27d3efc chore(gatsby): Remove fallback for v8 serialize (#16958)
58ed3ca fix(gatsby): Remove deprecation warning from express-graphql (#16956)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project.
------------
**Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.*
For more information:
🧐 [View latest project report](https://app.snyk.io/org/haysclark/project/84a46da2-929c-4011-a1c0-e2f10a98415b?utm_source=github&utm_medium=referral&page=fix-pr)
🛠 [Adjust project settings](https://app.snyk.io/org/haysclark/project/84a46da2-929c-4011-a1c0-e2f10a98415b?utm_source=github&utm_medium=referral&page=fix-pr/settings)
📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities)
[//]: # (snyk:metadata:{"prId":"a81f593f-65e5-400e-bf4b-78b1d35f6222","prPublicId":"a81f593f-65e5-400e-bf4b-78b1d35f6222","dependencies":[{"name":"gatsby","from":"2.0.85","to":"3.13.0"},{"name":"gatsby-plugin-sharp","from":"2.0.17","to":"3.15.0"},{"name":"gatsby-remark-copy-linked-files","from":"2.0.8","to":"2.9.0"},{"name":"gatsby-source-filesystem","from":"2.0.12","to":"2.1.16"}],"packageManager":"npm","projectPublicId":"84a46da2-929c-4011-a1c0-e2f10a98415b","projectUrl":"https://app.snyk.io/org/haysclark/project/84a46da2-929c-4011-a1c0-e2f10a98415b?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-AJV-584908","SNYK-JS-ANSIREGEX-1583908","SNYK-JS-BABELTRAVERSE-5962462","SNYK-JS-CSSWHAT-3035488","SNYK-JS-DECODEURICOMPONENT-3149970","SNYK-JS-INFLIGHT-6095116","SNYK-JS-INI-1048974","SNYK-JS-JSON5-3182856","SNYK-JS-JSONSCHEMA-1920922","SNYK-JS-JSYAML-173999","SNYK-JS-JSYAML-174129","SNYK-JS-KINDOF-537849","SNYK-JS-LOADERUTILS-3042992","SNYK-JS-LOADERUTILS-3043105","SNYK-JS-LOADERUTILS-3105943","SNYK-JS-LODASH-1018905","SNYK-JS-LODASH-1040724","SNYK-JS-LODASH-450202","SNYK-JS-LODASH-567746","SNYK-JS-LODASH-608086","SNYK-JS-MINIMATCH-3050818","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-559764","SNYK-JS-MIXINDEEP-450212","SNYK-JS-QS-3153490","SNYK-JS-SEMVER-3247795","SNYK-JS-SETVALUE-1540541","SNYK-JS-SETVALUE-450213","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1536758","SNYK-JS-TAR-1579147","SNYK-JS-TAR-1579152","SNYK-JS-TAR-1579155","SNYK-JS-TAR-174125","npm:chownr:20180731","npm:debug:20170905"],"upgrade":["SNYK-JS-AJV-584908","SNYK-JS-ANSIREGEX-1583908","SNYK-JS-BABELTRAVERSE-5962462","SNYK-JS-CSSWHAT-3035488","SNYK-JS-DECODEURICOMPONENT-3149970","SNYK-JS-INFLIGHT-6095116","SNYK-JS-INI-1048974","SNYK-JS-JSON5-3182856","SNYK-JS-JSONSCHEMA-1920922","SNYK-JS-JSYAML-173999","SNYK-JS-JSYAML-174129","SNYK-JS-KINDOF-537849","SNYK-JS-LOADERUTILS-3042992","SNYK-JS-LOADERUTILS-3043105","SNYK-JS-LOADERUTILS-3105943","SNYK-JS-LODASH-1018905","SNYK-JS-LODASH-1040724","SNYK-JS-LODASH-450202","SNYK-JS-LODASH-567746","SNYK-JS-LODASH-608086","SNYK-JS-MINIMATCH-3050818","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-559764","SNYK-JS-MIXINDEEP-450212","SNYK-JS-QS-3153490","SNYK-JS-SEMVER-3247795","SNYK-JS-SETVALUE-1540541","SNYK-JS-SETVALUE-450213","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1536758","SNYK-JS-TAR-1579147","SNYK-JS-TAR-1579152","SNYK-JS-TAR-1579155","SNYK-JS-TAR-174125","npm:chownr:20180731","npm:debug:20170905"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[619,696,786,586,696,703,686,641,644,509,619,506,479,589,479,586,681,686,731,686,479,506,601,686,696,696,686,686,624,624,410,639,639,639,726,434,506],"remediationStrategy":"vuln"})
---
