9320b8e only escape arguments, not the command name
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project.
------------
**Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.*
For more information:
🧐 [View latest project report](https://app.snyk.io/org/ayishagisel/project/2d0e6801-a727-4748-acbf-2e75d2b7bc1f?utm_source=github&utm_medium=referral&page=fix-pr)
🛠 [Adjust project settings](https://app.snyk.io/org/ayishagisel/project/2d0e6801-a727-4748-acbf-2e75d2b7bc1f?utm_source=github&utm_medium=referral&page=fix-pr/settings)
📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities)
[//]: # (snyk:metadata:{"prId":"4d2f182a-ad6d-4c69-bcd7-af1145f82d42","prPublicId":"4d2f182a-ad6d-4c69-bcd7-af1145f82d42","dependencies":[{"name":"browser-sync","from":"2.24.6","to":"2.26.9"},{"name":"chokidar","from":"2.0.4","to":"3.0.0"},{"name":"localtunnel","from":"1.9.0","to":"2.0.1"},{"name":"npm","from":"6.2.0","to":"7.0.0"}],"packageManager":"npm","projectPublicId":"2d0e6801-a727-4748-acbf-2e75d2b7bc1f","projectUrl":"https://app.snyk.io/org/ayishagisel/project/2d0e6801-a727-4748-acbf-2e75d2b7bc1f?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-AJV-584908","SNYK-JS-ANSIREGEX-1583908","SNYK-JS-BINLINKS-537608","SNYK-JS-BINLINKS-537609","SNYK-JS-BINLINKS-537610","SNYK-JS-FOLLOWREDIRECTS-2332181","SNYK-JS-FOLLOWREDIRECTS-2396346","SNYK-JS-FSTREAM-174725","SNYK-JS-HAWK-2808852","SNYK-JS-HOSTEDGITINFO-1088355","SNYK-JS-HTTPSPROXYAGENT-469131","SNYK-JS-INFLIGHT-6095116","SNYK-JS-INI-1048974","SNYK-JS-JSONSCHEMA-1920922","SNYK-JS-KINDOF-537849","SNYK-JS-MINIMATCH-3050818","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-559764","SNYK-JS-MIXINDEEP-450212","SNYK-JS-QS-3153490","SNYK-JS-SEMVER-3247795","SNYK-JS-SETVALUE-1540541","SNYK-JS-SETVALUE-450213","SNYK-JS-SSRI-1246392","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1536758","SNYK-JS-TAR-1579147","SNYK-JS-TAR-1579152","SNYK-JS-TAR-1579155","SNYK-JS-TAR-174125","SNYK-JS-Y18N-1021887","npm:chownr:20180731","npm:extend:20180424","npm:hoek:20180212"],"upgrade":["SNYK-JS-AJV-584908","SNYK-JS-ANSIREGEX-1583908","SNYK-JS-BINLINKS-537608","SNYK-JS-BINLINKS-537609","SNYK-JS-BINLINKS-537610","SNYK-JS-FOLLOWREDIRECTS-2332181","SNYK-JS-FOLLOWREDIRECTS-2396346","SNYK-JS-FSTREAM-174725","SNYK-JS-HAWK-2808852","SNYK-JS-HOSTEDGITINFO-1088355","SNYK-JS-HTTPSPROXYAGENT-469131","SNYK-JS-INFLIGHT-6095116","SNYK-JS-INI-1048974","SNYK-JS-JSONSCHEMA-1920922","SNYK-JS-KINDOF-537849","SNYK-JS-MINIMATCH-3050818","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-559764","SNYK-JS-MIXINDEEP-450212","SNYK-JS-QS-3153490","SNYK-JS-SEMVER-3247795","SNYK-JS-SETVALUE-1540541","SNYK-JS-SETVALUE-450213","SNYK-JS-SSRI-1246392","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1536758","SNYK-JS-TAR-1579147","SNYK-JS-TAR-1579152","SNYK-JS-TAR-1579155","SNYK-JS-TAR-174125","SNYK-JS-Y18N-1021887","npm:chownr:20180731","npm:extend:20180424","npm:hoek:20180212"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[619,696,726,451,726,586,344,579,584,586,626,703,686,644,506,479,506,601,686,696,696,686,686,696,624,624,410,639,639,639,726,686,434,579,636],"remediationStrategy":"vuln"})
---
**Learn how to fix vulnerabilities with free interactive lessons:**
🦉 [Prototype Pollution](https://learn.snyk.io/lesson/prototype-pollution/?loc=fix-pr)
🦉 [Regular Expression Denial of Service (ReDoS)](https://learn.snyk.io/lesson/redos/?loc=fix-pr)
🦉 [Arbitrary File Overwrite](https://learn.snyk.io/lesson/directory-traversal/?loc=fix-pr)
🦉 [More lessons are available in Snyk Learn](https://learn.snyk.io/?loc=fix-pr)
