[Snyk] Fix for 7 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-DOTPROP-543489	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
	469/1000 Why? Has a fix available, CVSS 5.1	Denial of Service (DoS) npm:mem:20180117	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: lerna

The new version differs by 250 commits.

• 0c40a17 chore(release): publish v3.0.0
• aa29ff5 chore(release): No more release candidates
• 4dd10cf test(integration): Improve test root normalization pattern
• cbac458 test(helpers): Show empty log message's prefix
• 627cfc2 fix(publish): Improve `npm pack` experience
• 9c767ac feat: Add @ lerna/log-packed module, extracted from npm
• 012afcc test(publish): Avoid npm login-required validation in CI
• 8d80b2c feat(publish): Run `npm pack` before `npm publish`
• 088ea54 feat(npm-publish): Add npmPack export
• be453cd feat(package): Add tarball property
• ebc8ba6 feat(publish): Validate npm registry and package access prerequisites
• 0097360 refactor(publish): Pass npmConfig to dist-tag methods
• 37e3ec7 refactor(publish): Move license setup into class method
• 410b8d5 test(npm-publish): Use actual Package instance in tests
• 566ab0e refactor(get-npm-exec-opts): Always return env, even if empty
• 3a5c079 chore(serialize-tempdir): Remove desperate logging
• 3cc6ccf chore(windows): Massive simplification of tempdir serializer
• 92e48c1 test: Move windows path serializer 'before' tempdir serializer
• 9c030c6 chore(pkg-matchers): Normalize backslashes of version comparison
• 00436cd Revert "fix(add): Always use POSIX paths when computing relative file: specifiers"
• aae9adb chore(windows): Add ludicrous logging to serialize-tempdir
• ffe354f fix(add): Always use POSIX paths when computing relative file: specifiers
• 16d93b6 test(listable): Turn off chalk so stuff doesn't fail in CI
• 1d6fbc0 chore(windows): join the wack to the whack path

See the full diff

Package name: lerna-changelog

The new version differs by 35 commits.

• 8728c81 v0.7.0
• 62697da Update CHANGELOG
• 5786e0a Merge pull request [Snyk] Security upgrade jest from 22.4.1 to 25.0.0 #82 from Turbo87/issue-not-found
• bcc8a3a changelog: Handle missing issues/PRs gracefully
• 5f85224 Fix broken tests caused by conflicting PR merges
• 019bb7f Merge pull request [Snyk] Security upgrade jest from 22.4.1 to 25.0.0 #81 from Turbo87/scoped-packages
• 0494674 Merge pull request [Snyk] Security upgrade css-loader from 0.28.9 to 1.0.0 #80 from Turbo87/next
• 374a382 changelog#packageFromPath: Fix "packages/@ foo/bar/baz.js" test case
• 725489f changelog#packageFromPath: Fix "packages/foo.js" test case
• a42a826 changelog: Extract packageFromPath() method
• 3073fa9 Changelog: Simplify mock implementation
• 9ca6ce7 Changelog: Merge config and options
• 6d7fcd3 TS: Add "es2015.core" to supported libraries
• 23b28ea tests: Remove unused createMarkdown() arguments
• 61b0fea Changelog: Add "Options" interface
• 552bed5 cli: Convert from kebab-case to camelCase after CLI option parsing
• e0db0fb Inline RemoteRepo wrapper class
• c2424a3 RemoteRepo: Move getBaseIssueUrl() implementation to GitHubAPI class
• d2bee48 GitHubAPI: Remove unused "repo" property
• 49dd4c9 GitHubAPI: Add "repo" parameter to getIssueData() method
• 8c3dc78 GitHubAPI: Change _fetch() parameter from "key" to "url"
• b2a6980 GitHubAPI: Inline _get() method
• a413287 Merge pull request [Snyk] Security upgrade jest from 22.4.1 to 24.0.0 #73 from Turbo87/caching
• ec4de45 Remove unused "mkdirp" dependency

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic