[Snyk] Fix for 20 vulnerabilities

[gvilarino]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------  | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-ANSIREGEX-1583908](https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908) | Yes | Proof of Concept  | **679/1000**
**Why?** Has a fix available, CVSS 9.3 | Incomplete List of Disallowed Inputs
[SNYK-JS-BABELTRAVERSE-5962463](https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962463) | Yes | No Known Exploit  | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-GLOBPARENT-1016905](https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905) | Yes | Proof of Concept  | **641/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 6.4 | Prototype Pollution
[SNYK-JS-JSON5-3182856](https://snyk.io/vuln/SNYK-JS-JSON5-3182856) | Yes | Proof of Concept  | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-LODASH-1018905](https://snyk.io/vuln/SNYK-JS-LODASH-1018905) | Yes | Proof of Concept  | **681/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.2 | Command Injection
[SNYK-JS-LODASH-1040724](https://snyk.io/vuln/SNYK-JS-LODASH-1040724) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-LODASH-450202](https://snyk.io/vuln/SNYK-JS-LODASH-450202) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-LODASH-608086](https://snyk.io/vuln/SNYK-JS-LODASH-608086) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-LODASH-73638](https://snyk.io/vuln/SNYK-JS-LODASH-73638) | Yes | Proof of Concept  | **541/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 4.4 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-LODASH-73639](https://snyk.io/vuln/SNYK-JS-LODASH-73639) | Yes | Proof of Concept  | **681/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.2 | Command Injection
[SNYK-JS-LODASHTEMPLATE-1088054](https://snyk.io/vuln/SNYK-JS-LODASHTEMPLATE-1088054) | Yes | Proof of Concept  | **589/1000**
**Why?** Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-MINIMATCH-1019388](https://snyk.io/vuln/SNYK-JS-MINIMATCH-1019388) | Yes | No Known Exploit  | **479/1000**
**Why?** Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-MINIMATCH-3050818](https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818) | Yes | No Known Exploit  | **479/1000**
**Why?** Has a fix available, CVSS 5.3 | Improper Input Validation
[SNYK-JS-POSTCSS-5926692](https://snyk.io/vuln/SNYK-JS-POSTCSS-5926692) | Yes | No Known Exploit  | **646/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 6.5 | Server-side Request Forgery (SSRF)
[SNYK-JS-REQUEST-3361831](https://snyk.io/vuln/SNYK-JS-REQUEST-3361831) | Yes | Proof of Concept  | **646/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 6.5 | Prototype Pollution
[SNYK-JS-TOUGHCOOKIE-5672873](https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873) | Yes | Proof of Concept  | **589/1000**
**Why?** Has a fix available, CVSS 7.5 | Prototype Pollution
[SNYK-JS-UNSETVALUE-2400660](https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660) | Yes | No Known Exploit  | **506/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 3.7 | Regular Expression Denial of Service (ReDoS)
[npm:braces:20180219](https://snyk.io/vuln/npm:braces:20180219) | Yes | Proof of Concept  | **479/1000**
**Why?** Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[npm:content-type-parser:20170905](https://snyk.io/vuln/npm:content-type-parser:20170905) | Yes | No Known Exploit  | **636/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 6.3 | Prototype Pollution
[npm:lodash:20180130](https://snyk.io/vuln/npm:lodash:20180130) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: babelify

The new version differs by 6 commits.

• b06b778 8.0.0
• ea73917 Remove path-is-absolute devDep
• 02f97ec drop node 0.10/0.12, add peerDep on babel-core instead of dep, drop object-assign, add package-lock
• 6d45fa8 Explicitly test Node 4, 5 and 6 in travis
• 9944a55 Explain the double negatives a bit better (#197)
• d9e3029 babelify in quotes in example (#198)

See the full diff

Package name: gulp

The new version differs by 134 commits.