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------  | **619/1000****Why?** Has a fix available, CVSS 8.1 | Prototype Pollution
[SNYK-JS-AJV-584908](https://snyk.io/vuln/SNYK-JS-AJV-584908) | Yes | No Known Exploit  | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-ANSIREGEX-1583908](https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908) | Yes | Proof of Concept  | **726/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 8.1 | Arbitrary File Overwrite
[SNYK-JS-BINLINKS-537608](https://snyk.io/vuln/SNYK-JS-BINLINKS-537608) | Yes | Proof of Concept  | **451/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 2.6 | Unauthorized File Access
[SNYK-JS-BINLINKS-537609](https://snyk.io/vuln/SNYK-JS-BINLINKS-537609) | Yes | Proof of Concept  | **726/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 8.1 | Arbitrary File Write
[SNYK-JS-BINLINKS-537610](https://snyk.io/vuln/SNYK-JS-BINLINKS-537610) | Yes | Proof of Concept  | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Information Exposure
[SNYK-JS-FOLLOWREDIRECTS-2332181](https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2332181) | Yes | Proof of Concept  | **344/1000**
**Why?** Has a fix available, CVSS 2.6 | Information Exposure
[SNYK-JS-FOLLOWREDIRECTS-2396346](https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2396346) | Yes | No Known Exploit  | **579/1000**
**Why?** Has a fix available, CVSS 7.3 | Arbitrary File Overwrite
[SNYK-JS-FSTREAM-174725](https://snyk.io/vuln/SNYK-JS-FSTREAM-174725) | Yes | No Known Exploit  | **584/1000**
**Why?** Has a fix available, CVSS 7.4 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-HAWK-2808852](https://snyk.io/vuln/SNYK-JS-HAWK-2808852) | Yes | No Known Exploit  | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-HOSTEDGITINFO-1088355](https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355) | Yes | Proof of Concept  | **626/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 6.1 | Man-in-the-Middle (MitM)
[SNYK-JS-HTTPSPROXYAGENT-469131](https://snyk.io/vuln/SNYK-JS-HTTPSPROXYAGENT-469131) | Yes | Proof of Concept  | **703/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.2 | Missing Release of Resource after Effective Lifetime
[SNYK-JS-INFLIGHT-6095116](https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-INI-1048974](https://snyk.io/vuln/SNYK-JS-INI-1048974) | Yes | Proof of Concept  | **644/1000**
**Why?** Has a fix available, CVSS 8.6 | Prototype Pollution
[SNYK-JS-JSONSCHEMA-1920922](https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922) | Yes | No Known Exploit  | **506/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 3.7 | Validation Bypass
[SNYK-JS-KINDOF-537849](https://snyk.io/vuln/SNYK-JS-KINDOF-537849) | Yes | Proof of Concept  | **479/1000**
**Why?** Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-MINIMATCH-3050818](https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818) | Yes | No Known Exploit  | **506/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 3.7 | Prototype Pollution
[SNYK-JS-MINIMIST-2429795](https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795) | Yes | Proof of Concept  | **601/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.6 | Prototype Pollution
[SNYK-JS-MINIMIST-559764](https://snyk.io/vuln/SNYK-JS-MINIMIST-559764) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-MIXINDEEP-450212](https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212) | Yes | Proof of Concept  | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Prototype Poisoning
