[Snyk] Fix for 9 vulnerabilities

[blubfoo]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/next/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIHTML-1296849	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	No	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Cross-site Scripting (XSS) SNYK-JS-DEVALUE-536388	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	No	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	No	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-TERSER-2806366	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @ampproject/toolbox-optimizer

The new version differs by 69 commits.

• 908b78b v2.0.0
• b090e54 update changelog
• 2e6b60d v2.0.0-alpha.7
• bb4bcab Update readme and add Markdown sample (Support relative urls on Link component vercel/next.js#614)
• 7c40e60 More flexible image path resolution (Reset prefetchCache when reloading a route. vercel/next.js#617)
• d2c5d53 Update dependency husky to v4.2.3 (Update ansi-html to version 0.0.7 🚀 vercel/next.js#612)
• 11971d8 optimizer: Support alternate cache boilerplate CSS (Check for .json file extension before JSON parse. Was throwing when r… vercel/next.js#601)
• 4f20d9b make bind attr rewriting experimental
• feac2b7 Update dependency mkdirp to v1 (Use zopfli and brotli for improved compression of assets vercel/next.js#584)
• 6a0abd5 chore(deps): update dependency nock to v11.8.2 (Lazy compilation during development vercel/next.js#608)
• 742c4c8 Update dependency @ ampproject/rollup-plugin-closure-compiler to v0.21.0 (Add child function support to Link vercel/next.js#605)
• 678335a remove node 8 engine req
• dccaa90 optimizer: Revert unsupported self-hosting modifications (Fix meta and styles on error page vercel/next.js#600)
• 7cca5c4 Fix typos (clicking anchor with href="#id" resulting in error vercel/next.js#602)
• 362cd22 fix package-lock
• 8b6ed1b fix tests
• 9d8d41a v2.0.0-alpha.6
• 05e4f0c update changelog
• d2905fe update dependencies
• fa872ba fix test
• 236625a Add support for intrinsic layout ([Snyk] Security upgrade apollo-server-micro from 2.9.0 to 3.0.0 #443)
• ada041c Add Markdown transformer (Support /subpath/:parameter route vercel/next.js#596)
• 952b1c4 Only trim whitespace in head (Improve "pages/ not found error" vercel/next.js#591)
• 6f465eb AutoExtensionImporter: fix amp-carousel adding amp-lightbox-gallery (Persisting React state between route navigation vercel/next.js#590)

See the full diff

Package name: devalue

The new version differs by 4 commits.

• 0debc41 -> v2.0.1
• 657c8c4 Merge pull request [Snyk] Fix for 1 vulnerabilities #23 from skaji/patch
• dea6814 LIL -> MIT in README
• f520cc5 add jsesc to 'see also'

See the full diff

Package name: fork-ts-checker-webpack-plugin

The new version differs by 29 commits.

• 04581f4 fix(dependency): updating chokidar as per original issue
• 032475e feat: add nativescript-vue-template-compiler support ([Snyk] Security upgrade apollo-server-micro from 2.6.7 to 2.9.2 #354)
• 73e3903 fix: convert afterCompile to emit ([Snyk] Security upgrade video.js from 6.13.0 to 7.14.3 #353)
• 074b2bf fix: revert 2.0.0 afterCompileCallback changes ([Snyk] Security upgrade next-offline from 4.0.6 to 5.0.3 #352)
• 594bed1 chore(deps-dev): bump lodash from 4.17.11 to 4.17.13
• dd410b0 fix: change fork-ts-checker-emit to fork-ts-checker-after-compile
• b135193 refactor: rename emitCallback to afterCompileCallback
• 2e3aedd fix: replace emit hook with afterCompile
• ac95f23 doc: fix formatting of the REAMDE.md header
• 16c32c6 chore(deps): bump mixin-deep from 1.3.1 to 1.3.2
• 9c37ebc feat: add devcontainer support ([Snyk] Security upgrade mini-css-extract-plugin from 0.8.0 to 1.1.0 #334)
• 73a0b9a fix types for eslint option ([Snyk] Security upgrade next from 9.5.5 to 10.0.6 #348)
• da2db52 Revert "fix: log everything to stderr, not stdout ([Snyk] Security upgrade next from 9.5.5 to 10.0.7 #321)" ([Snyk] Security upgrade next from 9.5.5 to 10.0.6 #345)
• 1621fd5 chore(deps): bump eslint-utils from 1.3.1 to 1.4.2
• a89fdaf fix: log everything to stderr, not stdout ([Snyk] Security upgrade next from 9.5.5 to 10.0.7 #321)
• 4e8c6f9 feat: apply clickable filename format to codeframeFormatter ([Snyk] Security upgrade css-loader from 0.28.11 to 5.0.0 #320)
• 39fbffb fix: eslint excludes .json & ignored files ([Snyk] Fix for 1 vulnerabilities #316) ([Snyk] Security upgrade next from 9.5.5 to 10.0.7 #318)
• f292028 fix: handle unhandled "write EPIPE" error ([Snyk] Security upgrade css-loader from 0.28.11 to 1.0.0 #306)
• cb31cae fix: do not lint tsconfig.json ([Snyk] Security upgrade next-offline from 4.0.6 to 5.0.0 #313)
• 34b16c5 docs: clarify `watch` option (n/a with useTypescriptIncrementalApi) ([Snyk] Security upgrade next from 9.5.5 to 10.0.7 #311)
• 544f205 feat: add eslint typescript support ([Snyk] Security upgrade next from 8.1.0 to 9.3.4 #305)
• cae170b chore(deps): bump lodash.template from 4.4.0 to 4.5.0
• 0c93455 docs: add the "Credits" section in README.md
• 9f431ad docs: change all references from Realytics to TypeStrong

See the full diff

Package name: mkdirp

The new version differs by 4 commits.