• 55eb23a Release: 4.0.0
• 173a532 Docs: Fix the installation instructions
• ec54d09 Docs: Improve note about out-of-date docs
• 03b7c98 Docs: Update recipes to install gulp@next
• 2eba29e Docs: Remove run-sequence from recipes
• 76eb4d6 Docs: Add installation instructions & update badges
• fbc162f Docs: Remove references to gulp-util
• 3011cf9 Scaffold: Normalize repository
• f27be05 Update: Remove graceful-fs from test suite
• 361ab63 Upgrade: Update glob-watcher
• 064d100 Build: Avoid broken node 9
• 057df59 Release: 4.0.0-alpha.3
• c1ba80c Breaking: Upgrade major versions of glob-watcher, gulp-cli & vinyl-fs
• 89acc5c Docs: Improve ES2015 task exporting examples (#1999)
• 0ac9e04 Docs: Add "Project structure" section to CONTRIBUTING.md (#1859)
• 723cbc4 Docs: Fix syntax in recipe example (#1715)
• d420a6a Docs: Have gulp.lastRun take a function to avoid task registration (#1828)
• 29ece6f Upgrade: Update undertaker
• e931cb0 Docs: Fix changelog typos (#1696)
• 477db84 Docs: Add a "BrowserSync with Gulp 4" recipe (#1659)
• d4ed3c7 Docs: Add options.cwd for gulp.src API (#1645)
• 5dc3b07 Docs: Update gulp.watch API to align with glob-watcher
• 0c66069 Breaking: Replace chokidar as gulp.watch with glob-watcher wrapper
• c3dbc10 Docs: Clarify incremental builds example (#1609)

See the full diff

Package name: gulp-add-src

The new version differs by 8 commits.

• c52a037 chore: release 1.0.0
• ae8496c Merge pull request #15 from konsultaner/master
• 1215372 make node 8 LTS compatible
• ab2cabd Merge pull request #12 from dslpp056193/patch-1
• 7899433 Update README.md
• 5837ec1 More understandable readme.md
• 8898a42 Merge pull request #6 from SimenB/package.json-files
• d68d978 Don't publish dotfiles or tests to npm registry

See the full diff

Package name: gulp-autoprefixer

The new version differs by 27 commits.

• ede5a11 8.0.0
• a953087 Require Node.js 12 and upgrade dependencies
• 87ff53d Move to GitHub Actions (#117)
• c5e7214 7.0.1
• da50fd2 Make Gulp an optional peer dependency
• 40fba84 7.0.0
• ab49120 Require Node.js 8 and Gulp 4
• 83cc576 Enable the repo sponsor button
• adec1a7 6.1.0
• 7b080bf Upgrade dependencies
• dfe3919 6.0.0
• c225cbd Upgrade `autoprefixer` and `postcss`
• ea0b7f8 Require Node.js 6
• 18a27be 5.0.0
• e526a78 Meta tweaks
• e954e6e Update sourcemap paths to be relative to `file.base` (#92)
• 7828646 Upgrade to Autoprefixer 8 (#96)
• d008588 4.1.0
• 27816c3 Meta tweaks
• 94f3447 Drop dependency on deprecated gulp-util (#94)
• 60aead3 Test against Node.js v8 (#90)
• 5188604 4.0.0
• 04814b7 Rewrite tests to use AVA
• 7df69ba ES2015ify, bump postcss, require Node.js 4

See the full diff

Package name: gulp-clean-css

The new version differs by 27 commits.

• e2bf4d2 dep updates, test cleanup
• 48e956f removed deprecated gulp-util (#50)
• 9f5c4ab readme syntax consistency
• 869e147 clean-css => 4.1.9
• e6c44e4 clean-css => 4.1.8
• 2f70027 bump clean-css 4-1-7
• 47425a2 link fix for badge
• a43222d :sunglasses:
• 4a4daa1 clean-css bump
• edd64a9 bump to clean-css 4.1.5
• 6db6e08 readme
• c93de53 dm, readme
• bc636fc build, node v8
• 8709c50 slight cleanup
• 414e7cb clean-css => 4.1.4, dep updates
• d6729f2 bump
• f389d8f ensure that URLs of inlined imports are recalculated relative to current file (#44)
• 5dc705c #43 ; dep updated (clean-css 4.1.3)
• eeee392 pass rebase option
• ba2ee13 #42
• 0efd1c3 bump 3.3.0
• 81d70a7 Merge remote-tracking branch 'origin/master'
• 92ddf63 rebasing, clean-css 4.1.2
• 38b8899 update dep, clean-css 4.1.1

See the full diff

Package name: gulp-concat-css

The new version differs by 3 commits.