[SNYK-JS-QS-3153490](https://snyk.io/vuln/SNYK-JS-QS-3153490) | Yes | Proof of Concept  | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-SEMVER-3247795](https://snyk.io/vuln/SNYK-JS-SEMVER-3247795) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-SETVALUE-1540541](https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-SETVALUE-450213](https://snyk.io/vuln/SNYK-JS-SETVALUE-450213) | Yes | Proof of Concept  | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-SSRI-1246392](https://snyk.io/vuln/SNYK-JS-SSRI-1246392) | Yes | Proof of Concept  | **624/1000**
**Why?** Has a fix available, CVSS 8.2 | Arbitrary File Overwrite
[SNYK-JS-TAR-1536528](https://snyk.io/vuln/SNYK-JS-TAR-1536528) | Yes | No Known Exploit  | **624/1000**
**Why?** Has a fix available, CVSS 8.2 | Arbitrary File Overwrite
[SNYK-JS-TAR-1536531](https://snyk.io/vuln/SNYK-JS-TAR-1536531) | Yes | No Known Exploit  | **410/1000**
**Why?** Has a fix available, CVSS 3.7 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-TAR-1536758](https://snyk.io/vuln/SNYK-JS-TAR-1536758) | Yes | No Known Exploit  | **639/1000**
**Why?** Has a fix available, CVSS 8.5 | Arbitrary File Write
[SNYK-JS-TAR-1579147](https://snyk.io/vuln/SNYK-JS-TAR-1579147) | Yes | No Known Exploit  | **639/1000**
**Why?** Has a fix available, CVSS 8.5 | Arbitrary File Write
[SNYK-JS-TAR-1579152](https://snyk.io/vuln/SNYK-JS-TAR-1579152) | Yes | No Known Exploit  | **639/1000**
**Why?** Has a fix available, CVSS 8.5 | Arbitrary File Write
[SNYK-JS-TAR-1579155](https://snyk.io/vuln/SNYK-JS-TAR-1579155) | Yes | No Known Exploit  | **726/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 8.1 | Arbitrary File Overwrite
[SNYK-JS-TAR-174125](https://snyk.io/vuln/SNYK-JS-TAR-174125) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-Y18N-1021887](https://snyk.io/vuln/SNYK-JS-Y18N-1021887) | Yes | Proof of Concept  | **434/1000**
**Why?** Has a fix available, CVSS 4.4 | Time of Check Time of Use (TOCTOU)
[npm:chownr:20180731](https://snyk.io/vuln/npm:chownr:20180731) | Yes | No Known Exploit  | **579/1000**
**Why?** Has a fix available, CVSS 7.3 | Prototype Pollution
[npm:extend:20180424](https://snyk.io/vuln/npm:extend:20180424) | Yes | No Known Exploit  | **636/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 6.3 | Prototype Pollution
[npm:hoek:20180212](https://snyk.io/vuln/npm:hoek:20180212) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: browser-sync
The new version differs by 79 commits.- 2b55728 v2.26.9
- 2bf8812 v2.26.8
- 0f3cc0b fix: npm audit fixes (root)
- ba1f09f fix: npm audit fixes
- d89252a Merge pull request #1749 from ProLoser/securityFix
- df81272 Merge pull request #1771 from tolulawson/master
- 64f87b9 Merge pull request #1768 from fozzleberry/bump-http-proxy-1.18.1
- 43dc459 Merge pull request #1725 from nitinbansal1989/master
- 894d031 -- Corrected codesync tagline
- 0667104 used correct syntax on bump
- 938e611 bumped node engines to >= 8.0.0
- 20a0334 bumped http proxy to >=1.18.1
- c103029 Security fix for #1649
- 864c9f1 upgrade chokidar version
- 2191369 v2.26.7
- 53f9b36 docs: readme
- 0b3d98b v2.26.6
- fdfc681 tests: add e2e tests to package.json
- c56cfd9 Merge pull request #1698 from emeitch/fix_deprecated_header
- 2fd598f Merge pull request #1690 from XhmikosR/xmr-ci
- 841ccd5 Merge pull request #1694 from coliff/patch-1
- 209c9c1 Merge pull request #1697 from gaards/update-localtunnel
- 87bee4b Use getHeaders or _headers
- 77abfd3 Update localtunnel
See the full diffPackage name: chokidar
The new version differs by 161 commits.- 7b8e02a Release 3.0.0.
