[Snyk] Upgrade npm from 6.8.0 to 6.13.4 #8

snyk-bot · 2020-01-17T02:53:58Z

Snyk has created this PR to upgrade npm from 6.8.0 to 6.13.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 28 versions ahead of your current version.
The recommended version was released a month ago, on 2019-12-11.

The recommended version fixes:

Severity	Issue
	Arbitrary File Write SNYK-JS-NPM-537606
	Arbitrary File Overwrite SNYK-JS-NPM-537603
	Arbitrary File Overwrite SNYK-JS-FSTREAM-174725
	Arbitrary File Write SNYK-JS-BINLINKS-537610
	Arbitrary File Overwrite SNYK-JS-BINLINKS-537608
	Man-in-the-Middle (MitM) SNYK-JS-HTTPSPROXYAGENT-469131
	Unauthorized File Access SNYK-JS-NPM-537604
	Unauthorized File Access SNYK-JS-BINLINKS-537609

Release notes

Package name: npm

6.13.4 - 2019-12-11
6.13.4 (2019-12-11)

BUGFIXES
- 320ac9aee npm/bin-links#12 npm/gentle-fs#7 Do not remove global bin/man links inappropriately (@isaacs)
DEPENDENCIES
- 52fd21061 gentle-fs@2.3.0 (@isaacs)
- d06f5c0b0 bin-links@1.1.6 (@isaacs)
6.13.3 - 2019-12-10
6.13.3 (2019-12-09)

DEPENDENCIES
- 19ce061a2 bin-links@1.1.5 Properly normalize, sanitize, and verify bin entries in package.json.
- 59c836aae npm-packlist@1.4.7
- fb4ecd7d2 pacote@9.5.11
  - 5f33040 #476 npm/pacote#22 npm/pacote#14 fix: Do not drop perms in git when not root (isaacs, @darcyclarke)
  - 6f229f7 sanitize and normalize package bin field (isaacs)
- 1743cb339 read-package-json@2.1.1
6.13.2 - 2019-12-03
6.13.2 (2019-12-03)

BUG FIXES
- 4429645b3 #546 fix docs target typo (@richardlau)
- 867642942 #142 fix(packageRelativePath): fix 'where' for file deps (@larsgw)
- d480f2c17 #527 Revert "windows: Add preliminary WSL support for npm and npx" (@craigloewen-msft)
- e4b97962e #504 remove unnecessary package.json read when reading shrinkwrap (@Lighting-Jack)
- 1c65d26ac #501 fix(fund): open url for string shorthand (@ruyadorno)
- ae7afe565 #263 Don't log error message if git tagging is disabled (@woppa684)
- 4c1b16f6a #182 Warn the user that it is uninstalling npm-install (@Hoidberg)
6.13.1 - 2019-11-18
6.13.1 (2019-11-18)

BUG FIXES
- 938d6124d #472 fix(fund): support funding string shorthand (@ruyadorno)
- b49c5535b #471 should not publish tap-snapshot folder (@ruyadorno)
- 3471d5200 #253 Add preliminary WSL support for npm and npx (@infinnie)
- 3ef295f23 #486 print quick audit report for human output (@isaacs)
TESTING
- dbbf977ac #278 added workflow to trigger and run benchmarks (@mikemimik)
- b4f5e3825 #457 feat(docs): adding tests and updating docs to reflect changes in registry teams API. (@nomadtechie)
- 454c7dd60 #456 fix git configs for git 2.23 and above (@isaacs)
DOCUMENTATION
- b8c1576a4 30b013ae8 26c1b2ef6 9f943a765 c0346b158 8e09d5ad6 4a2f551ee 87d67258c 5c3b32722 b150eaeff 7555a743c b89423e2f #463 #285 #268 #232 #485 #453 docs cleanup: typos, styling and content (@claudiahdz) (@XhmikosR) (@mugli) (@brettz9) (@mkotsollaris)
DEPENDENCIES
- 661d86cd2 make-fetch-happen@5.0.2 (@claudiahdz)
6.13.0 - 2019-11-05
6.13.0 (2019-11-05)

