[Snyk] Fix for 13 vulnerabilities

[0c0c0f]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/omi-cli/template/md2site/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-BROWSERSLIST-1090194	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-EVENTSOURCE-2823375	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-ISSVG-1085627	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-ISSVG-1243891	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-MERGE-1040469	Yes	No Known Exploit
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-MERGE-1042987	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
	469/1000 Why? Has a fix available, CVSS 5.1	Denial of Service (DoS) npm:mem:20180117	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: css-loader

The new version differs by 98 commits.

• 634ab49 chore(release): 2.0.0
• 6ade2d0 refactor: remove unused file (Uncaught The provide prop was not found on the parent node or the provide type is incorrect. provide和inject的使用问题 Tencent/omi#860)
• e7525c9 test: nested url (feat: complete and add image Tencent/omi#859)
• 7259faa test: css hacks (feat: complete avatar adjust and fix parseNode/TdClassNamePrefix import Tencent/omi#858)
• 5e6034c feat: allow to filter import at-rules (Add image components Tencent/omi#857)
• 5e702e7 feat: allow filtering urls (feat: improve alert Tencent/omi#856)
• 9642aa5 test: css stuff (continuous development of tag-input Tencent/omi#855)
• 3338656 fix: reduce number of require for url (input 1.0.3 Tencent/omi#854)
• 533abbe test: issue 636 (feat：finish drawer Tencent/omi#853)
• 08c551c refactor: better warning on invalid url resolution (Update check.tsx Tencent/omi#852)
• b0aa159 test: issue 一个与feat/bug无关的issue Tencent/omi#589 (input 1.0.2 and continue to develop tag-input Tencent/omi#851)
• f599c70 fix: broken unucode characters (input 1.0.2 and tag-input beta Tencent/omi#850)
• 1e551f3 test: issue 286 (添加了公共组件common Tencent/omi#849)
• 419d27b docs: improve readme (Add badeg Tencent/omi#848)
• d94a698 refactor: webpack-default (tag 1.0.2 and improve tag's part in site Tencent/omi#847)
• b97d997 feat: schema options
• 453248f fix: support module resolution in composes (avatar组件一些修改 Tencent/omi#845)
• 8a6ea10 refactor: postcss plugins (tag 1.0.1 and add tag into site Tencent/omi#844)
• fdcf687 fix: url resolving logic (input 1.0.1 and add input into site Tencent/omi#843)
• 889dc7f feat: allow to disable css modules and disable their by default (feat: add drawer  Tencent/omi#842)
• ee2d253 test: importLoaders option (feat: add card Tencent/omi#841)
• 1dad1fb feat: reuse postcss ast from other loaders (i.e `postcss-loader`) (textarea 1.0.5 Tencent/omi#840)
• fe94ebc test: icss reserved keywords (avatar组件的改进 Tencent/omi#839)
• 9eaba66 refactor: migrate on message api for postcss-icss-plugin (feat: improve button and add site example Tencent/omi#838)

See the full diff

Package name: eslint

The new version differs by 250 commits.

• 77bb207 5.7.0
• aa599c4 Build: changelog update for 5.7.0
• 536611a Revert "Build: Use karma-chrome-launcher to run tests (#10898)" (#10973)
• 6cb63fd Update: Add iife to padding-line-between-statements (fixes #10853) (#10916)
• 5fd1bda Update: no-tabs allowIndentationTabs option (fixes #10256) (#10925)
• d12be69 Fix: no-extra-bind No autofix if arg may have side effect (fixes #10846) (#10918)
• 847372f Fix: no-unused-vars false pos. with markVariableAsUsed (fixes #10952) (#10954)
• 4132de7 Chore: Simplify space-infix-ops (#10935)
• 543edfa Fix: Fix error with one-var (fixes #10937) (#10938)
• 95c4cb1 Docs: Fix typo for no-unsafe-finally (#10945)
• 5fe0e1a Fix: no-invalid-regexp disallows \ at end of pattern (fixes #10861) (#10920)
• f85547a Docs: Add 'When Not To Use' section to space-infix-ops (#10931)
• 3dccac4 Docs: Update working-with-parsers link (#10929)
• 557a8bb Docs: Remove old note about caching, add a new one (fixes #10739) (#10913)
• fe8111a Chore: Add more test cases to space-infix-ops (#10936)
• 066f7e0 Update: camelcase rule ignoreList added (#10783)
• 70bde69 Upgrade: table to version 5 (#10903)
• 9bc3f7c Build: Use karma-chrome-launcher to run tests (#10898)
• 2e52bca Chore: Update issue templates (#10900)
• bf96e96 5.6.1
• 7e13c4c Build: changelog update for 5.6.1
• 9b26bdb Fix: avoid exponential require-atomic-updates traversal (fixes #10893) (#10894)
• 9432b10 Fix: make separateRequires work in consecutive mode (fixes #10784) (#10886)
• e51868d Upgrade: debug@4 (fixes #10854) (#10887)