**Learn how to fix vulnerabilities with free interactive lessons:**
🦉 [Prototype Pollution](https://learn.snyk.io/lesson/prototype-pollution/?loc=fix-pr)
🦉 [Regular Expression Denial of Service (ReDoS)](https://learn.snyk.io/lesson/redos/?loc=fix-pr)
🦉 [Arbitrary Code Execution](https://learn.snyk.io/lesson/malicious-code-injection/?loc=fix-pr)
🦉 [More lessons are available in Snyk Learn](https://learn.snyk.io/?loc=fix-pr)
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------  | **619/1000****Why?** Has a fix available, CVSS 8.1 | Prototype Pollution
[SNYK-JS-AJV-584908](https://snyk.io/vuln/SNYK-JS-AJV-584908) | No | No Known Exploit  | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-ANSIREGEX-1583908](https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908) | Yes | Proof of Concept  | **786/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 9.3 | Incomplete List of Disallowed Inputs
[SNYK-JS-BABELTRAVERSE-5962462](https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962462) | Yes | Proof of Concept  | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-CSSWHAT-3035488](https://snyk.io/vuln/SNYK-JS-CSSWHAT-3035488) | Yes | Proof of Concept  | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Denial of Service (DoS)
[SNYK-JS-DECODEURICOMPONENT-3149970](https://snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970) | Yes | Proof of Concept  | **703/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.2 | Missing Release of Resource after Effective Lifetime
[SNYK-JS-INFLIGHT-6095116](https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-INI-1048974](https://snyk.io/vuln/SNYK-JS-INI-1048974) | Yes | Proof of Concept  | **641/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 6.4 | Prototype Pollution
[SNYK-JS-JSON5-3182856](https://snyk.io/vuln/SNYK-JS-JSON5-3182856) | Yes | Proof of Concept  | **644/1000**
**Why?** Has a fix available, CVSS 8.6 | Prototype Pollution
[SNYK-JS-JSONSCHEMA-1920922](https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922) | No | No Known Exploit  | **509/1000**
**Why?** Has a fix available, CVSS 5.9 | Denial of Service (DoS)
[SNYK-JS-JSYAML-173999](https://snyk.io/vuln/SNYK-JS-JSYAML-173999) | Yes | No Known Exploit  | **619/1000**
**Why?** Has a fix available, CVSS 8.1 | Arbitrary Code Execution
[SNYK-JS-JSYAML-174129](https://snyk.io/vuln/SNYK-JS-JSYAML-174129) | Yes | No Known Exploit  | **506/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 3.7 | Validation Bypass
[SNYK-JS-KINDOF-537849](https://snyk.io/vuln/SNYK-JS-KINDOF-537849) | Yes | Proof of Concept  | **479/1000**
**Why?** Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-LOADERUTILS-3042992](https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3042992) | Yes | No Known Exploit  | **589/1000**
**Why?** Has a fix available, CVSS 7.5 | Prototype Pollution
[SNYK-JS-LOADERUTILS-3043105](https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105) | Yes | No Known Exploit  | **479/1000**
**Why?** Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-LOADERUTILS-3105943](https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3105943) | Yes | No Known Exploit  | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-LODASH-1018905](https://snyk.io/vuln/SNYK-JS-LODASH-1018905) | Yes | Proof of Concept  | **681/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.2 | Command Injection
[SNYK-JS-LODASH-1040724](https://snyk.io/vuln/SNYK-JS-LODASH-1040724) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-LODASH-450202](https://snyk.io/vuln/SNYK-JS-LODASH-450202) | Yes | Proof of Concept  | **731/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 8.2 | Prototype Pollution
[SNYK-JS-LODASH-567746](https://snyk.io/vuln/SNYK-JS-LODASH-567746) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-LODASH-608086](https://snyk.io/vuln/SNYK-JS-LODASH-608086) | Yes | Proof of Concept  | **479/1000**
**Why?** Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-MINIMATCH-3050818](https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818) | Yes | No Known Exploit  | **506/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 3.7 | Prototype Pollution
[SNYK-JS-MINIMIST-2429795](https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795) | Yes | Proof of Concept  | **601/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.6 | Prototype Pollution
[SNYK-JS-MINIMIST-559764](https://snyk.io/vuln/SNYK-JS-MINIMIST-559764) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-MIXINDEEP-450212](https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212) | Yes | Proof of Concept  | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Prototype Poisoning
[SNYK-JS-QS-3153490](https://snyk.io/vuln/SNYK-JS-QS-3153490) | No | Proof of Concept  | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-SEMVER-3247795](https://snyk.io/vuln/SNYK-JS-SEMVER-3247795) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-SETVALUE-1540541](https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541) | Yes | Proof of Concept  | **686/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.3 | Prototype Pollution
[SNYK-JS-SETVALUE-450213](https://snyk.io/vuln/SNYK-JS-SETVALUE-450213) | Yes | Proof of Concept  | **624/1000**
**Why?** Has a fix available, CVSS 8.2 | Arbitrary File Overwrite
[SNYK-JS-TAR-1536528](https://snyk.io/vuln/SNYK-JS-TAR-1536528) | Yes | No Known Exploit  | **624/1000**
**Why?** Has a fix available, CVSS 8.2 | Arbitrary File Overwrite
[SNYK-JS-TAR-1536531](https://snyk.io/vuln/SNYK-JS-TAR-1536531) | Yes | No Known Exploit  | **410/1000**
**Why?** Has a fix available, CVSS 3.7 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-TAR-1536758](https://snyk.io/vuln/SNYK-JS-TAR-1536758) | Yes | No Known Exploit  | **639/1000**
**Why?** Has a fix available, CVSS 8.5 | Arbitrary File Write
[SNYK-JS-TAR-1579147](https://snyk.io/vuln/SNYK-JS-TAR-1579147) | Yes | No Known Exploit  | **639/1000**
**Why?** Has a fix available, CVSS 8.5 | Arbitrary File Write
[SNYK-JS-TAR-1579152](https://snyk.io/vuln/SNYK-JS-TAR-1579152) | Yes | No Known Exploit  | **639/1000**
**Why?** Has a fix available, CVSS 8.5 | Arbitrary File Write
[SNYK-JS-TAR-1579155](https://snyk.io/vuln/SNYK-JS-TAR-1579155) | Yes | No Known Exploit  | **726/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 8.1 | Arbitrary File Overwrite
[SNYK-JS-TAR-174125](https://snyk.io/vuln/SNYK-JS-TAR-174125) | Yes | Proof of Concept  | **434/1000**
**Why?** Has a fix available, CVSS 4.4 | Time of Check Time of Use (TOCTOU)
[npm:chownr:20180731](https://snyk.io/vuln/npm:chownr:20180731) | Yes | No Known Exploit  | **506/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 3.7 | Regular Expression Denial of Service (ReDoS)
[npm:debug:20170905](https://snyk.io/vuln/npm:debug:20170905) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: gatsby
The new version differs by 250 commits.- 0a455df chore(release): Publish
- 91dc167 fix(gatsby): don't log FAST_DEV message for each worker (#32961) (#32967)