NEW FEATURES
- 4414b06d9 #273 add fund command (@ruyadorno)
DOCUMENTATION
- ae4c74d04 #274 migrate existing docs to gatsby (@claudiahdz)
- 4ff1bb180 #277 updated documentation copy (@oletizi)
BUG FIXES
- e4455409f #281 delete ps1 files on package removal (@NoDocCat)
- cd14d4701 #279 update supported node list to remove v6.0, v6.1, v9.0 - v9.2 (@ljharb)
DEPENDENCIES
- a37296b20 pacote@9.5.9
- d3cb3abe8 read-cmd-shim@1.0.5
TESTING
- 688cd97be #272 use github actions for CI (@JasonEtco)
- 9a2d8af84 #240 Clean up some flakiness and inconsistency (@isaacs)
6.12.1 - 2019-10-29
6.12.1 (2019-10-29)

BUG FIXES
- 6508e833d #269 add node v13 as a supported version (@ljharb)
- b6588a8f7 #265 Fix regression in lockfile repair for sub-deps (@feelepxyz)
- d5dfe57a1 #266 resolve circular dependency in pack.js (@addaleax)
DEPENDENCIES
- 73678bb59 chownr@1.1.3
- 4b76926e2 graceful-fs@4.2.3
- c691f36a9 libcipm@4.0.7
- 5e1a14975 npm-packlist@1.4.6
- c194482d6 npm-registry-fetch@4.0.2
- bc6a8e0ec tar@4.4.1
- 4dcca3cbb uuid@3.3.3
6.12.0 - 2019-10-08
6.12.0 (2019-10-08):

Now npm ci runs prepare scripts for git dependencies, and respects the --no-optional argument. Warnings for engine mismatches are printed again. Various other fixes and cleanups.

BUG FIXES
- 890b245dc #252 ci: add dirPacker to options (@claudiahdz)
- f3299acd0 #257 npm.community#4792 warn message on engine mismatch (@ruyadorno)
- bbc92fb8f #259 npm.community#10288 Fix figgyPudding error in npm token (@benblank)
- 70f54dcb5 #241 doctor: Make OK more consistent (@gemal)
FEATURES
- ed993a29c #249 Add CI environment variables to user-agent (@isaacs)
- f6b0459a4 #248 Add option to save package-lock without formatting Adds a new config --format-package-lock, which defaults to true. (@bl00mber)
DEPENDENCIES
- 0ca063c5d npm-lifecycle@3.1.4:
  - fix: filter functions and undefined out of makeEnv (@isaacs)
- 5df6b0ea2 libcipm@4.0.4:
  - fix: pack git directories properly (@claudiahdz)
  - respect no-optional argument (@cruzdanilo)
- 7e04f728c tar@4.4.12
- 5c380e5a3 stringify-package@1.0.1 (@isaacs)
- 62f2ca692 node-gyp@5.0.5 (@isaacs)
- 0ff0ea47a npm-install-checks@3.0.2 (@isaacs)
- f46edae94 hosted-git-info@2.8.5 (@isaacs)
TESTING
- 44a2b036b #262 fix root-ownership race conditions in meta-test (@isaacs)
6.12.0-next.0 - 2019-09-26
Now npm ci runs prepare scripts for git dependencies, and respects the --no-optional argument.

BUG FIXES
- 890b245dc #252 chore(ci): add dirPacker to options (@claudiahdz)
DEPENDENCIES
- 0ca063c5d npm-lifecycle@3.1.4:
  - fix: filter functions and undefined out of makeEnv (@isaacs)
- 5df6b0ea2 libcipm@4.0.4:
  - fix: pack git directories properly (@claudiahdz)
  - respect no-optional argument (@cruzdanilo)
- 7e04f728c tar@4.4.12
6.11.3 - 2019-09-03
6.11.3 (2019-09-03):

Fix npm ci regressions and npm outdated depth.

BUG FIXES
- 235ed1d28#239 Don't override user specified depth in outdated. Restores ability to update packages using --depth as suggested by npm audit. (@G-Rath)
- 1fafb5151#242 npm.community#9586 Revert "install: do not descend into directory deps' child modules" (@isaacs)
- cebf542e6#243 npm.community#9720 ci: pass appropriate configs for file/dir modes (@isaacs)
DEPENDENCIES
- e5fbb7ed1 read-cmd-shim@1.0.4 (@claudiahdz)
- 23ce65616 npm-pick-manifest@3.0.2 (@claudiahdz)
6.11.2 - 2019-08-22
6.11.2 (2019-08-22):

Fix a recent Windows regression, and two long-standing Windows bugs. Also, get CI running on Windows, so these things are less likely in the future.

