[Snyk] Fix for 15 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

  • package.json
  • package-lock.json

• Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
  Find out more.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ACORN-559469	Yes	No Known Exploit
	Prototype Pollution SNYK-JS-DOTPROP-543489	Yes	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-450202	No	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-73638	No	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	No	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:eslint:20180222	No	Proof of Concept
	Cross-site Scripting (XSS) npm:react-dom:20180802	No	No Known Exploit

Commit messages

Package name: electron-store

The new version differs by 15 commits.

• 84c6b72 3.1.0
• eee6263 Upgrade `conf` dependency
• 66054bc 3.0.0
• 8989899 Upgrade `conf` dependency
• ca19e10 Require Electron 4
• abffec0 Meta tweaks
• 584c627 CI updates ([Snyk] Upgrade eslint from 4.2.0 to 4.19.1 #54)
• 23bbd64 Add related modules to the readme
• a213bce Document `onDidChange` limitation
• 52035b7 2.0.0
• a642fa4 Require Electron 2
• 9882bdc Update conf to 2.0 ([Snyk] Security upgrade node-pre-gyp from 0.6.36 to 0.8.0 #43)
• bab1a46 Simplify appveyor.yml
• 28fd184 Update Electron website URLs
• 4e7ead7 Clarify that the value must be JSON serializable

See the full diff

Package name: eslint

The new version differs by 250 commits.

• a7985a6 6.0.0
• be74dd9 Build: changelog update for 6.0.0
• 81aa06b Upgrade: espree@6.0.0 (#11869)
• 5f022bc Fix: no-else-return autofix produces name collisions (fixes #11069) (#11867)
• ded9548 Fix: multiline-comment-style incorrect message (#11864)
• cad074d Docs: Add JSHint W047 compat to no-floating-decimal (#11861)
• 41f6304 Upgrade: sinon (#11855)
• 167ce87 Chore: remove unuseable profile command (#11854)
• c844c6f Fix: max-len properly ignore trailing comments (fixes #11838) (#11841)
• 1b5661a Fix: no-var should not fix variables named 'let' (fixes #11830) (#11832)
• 4d75956 Build: CI with Azure Pipelines (#11845)
• 1db3462 Chore: rm superfluous argument & fix perf-multifiles-targets (#11834)
• c57a4a4 Upgrade: @babel/polyfill => core-js v3 (#11833)
• 65faa04 Docs: Clarify prefer-destructuring array/object difference (fixes #9970) (#11851)
• 81c3823 Fix: require-atomic-updates reports parameters (fixes #11723) (#11774)
• aef8ea1 Sponsors: Sync README with website
• 4f48f5a 6.0.0-rc.0
• 6bad650 Build: changelog update for 6.0.0-rc.0
• f403b07 Update: introduce minKeys option to sort-keys rule (fixes #11624) (#11625)
• 87451f4 Fix: no-octal should report NonOctalDecimalIntegerLiteral (fixes #11794) (#11805)
• e4ab053 Update: support "bigint" in valid-typeof rule (#11802)
• e0fafc8 Chore: removes unnecessary assignment in loop (#11780)
• 20908a3 Docs: removed '>' prefix from from docs/working-with-rules (#11818)
• 1c43eef Sponsors: Sync README with website

See the full diff

Package name: eslint-nibble

The new version differs by 30 commits.

• 3901ff5 5.0.0
• e585fbf 5.0.0-beta.4
• 58d09ca Add `--rule` option to filter displayed rules
• 942c720 Revert attempt to use `resolve` to support npx
• a4303ce 5.0.0-beta.3
• 0c18655 Add some temporary debugging help
• 2866fb4 5.0.0-beta.2
• 35fc403 Resolve eslint peer by cwd
• 35e47b7 5.0.0-beta.1
• 51335e1 Merge pull request [Snyk] Upgrade jest-fetch-mock from 1.0.6 to 1.7.5 #53 from IanVS/45-enable-npx-without-install
• 1f218a7 Use `resolve` library to allow install-less npx
• e2dc32b 5.0.0-beta.0
• 67e8eba Document cache flags
• abcd198 Merge pull request [Snyk] Security upgrade node-pre-gyp from 0.6.36 to 0.8.0 #42 from aboyton/master
• aad0929 Merge pull request [Snyk] Security upgrade node-fetch from 2.1.2 to 3.2.10 #52 from IanVS/40-eslint-peer-dep
• fa06436 npm saves by default now, avoid that
• 53adabb Improve readme to mention npx, yarn
• 111fed3 Add eslint to devDependencies & update plugins
• bd72901 Move eslint into peerDependencies
• ff2f4c5 Merge pull request [Snyk] Upgrade ledgerco from 1.1.3 to 1.2.1 #51 from IanVS/upgrade-dependencies
• c460100 Drop support for node < 6
• 0c613b0 Use forked version of eslint-stat
• 1e4d3cb ⬆️ [major] eslint-formatter-friendly to 6.0.0
• ed6db9a ⬆️ [major] chalk to 2.4.1

See the full diff

With a Snyk patch:

Severity	Issue	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	No Known Exploit
	Prototype Pollution npm:extend:20180424	No Known Exploit
	Prototype Pollution npm:hoek:20180212	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	No Known Exploit
	Prototype Override Protection Bypass npm:qs:20170213	No Known Exploit
	Uninitialized Memory Exposure npm:stringstream:20180511	Mature
	Regular Expression Denial of Service (ReDoS) npm:tough-cookie:20170905	No Known Exploit
	Uninitialized Memory Exposure npm:tunnel-agent:20170305	Proof of Concept

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:

🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

[ghost]

Congratulations 🍻. DeepCode analyzed your code in 0.175 seconds and we found no issues. Enjoy a moment of no bugs ☀️.

💬 This comment has been generated by the DeepCode bot, installed by the owner of the repository. The DeepCode bot protects your repository by detecting and commenting on security vulnerabilities or other critical issues.

---

☺️ If you want to provide feedback on our bot, here is how to contact us.