- f936c93 fix(gatsby): set staticQueryResultHash to new hash on data change (#32949) (#32966)
- ea161ce feat(gatsby-graphiql-explorer): upgrade to webpack 5 (#30642)
- 944e381 chore(release): Publish next
- d6326df fix(gatsby-core-utils): Switch `auth` option from got to username/password (#32665)
- cf9c066 fix(gatsby): add this typings to actions (#32210)
- 53aa88e chore: enable test parallelism (#32766)
- b7deabc fix(deps): update starters and examples - gatsby (#32843)
- 6025c84 chore(deps): update dependency katex to ^0.13.13 for gatsby-remark-katex (#32567)
- d87c5cb chore: enable lmdb by default and update node for next major (#32695)
- 818d6c1 feat(gatsby-plugin-gatsby-cloud): Add `disablePreviewUI` option (#32907)
- f556a00 chore: update changelogs (#32924)
- aba5eba feat(gatsby): enable webpack caching in development for everyone (#32922)
- ac7bd4e feat(gatsby-source-wordpress): allow path to js file for beforeChangeNode option (#32901)
- 1a87a8a docs(gatsby-source-wordpress): document content sync (#32768)
- 417df15 chore: re-generate changelogs (#32886)
- 1810874 fix(gatsby-source-wordpress): draft previews (#32915)
- 7c72ab8 chore(gatsby): remove unused packages (#32903)
- afb06d7 chore(docs): Add hint for MDX plugin in remark-plugin-tutorial (#32876)
- 1303ecb chore(docs): Update wording for "using-web-fonts" (#32902)
- 9589911 chore(docs): Fix code highlighting in part 6 (#32900)
- 568d4ce feat(gatsby-source-drupal): Use the collection count from JSON:API extras to enable parallel API requests for cold builds (#32883)
- 41f5337 fix(deps): update typescript to ^4.29.3 (#32614)
See the full diffPackage name: gatsby-plugin-sharp
The new version differs by 250 commits.- c1e67a2 chore(release): Publish
- 0c45654 chore: remove tracedSVG (#37093) (#37137)
- d7edf95 chore(release): Publish
- 2d00ea0 fix(gatsby-plugin-mdx): Do not leak frontmatter into page (#35859) (#35913)
- 4997d63 chore(release): Publish
- ff94ed5 fix(gatsby-plugin-mdx): don't allow JS frontmatter by default (#35830) (#35834)
- 36f21b0 chore: Removate validate-renovate from v3-latest branch (#34460)
- 1acb1bc chore(release): Publish
- 1589bd8 fix(gatsby): ensure that writing node manifests to disk does not break on Windows (#33853) (#34020)
- 9694010 fix(gatsby-source-drupal): Ensure all new nodes are created before creating relationships (#33864) (#34019)
- 76deb39 fix(gatsby-source-drupal): searcParams missing from urls (#33861) (#34018)
- f74cc8f feat(gatsby-source-drupal): Add node manifest support for previews (#33683) (#34017)
- 476a591 chore(release): Publish
- 35b48f8 fix(gatsby-plugin-image): GatsbyImage not displaying image in IE11 (#33416) (#33806)
- 880022e fix(gatsby-plugin-image): flickering when state changes (#33732) (#33807)
- c0d07e7 feat(gatsby-source-wordpress): Update supported-remote-plugin-versions.ts (#33801) (#33804)
- 3d9a702 chore(release): Publish
- 84053a2 fix(gatsby-plugin-sharp): pass input buffer instead of readStream when processing image jobs (#33685) (#33703)
- 4722a0d fix(gatsby-source-drupal): Add timeout in case of stalled API requests (#33668) (#33705)
- 857a628 fix(gatsby): single page node manifest accuracy (#33642) (#33698)
- 6bfd0f1 Properly set the pathPrefix and assetPrefix in the pluginData (#33667) (#33702)
- 26c51c0 fix(gatsby-source-drupal): cache backlink records (#33444) (#33701)
- b80c53a fix(gatsby-source-drupal): Correctly update nodes with changed back references so queries are re-run (#33328) (#33699)