DEPENDENCIES
- 9778a1b87 cmd-shim@3.0.3: Fix regression where shims fail to preserve exit code (@isaacs)
- bf93e91d8 npm-package-arg@6.1.1: Properly handle git+file: urls on Windows when a drive letter is included. (@isaacs)
BUGFIXES
- 6cc4cc66f escape args properly on Windows Bash Despite being bash, Node.js running on windows git mingw bash still executes child processes using cmd.exe. As a result, arguments in this environment need to be escaped in the style of cmd.exe, not bash. (@isaacs)
TESTS
- 291aba7b8 make tests pass on Windows (@isaacs)
- fea3a023a travis: run tests on Windows as well (@isaacs)
6.11.1 - 2019-08-21
6.11.0 - 2019-08-20
6.10.3 - 2019-08-06
6.10.2 - 2019-07-23
6.10.2-next.3 - 2019-07-22
6.10.2-next.2 - 2019-07-21
6.10.2-next.1 - 2019-07-17
6.10.2-next.0 - 2019-07-16
6.10.1 - 2019-07-11
6.10.1-next.2 - 2019-07-10
6.10.1-next.1 - 2019-07-03
6.10.1-next.0 - 2019-07-03
6.10.0 - 2019-07-03
6.10.0-next.0 - 2019-07-01
6.9.2 - 2019-06-27
6.9.1-next.0 - 2019-03-20
6.9.0 - 2019-03-06
6.9.0-next.0 - 2019-02-21
6.8.0 - 2019-02-13

from npm GitHub release notes

Commit messages

Package name: npm

fd29398 6.13.4
f2aca36 docs: changelog for 6.13.4
320ac9a Do not remove global bin/man links inappropriately
d06f5c0 bin-links@1.1.6
52fd210 gentle-fs@2.3.0
45482c2 6.13.3
118bc96 docs: changelog for 6.13.3
1743cb3 read-package-json@2.1.1
fb4ecd7 pacote@9.5.11
59c836a npm-packlist@1.4.7
19ce061 bin-links@1.1.5
0a0fdff 6.13.2
dc0178c update AUTHORS
c6ff3ba docs: update changelog for 6.13.2
4429645 makefile: fix docs target typo
4c1b16f chore: Warn the user that it is uninstalling npm-install
ae7afe5 fix: Don't log error message if git tagging is disabled
1c65d26 fix(fund): open url for string shorthand
e4b9796 shrinkwrap: no need to read package.json when read shrinkwrap
8676429 fix(packageRelativePath): fix 'where' for file deps
d480f2c Revert "windows: Add preliminary WSL support for npm and npx"
b829d62 6.13.1
464036b update AUTHORS
1d61a3c docs: update changelog for 6.13.1

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade npm from 6.8.0 to 6.13.4. See this package in NPM: https://www.npmjs.com/package/npm See this project in Snyk: https://app.snyk.io/org/silver-xu/project/109f4ac2-c069-4f82-8240-e6e7ba5a3bf6?utm_source=github&utm_medium=upgrade-pr

[Snyk] Upgrade npm from 6.8.0 to 6.13.4 #8

Are you sure you want to change the base?

[Snyk] Upgrade npm from 6.8.0 to 6.13.4 #8

Conversation

snyk-bot commented Jan 17, 2020

Snyk has created this PR to upgrade npm from 6.8.0 to 6.13.4.

6.13.4 (2019-12-11)

BUGFIXES

DEPENDENCIES

6.13.3 (2019-12-09)

DEPENDENCIES

6.13.2 (2019-12-03)

BUG FIXES

6.13.1 (2019-11-18)

BUG FIXES

TESTING

DOCUMENTATION

DEPENDENCIES

6.13.0 (2019-11-05)

NEW FEATURES

DOCUMENTATION

BUG FIXES

DEPENDENCIES

TESTING

6.12.1 (2019-10-29)

BUG FIXES

DEPENDENCIES

6.12.0 (2019-10-08):

BUG FIXES

FEATURES

DEPENDENCIES

TESTING

BUG FIXES

DEPENDENCIES

6.11.3 (2019-09-03):

BUG FIXES

DEPENDENCIES

6.11.2 (2019-08-22):

DEPENDENCIES

BUGFIXES

TESTS