• 8d11ad5 3.0.0
• e8f7ad3 Merge pull request #44 from TheDancingCode/pr/remove-gutil
• 2266a2c Drop dependency on deprecated `gulp-util`

See the full diff

Package name: gulp-stylint

The new version differs by 7 commits.

• 14cda81 4.0.2
• 9d23506 Merge pull request #35 from asghol/master
• 44110fd No longer using the deprecate package gulp-util, closes #34
• 8de7f79 4.0.1
• f5d41ca test only on latest node
• ad8b630 Merge pull request #33 from gucong3000/patch-1
• 9ca2233 use `Boolean` as filter for `warningsOrErrors`

See the full diff

Package name: gulp-stylus

The new version differs by 4 commits.

• d79824c 2.7.0
• f222454 Remove gulp-util
• 029e104 update licenses
• 7fb0e16 Fix Javascript syntax error on code snippet

See the full diff

Package name: jsdom

The new version differs by 250 commits.

• 74a8d1e Version 16.6.0
• f51f2ec Remove the dependency on request
• 2b6d5ae Update dependencies
• b72b33b Disable now-crashing canvas test
• 39b7972 Handle null and undefined thrown as exceptions
• 04f6c13 Add ParentNode.replaceChildren() (#3176)
• e4c4004 Version 16.5.3
• 2f41466 Fix MutationObserver infinite loop bugs (#3173)
• b232f2a Run partially-failing WPTs in the custom-elements directory
• 35e103e Run partially-failing WPTs in the cors directory
• 77b660a Run partially-failing WPTs in the FileAPI directory
• d8a245f Use `InnerHTML` mixin for `innerHTML` definition (#2981)
• bd50bbe Version 16.5.2
• d5cfd69 Fix event handler ObjectEnvironment instantiation
• 93e3d4a Remove vestigial concurrentNodeIterators option-passing
• c92f9c1 Check all associated elements for form validity
• 2202703 Fix failing WPTs calculation
• 21c7671 Upgrade dependencies
• c1b9ea1 Port skipped "test_body_event_handler_inline" to WPT
• a13d854 Use WeakRefs for NodeIterator tracking when supported
• fdf97d8 Fix radio/checkbox to not fire events when disconnected
• 761d8cc Refactor <output>
• b36d418 Make customElements.whenDefined() resolve with the constructor
• c5d13bb Remove a variety of redundant to-port tests

See the full diff

Package name: migrate-mongoose

The new version differs by 9 commits.

• 76f67e3 4.0.0
• d84336d feat: upgraded mongoose version to support new mongo connection types
• dcdc96d feat: remove babel support
• 3ee337c fix: don't throw an error if there are no migrations to run
• e3707d1 Merge pull request #27 from shvetsovdm/master
• 0788f57 Fix typo in the lib run method
• a89d8df Fix `migrate down` without a migration name
• 47e5919 Merge pull request #22 from miangraham/master
• b9098ef Fix reversed args to migrator.run() in programmatic usage README

See the full diff

Package name: watchify

The new version differs by 30 commits.

• 7b27a3c 4.0.0
• 5d4842a bump deps (#380)
• b840f29 disable package-lock.json
• bae5e02 update chokidar and anymatch (#378)
• 3445775 ci: use github actions (#379)
• f79e59f Change URLs from "Substack" (someones personal site & acc) to "browserify" (#369)
• bd2f677 ci: run on more node versions
• 563a90d Merge pull request #367 from Trott/update-readme-badge
• bb2b429 chore: Fix Travis-CI badge in readme.markdown
• c3fe218 3.11.1
• e90101b Merge pull request #362 from digipost/upgrade-deps
• d163b4f upgrade dependencies: fix errors from npm audit
• 1917270 Merge pull request #351 from menzow/feature/update-docs
• d232754 Merge pull request #357 from Kamil93/patch-1
• d924e9b Update readme.markdown
• 9ea8a65 Support for working with transforms
• 11989b2 3.11.0
• 82669ad Merge pull request #355 from browserify/browserify-16
• 495b6f2 Update to browserify@16
• 2bc76db Merge pull request #353 from BridgeAR/master
• b2a2ab1 test: add callbacks
• 5f7f27b 3.10.0
• 6de686b browserify@15
• 8147bc5 Add troubleshooting information for silenced errors