- e29a194 chore: use gatsby-dev-cli@latest-v3 in tests
See the full diffPackage name: gatsby-remark-copy-linked-files
The new version differs by 250 commits.- fbc5893 chore(release): Publish
- e693b62 chore: update yarn.lock (#29078)
- e998870 fix(gatsby): Always render the body component to ensure needed head & pre/post body components are added (#29077)
- a1921b5 feat(gatsby): bump opt-in % to dev-ssr to 20% (#29075)
- 2439b44 feat(gatsby-codemods): Handle or warn on nested options changes (#29046)
- c0e6c92 fix(gatsby-plugin-typescript): add missing options validations (#29066)
- 3163ca6 fix(gatsby-plugin-mdx): Add `root` to plugin validation (#29010)
- 6233382 fix(gatsby-plugin-image): Fix onload race condition (#29064)
- c76c175 benchmark(gabe-fs-markdown-images): add img benchmark (#29009)
- bd5b5f7 feat(gatsby): allow to skip cache persistence (#29047)
- 48db6ac fix(gatsby): fix broken GraphQL resolver tracing (#29015)
- 90b6e3d fix(gatsby): Use fast-refresh for React 17 (#28930)
- 9a55d12 feat(gatsby): Add eslint rules to warn against bad patterns in pageTemplates (for Fast Refresh) (#28689)
- b9978e1 fix(gatsby-plugin-image): Handle imgStyle in SSR (#29043)
- f23ba4b fix(gatsby-source-contentful): Improve base64 placeholders (#29034)
- 18b5f30 fix(security): update vulnerable packages, include React 17 in peerDeps (#28545)
- f8bbc06 docs: edit search documentation (#28737)
- 004acf0 fix(sharp) wrap sharp calls in try/catch to avoid crashing on bad images (#28645)
- bf6f264 Hydrate when the page was server rendered (#29016)
- e72533d chore(gatsby-plugin-image): Unflag remote images (#29032)
- 332543c chore(docs): adjust Contentful Rich Text example codes (#29029)
- 9bcc12c feat(gatsby-plugin-image): Change fullWidth to use breakpoints (#29002)
- 168ff60 Fix/contentful add header (#29028)
- a3ad6d7 fix(gatsbu-source-contentful): apply useNameForId when creating the graphql schema (#28649)
See the full diffPackage name: gatsby-source-filesystem
The new version differs by 250 commits.- 7884025 chore(release): Publish
- 816d475 fix: update dependency chokidar to v3 (#16975)
- 90ac3a5 chore(release): Publish
- 92df1cf fix(gatsby-plugin-feed): respect custom options and require title in config (#16814)
- efb0198 chore: update babel monorepo (#16977)
- d16474d fix(gatsby): update check for default exports (#16979)
- 043bebe fix: update gatsby monorepo (#16978)
- 42c1c5e chore: Set lerna concurrency on ci (#16973)
- a25bc27 docs: Add reddit link to Awesome Gatsby docs (#16982)
- 41d3e1c chore(gatsby-image): Clarify IntersectionObserver support in README.md (#16962)
- 7912336 chore(release): Publish
- f355bf8 Revert "chore: update babel monorepo" (#16976)
- 29d5e3c chore: update babel monorepo (#16929)
- 182407f chore: update react monorepo to ^16.9.0 (#16943)
- f7382ae feat(www): add code snippet with install command to starters (#16972)
- 3299192 chore: update dependency aws-sdk to ^2.516.0 (#16967)
- 7d2bf0d chore: update dependency flow-bin to ^0.106.0 (#16966)
- 5757af9 fix: update dependency theme-ui to ^0.2.36 (#16964)
- ebe6131 chore: update gatsby monorepo (#16950)
- 8b08b8c chore: Added my city to my creator description (#16955)
- d6bd515 fix: update minor updates in packages except react, babel and… (#16960)
- e9c8e8a chore(release): Publish
- 27d3efc chore(gatsby): Remove fallback for v8 serialize (#16958)
- 58ed3ca fix(gatsby): Remove deprecation warning from express-graphql (#16956)
See the full diff