- e7bfe2f Move stuff.
- df7f22e Remove changelog from npm, move to hidden dir.
- 3df7692 Improve naming.
- 6e94ca2 Clean-up.
- 2de2f9c test: Add testing of Node.js v12 in Travis pipeline. (#833)
- 9e0965a Fix Windows tests in Travis CI (#832)
- c95a98f Update stuff.
- 187ff2b test: Trying to fix blinked tests for Travis CI. (#825)
- db99076 fix(Windows): Add converting from windows to unix path for all ignored paths. (#824)
- 41f8782 fix(FsEvents): Remove situation with NaN depth. (#823)
- 7cf3f7e Update readdirp to stable.
- 0927a62 Bump packages.
- 11cd857 Update nyc.
- 99c14d7 Uncomment fsevents.
- cf330a5 Update fsevents.
- 0e4fca5 Fix deps.
- 9c575d4 Fix Windows version (#821)
- 3323d59 fix(Linux): Make event loop hack for keep testing valid. (#820)
- 06214c5 Update to latest readdirp.
- 793639f Rename osxfswatch.
- 078bc2d Refactor and fix freaking tests.
- 2b9bb41 Try node 11.
- 3fe3d4e Test travis.
See the full diffPackage name: localtunnel
The new version differs by 18 commits.- 485b816 2.0.1
- 683e743 upgrade devDependencies: mocha
- 67f4dda update dependencies: axios, debug, yargs
- adecb77 Add reference to .NET localtunnel-client (#384)
- b7e4501 v2.0.0
- 24475fe update yarn.lock with yarn 1.17.3
- 2a74d6b HTTPS support, Promise API, modern ES syntax
- d7330a7 v1.9.2
- 5754959 update History.md
- e9d9203 update debug to 4.1.1
- be3dc1a update axios to 0.19.0
- 4d6db16 update yarn.lock with integrity entries
- 41270db Update node versions and default build environment in travis.yml (#307)
- 42ea8ec Bump to UNRELEASED
- 5b313bd v1.9.1
- ef78c19 update History.md
- d0fc61c update debug to 2.6.9
- a4bf6d1 unreleased
See the full diffPackage name: npm
The new version differs by 250 commits.- 3b4ba65 7.0.0
- bbfc75d chore: fix weird .gitignore thing that happened somehow
- 8a2d375 docs: changelog for v7.0.0
- 365f2e7 read-package-json@3.0.0
- fafb348 npm-package-arg@8.1.0
- 9306c68 libnpmfund@1.0.1
- 569cd64 libnpmfund@1.0.0
- ac9fde7 Integration code for @ npmcli/arborist@1.0.0
- 704b9cd @ npmcli/arborist@1.0.0
- 3955bb9 hosted-git-info@3.0.6
- da240ef fix: patch config.js to remove duplicate values
- 9ae45a8 init-package-json@2.0.0
- 41ab36d eslint@7.11.0
- c474a15 npm-registry-fetch@8.1.5
- efc6786 fix: make sure publishConfig is passed through
- 1e4e6e9 docs: v7 using npm config refresh
- 5c1c2da fix: init config aliases
- 5bc7eb2 docs: v7 npm-install refresh
- 1a35d87 7.0.0-rc.4
- 7a5a557 docs: changelog for v7.0.0-rc.4
- f0cf859 chore: dedupe deps
- 0273745 make-fetch-happen@8.0.10
- 7bd47ca @ npmcli/arborist@0.0.33
- 9320b8e only escape arguments, not the command name
See the full diff