[Snyk] Fix for 12 vulnerabilities

[mkucharz]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

  • package.json
  • package-lock.json

• Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
  Find out more.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-EVENTSOURCE-2823375	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	No	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	No	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Command Injection SNYK-JS-REACTDEVUTILS-1083268	Yes	Proof of Concept
	619/1000 Why? Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	No	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @reach/router

The new version differs by 62 commits.

• 1f26ef0 useRouteMatch => useMatch, add null context warnings (#347)
• 99576e7 1.3.0
• 56d4dca Add Hooks APIs (#346)
• 15298df fix createNamedContext (#305)
• 95a8aa5 Bump react-dom from 16.4.1 to 16.4.2 (#329)
• 3832202 Bump mixin-deep from 1.3.1 to 1.3.2 in /website (#330)
• 2dd1c31 Bump lodash from 4.17.10 to 4.17.15 in /website (#331)
• 0908a5f Merge pull request #334 from reach/1.3.0-beta.1
• 31c07a3 update snapshots
• 6f82408 bump to 1.3 in docs
• edea55d remove group role from focus wrapper
• 234523a Fix failing unit tests (#333)
• 11e9ed6 Fix/active routes push new state to history (#302)
• 0d38c82 Fix the getProps example (#306)
• ccfc3c8 Support for named trailing wildcard (#323)
• 0b4d21b Update accessibility.md (#317)
• 3154b75 Merge pull request #319 from stof/upgrade_create_react_context
• ad52cd3 Upgrade create-react-context to 0.3.0
• 28a79e7 Add `?` to location.search in memory history
• f045ba8 Failing test for memory history location.search
• 0a8af93 Don’t copy everything from history.location
• 77fa233 Add displayName to Link
• 64a24e8 Add server configuration guide
• 2cc803d 1.3.0-beta.0

See the full diff

Package name: react-cosmos

The new version differs by 250 commits.

• 1cf4423 v5.0.0
• 4bcbf8c Create independent website pages (#1102)
• 02d72d4 Add rocket animation to website and improve spacing (#1101)
• e106aff Create benefits website section (#1100)
• a569189 Create website build (#1095)
• b76d44f Mention webpack version requirement (#1099)
• 5a4a0df Create remaining website sections (#1094)
• 6fb70b7 Add more website sections (#1093)
• 0054593 Optimize header animation (#1092)
• db70293 Create more website sections (#1091)
• b9446d1 Create partial website (#1090)
• 2e0c1bd Add troubleshooting section (#1089)
• 37f45c5 Add example and docs related to migrating proxies (#1087)
• c8f05a3 Create Cosmonaut animation for website (#1086)
• 5fadde7 Add more install instructions (#1085)
• a230d05 Clarify installation steps (#1084)
• ce65cb0 v5.0.0-rc.0
• ec95fbd Upgrade deps (#1082)
• 1256d57 Hide irrelevant actions in React Native mode (#1081)
• 519e188 Remove most calls to slash() and fix unit tests on Windows
• fd9f39f v5.0.0-beta.16
• aea3b9d Enforce LF line breaks (#1079)
• a64ef61 Add support for advanced HTTP proxy options (#1078)
• 8c4b1b1 Fix building and linting on Windows (#1077)

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Denial of Service (DoS) SNYK-JS-AXIOS-174505	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 More lessons are available in Snyk Learn