See the full diff

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded. Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/gvilarino/project/a23fa7ec-cd0c-4abf-8f18-91a91cae9379?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/gvilarino/project/a23fa7ec-cd0c-4abf-8f18-91a91cae9379?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"06d297e2-8ff5-4ced-bbec-7b9e625d7d68","prPublicId":"06d297e2-8ff5-4ced-bbec-7b9e625d7d68","dependencies":[{"name":"babelify","from":"7.3.0","to":"8.0.0"},{"name":"gulp","from":"3.9.1","to":"4.0.0"},{"name":"gulp-add-src","from":"0.2.0","to":"1.0.0"},{"name":"gulp-autoprefixer","from":"3.1.1","to":"8.0.0"},{"name":"gulp-clean-css","from":"3.0.4","to":"3.9.1"},{"name":"gulp-concat-css","from":"2.3.0","to":"3.0.0"},{"name":"gulp-stylint","from":"4.0.0","to":"4.0.2"},{"name":"gulp-stylus","from":"2.6.0","to":"2.7.0"},{"name":"jsdom","from":"9.12.0","to":"16.6.0"},{"name":"migrate-mongoose","from":"3.2.2","to":"4.0.0"},{"name":"watchify","from":"3.9.0","to":"4.0.0"}],"packageManager":"npm","projectPublicId":"a23fa7ec-cd0c-4abf-8f18-91a91cae9379","projectUrl":"https://app.snyk.io/org/gvilarino/project/a23fa7ec-cd0c-4abf-8f18-91a91cae9379?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-ANSIREGEX-1583908","SNYK-JS-BABELTRAVERSE-5962463","SNYK-JS-GLOBPARENT-1016905","SNYK-JS-JSON5-3182856","SNYK-JS-LODASH-1018905","SNYK-JS-LODASH-1040724","SNYK-JS-LODASH-450202","SNYK-JS-LODASH-608086","SNYK-JS-LODASH-73638","SNYK-JS-LODASH-73639","npm:lodash:20180130","SNYK-JS-LODASHTEMPLATE-1088054","SNYK-JS-MINIMATCH-1019388","SNYK-JS-MINIMATCH-3050818","SNYK-JS-POSTCSS-5926692","SNYK-JS-REQUEST-3361831","SNYK-JS-TOUGHCOOKIE-5672873","SNYK-JS-UNSETVALUE-2400660","npm:braces:20180219","npm:content-type-parser:20170905","npm:minimatch:20160620"],"upgrade":["SNYK-JS-ANSIREGEX-1583908","SNYK-JS-BABELTRAVERSE-5962463","SNYK-JS-GLOBPARENT-1016905","SNYK-JS-JSON5-3182856","SNYK-JS-LODASH-1018905","SNYK-JS-LODASH-1040724","SNYK-JS-LODASH-450202","SNYK-JS-LODASH-608086","SNYK-JS-LODASH-73638","SNYK-JS-LODASH-73639","SNYK-JS-LODASHTEMPLATE-1088054","SNYK-JS-MINIMATCH-1019388","SNYK-JS-MINIMATCH-3050818","SNYK-JS-POSTCSS-5926692","SNYK-JS-REQUEST-3361831","SNYK-JS-TOUGHCOOKIE-5672873","SNYK-JS-UNSETVALUE-2400660","npm:braces:20180219","npm:content-type-parser:20170905","npm:lodash:20180130"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[696,679,586,641,586,681,686,686,686,541,636,681,589,479,479,646,646,589,506,479,589],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Regular Expression Denial of Service (ReDoS)](https://learn.snyk.io/lesson/redos/?loc=fix-pr) 🦉 [Prototype Pollution](https://learn.snyk.io/lesson/prototype-pollution/?loc=fix-pr) 🦉 [Improper Input Validation](https://learn.snyk.io/lesson/improper-input-validation/?loc=fix-pr) 🦉 [More lessons are available in Snyk Learn](https://learn.snyk.io/?loc=fix-pr)