• b2e7ba0 0.5.2
• c5b97d1 bump minimist to 1.2 to fix security issue
• f2003bb test: add v4 and v5 to travis
• b8629ff tools: update tap + mock-fs. Fix broken test

See the full diff

Package name: node-fetch

The new version differs by 19 commits.

• 1ef4b56 backport of Internal Server Error and SourceMap vercel/next.js#1449 (Update standard to the latest version 🚀 vercel/next.js#1453)
• 8fe5c4e 2.x: Specify encoding as an optional peer dependency in package.json (Fire route cancel event just after the cancellation. vercel/next.js#1310)
• f56b0c6 fix(URL): prefer built in URL version when available and fallback to whatwg (with-global-stylesheet -- PostCSS for @import of normalize.css and autoprefixer vercel/next.js#1352)
• b5417ae fix: import whatwg-url in a way compatible with ESM Node (Example Koa2 vercel/next.js#1303)
• 18193c5 fix v2.6.3 that did not sending query params (Get rid of our use of eval vercel/next.js#1301)
• ace7536 fix: properly encode url with unicode characters (remove regenerator in server code vercel/next.js#1291)
• 152214c Fix(package.json): Corrected main file path in package.json (with-apollo example webpack break? vercel/next.js#1274)
• b5e2e41 update version number
• 2358a6c Honor the `size` option after following a redirect and revert data uri support
• 8c197f8 docs: Fix typos and grammatical errors in README.md (Routing on the client with Redux vercel/next.js#686)
• 1e99050 fix: Change error message thrown with redirect mode set to error (Update gulp-jest to version 1.0.0 🚀 vercel/next.js#653)
• 244e6f6 docs: Show backers in README
• 6a5d192 fix: Properly parse meta tag when parameters are reversed (Update react-dom to version 15.4.2 🚀 vercel/next.js#682)
• 47a24a0 chore: Add opencollective badge
• 7b13662 chore: Add funding link
• 5535c2e fix: Check for global.fetch before binding it (Server stops responding vercel/next.js#674)
• 1d5778a docs: Add Discord badge
• eb3a572 feat: Data URI support (Where do Providers Go? vercel/next.js#659)
• 086be6f Remove --save option as it isn't required anymore (Errors when trying the minimal setup vercel/next.js#581)

See the full diff

Package name: terser

The new version differs by 250 commits.

• 40674a4 update changelog, version
• d8cc569 backport fix to potential regexp DDOS
• 504b967 4.8.0
• 9f380dc update changelog
• 7dd0b9d update assumptions
• cfad907 Allow yield to be used as property key in generators.
• 283f44f Make class property assignment pure.
• ee965e8 Add numeric separators support (Link next/prefetch TypeError vercel/next.js#725)
• ee6b8af 4.7.0
• 807f729 update changelog
• 2e0e6c2 audit fix
• 87f7e7f fix functional tests
• 9b11e3d update node version
• 2ddf987 fix: fix a bug in AST_Arrow.prototype._size (Fix link in redux example vercel/next.js#701)
• 149e580 consider property access of arguments object to be pure. Closes Typo fix vercel/next.js#687
• 2a25f3f ensure `const` declarations values are replaced with something, since `const` must have a value.
• 056623c 4.6.13
• b0e3686 update changelog
• 8d8200c fix Reset status code for Koa (#677) vercel/next.js#678. when optimizing object properties, Terser should take care to not create incompatible identifiers
• 29e6d1b fix more of [Snyk] Security upgrade next-offline from 4.0.6 to 5.0.4 #525
• 4f161d7 4.6.12
• 3729fae lint
• ea01f7d update changelog
• 7fda1de further fix the equivalent-to fix

See the full diff

Package name: webpack-hot-middleware

The new version differs by 13 commits.

• e140693 2.25.1
• 3d5018a Merge pull request [Snyk] Security upgrade firebase from 5.11.1 to 7.22.0 #413 from nttibbetts/replace-ansi-html
• 90551e5 use public npm registry, not private one
• adeeade fix: replace ansi-html with ansi-html-community to fix vulnerability
• f0ffa4c Resolve weird desync in package lock
• 0f5e3e9 Use old-style require syntax to keep the linter happy
• aa38d42 Bump ansi/html encoding deps
• 2c31df1 Bump example dependencies
• d156bbc Simplify CI setup
• 0635d00 Replace istanbul with nyc
• 04fa8c8 Apply prettier formatting updates
• b81cfd5 Update eslint and prettier
• c98216a Upgrade test dependencies

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Cross-site Scripting (XSS)
🦉 More lessons are available in Snyk Learn