socket-security[bot]
commented
5 months ago New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
🚮 Removed packages: npm/@babel/plugin-transform-async-to-generator@7.1.0, npm/@babel/plugin-transform-classes@7.1.0, npm/@babel/plugin-transform-exponentiation-operator@7.1.0, npm/@babel/plugin-transform-function-name@7.1.0, npm/@babel/plugin-transform-modules-commonjs@7.1.0, npm/@babel/plugin-transform-object-super@7.1.0, npm/@babel/plugin-transform-parameters@7.1.0, npm/accepts@1.3.5, npm/acorn@5.7.3, npm/ansi-wrap@0.1.0, npm/ansi@0.3.1, npm/arr-flatten@1.1.0, npm/assert-plus@1.0.0, npm/async@2.6.1, npm/babel-generator@6.26.1, npm/babel-jest@23.6.0, npm/babel-plugin-syntax-flow@6.18.0, npm/babel-plugin-syntax-object-rest-spread@6.13.0, npm/babel-runtime@6.26.0, npm/babel-template@6.26.0, npm/babel-traverse@6.26.0, npm/babel-types@6.26.0, npm/base64-js@1.3.0, npm/cli-cursor@2.1.0, npm/cli-spinners@1.3.1, npm/concat-stream@1.6.2, npm/core-js@2.5.7, npm/core-util-is@1.0.2, npm/cross-spawn@5.1.0, npm/cssom@0.3.4, npm/errno@0.1.7, npm/estraverse@4.2.0, npm/esutils@2.0.2, npm/extsprintf@1.3.0, npm/fbjs@0.8.17, npm/figures@2.0.0, npm/find-up@2.1.0, npm/for-in@1.0.2, npm/fsevents@1.2.4, npm/gauge@1.2.7, npm/glob@7.1.3, npm/graceful-fs@4.1.11, npm/haul@1.0.0-rc.8, npm/hoist-non-react-statics@2.5.5, npm/http-errors@1.6.3, npm/iconv-lite@0.4.23, npm/inherits@2.0.3, npm/is-extglob@1.0.0, npm/is-glob@2.0.1, npm/is-stream@1.1.0, npm/istanbul-lib-coverage@1.2.1, npm/istanbul-lib-instrument@1.10.2, npm/istanbul-lib-source-maps@1.2.6, npm/jest-docblock@23.2.0, npm/jest-serializer@23.0.1, npm/jest-worker@23.2.0, npm/jest@23.6.0, npm/js-yaml@3.12.0, npm/loader-utils@1.1.0, npm/lodash@4.17.11, npm/lru-cache@4.1.3, npm/memory-fs@0.4.1, npm/metro-core@0.48.1, npm/metro-react-native-babel-preset@0.48.1, npm/metro@0.48.1, npm/mime-db@1.36.0, npm/mime-types@2.1.20, npm/minimatch@3.0.4, npm/minimist@1.2.0, npm/mkdirp@0.5.1, npm/morgan@1.9.1, npm/node-fetch@2.2.0, npm/normalize-path@2.1.1, npm/os-homedir@1.0.2, npm/os-tmpdir@1.0.2, npm/pretty-format@23.6.0, npm/private@0.1.8, npm/prop-types@15.6.2, npm/qs@6.5.2, npm/react-hot-loader@4.3.11, npm/react-native@0.57.3, npm/react-test-renderer@16.6.0-alpha.8af6728, npm/react@16.6.0-alpha.8af6728, npm/readable-stream@2.3.6, npm/regenerator-runtime@0.11.1, npm/regexpu-core@4.2.0, npm/repeat-string@1.6.1, npm/resolve@1.8.1, npm/rimraf@2.6.2, npm/rx-lite@4.0.8, npm/safe-buffer@5.1.2, npm/safer-buffer@2.1.2, npm/schema-utils@0.4.7, npm/serve-static@1.13.2, npm/set-blocking@2.0.0, npm/setimmediate@1.0.5, npm/shell-quote@1.6.1, npm/signal-exit@3.0.2, npm/source-map-support@0.5.9, npm/statuses@1.4.0, npm/string-width@1.0.2, npm/strip-ansi@3.0.1, npm/throat@4.1.0, npm/tough-cookie@2.4.3, npm/uglify-es@3.3.9, npm/uglifyjs-webpack-plugin@1.3.0, npm/unpipe@1.0.0, npm/whatwg-encoding@1.0.5, npm/which@1.3.1
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.
#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - example/package.json #### Note for [zero-installs](https://yarnpkg.com/features/zero-installs) users If you are using the Yarn feature [zero-installs](https://yarnpkg.com/features/zero-installs) that was introduced in Yarn V2, note that this PR does not update the `.yarn/cache/` directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run `yarn` to update the contents of the `./yarn/cache` directory. If you are not using zero-install you can ignore this as your flow should likely be unchanged.⚠️ Warning
``` Failed to update the yarn.lock, please update manually before merging. ```**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5 | Prototype Pollution
[SNYK-JS-LODASH-6139239](https://snyk.io/vuln/SNYK-JS-LODASH-6139239) | No | Proof of Concept (*) Note that the real score may have changed since the PR was raised. Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: