynesia fr-PF locale
• 8627e48 feat(isMobilePhone): add Kiribati en-KI locale
• ed60123 feat(isMobilePhone): add Tajikistan tg-TJ locale (#1846)
• c96d805 feat(isMobilePhone): add Maldives dv-MV locale
• 5c2d69e feat(isMobilePhone): regex for Burkina Faso fr-BF and Namibia en-NA locales
• fc0fefc feat(isMobilePhone): add Bhutan dz-BT locale (#1770)
• 01d3da3 feat(isMobilePhone): add Tajikistan tg-TJ locale (#1846)
• af2b43c feat(isUUID): add support for validation of version v1 and v2 (#1848)
• 769f6d5 feat(contains): add possibility to check that string contains seed multiple times (#1836)
• f2381e0 feat: (isMobilePhone): add Cameroon fr-CM locale (#1772)
• 5773869 feat(isVAT): add dutch NL locale (#1825)
• de1cb29 fix: Russian passport number regex (#1810)
• 7bee611 add CDN use option with unpkg (#1844)
• 57cc14e feat(isIdentityCard): add finnish locale (#1838)
• 2201869 feat: added finnish locale to isAlpha and isAlphanumeric (#1837)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 More lessons are available in Snyk Learn