See the full diff

Package name: file-loader

The new version differs by 9 commits.

• 1451b1e chore(release): 1.1.7
• 98bf052 fix(index): don't concat `options.outputPath` and `options.publicPath` ([Snyk] Security upgrade jest from 20.0.4 to 26.0.0 #246)
• 9ee8332 docs(README): add `regExp` option (`options.regExp`) ([Snyk] Security upgrade jest from 20.0.4 to 26.0.0 #244)
• f62bc44 chore(package): update `schema-utils` v0.3.0...0.4.5 ([Snyk] Security upgrade jest from 20.0.4 to 26.0.0 #245)
• ef5688e docs(README): correct default value for `digestType` (`hashes`) ([Snyk] Security upgrade webpack from 2.7.0 to 4.0.0 #239)
• d965494 chore(release): 1.1.6
• 1e4b7cf fix: rootContext compatibility fix for legacy / v4 ([Snyk] Fix for 1 vulnerabilities #237)
• 0c4cdc2 docs(README): correct the default value for `[hash:<length>]` ([Snyk] Fix for 1 vulnerabilities #230)
• 52c882e test: standardize test configuration ([Snyk] Security upgrade webpack from 4.46.0 to 5.0.0 #214)

See the full diff

Package name: html-webpack-plugin

The new version differs by 250 commits.

• 873d75b chore(release): 5.5.0
• ddeb774 chore: update examples
• 1e42625 feat: Support type=module via scriptLoading option
• 7d3645b Bump pretty-error to 4.0.0 to fix transitive vuln for ansi-regex CVE-2021-3807
• 79be779 [chore] changes actions to run on pull_requests
• b7e5859 [chore] fixes CI to avoid race conditions
• 48131d3 chore(release): 5.4.0
• 16a841a [chore] rebuild examples
• 3bb7c17 Update index.js
• e38ac97 Update index.js
• f08bd02 [chore] updates fixtures
• d62a10f [chore] upgrades [email protected] -> 6.0.2
• 2f5de7a Remove archived plugin
• 8f8f7c5 chore(release): 5.3.2
• 053c6e6 chore: update snapshot tests for webpack 5.4.0
• 9c7fba0 Fix security vulnerabilities
• b98fbeb Fix security vulnerabilities
• 25cdfc7 Added inject-body-webpack-plugin to readme
• 0e4c1fb Update README to document actual behavior
• 0a6568d chore(release): 5.3.1
• 82d0ee8 fix: remove loader-utils from plugin core
• 6f39192 chore(release): 5.3.0
• d654f5b feat: allow to modify the interpolation options in webpack config
• 41d7a50 feat: drop loader-utils dependency

See the full diff

Package name: postcss-loader

The new version differs by 54 commits.

• 7647ac9 chore(release): 3.0.0
• 313c3c4 docs(README): update filename formatting
• d6931da refactor(Error): add `error` property checks
• 962b1d6 refactor(options): remove `ident` from validation schema
• 1f98aee refactor(Warning): add `warning` property checks
• 95de4c1 docs(LOADER): update JSDoc
• ea68a42 chore(package): update `schema-utils` v0.4.5...1.0.0 (`dependencies`)
• 73a8c66 chore(ISSUE_TEMPLATE/DOCS): add template for documentation issues
• 70f4426 chore(ISSUE_TEMPLATE/FEATURE): add feature request template
• 4a0328e chore(ISSUE_TEMPLATE/BUG): move bug reports into their own template
• 319d1f7 chore(PULL_REQUEST_TEMPLATE): improve format and content
• bdcbef0 refactor(src): update code base with latest ES2015+ features
• f34954f fix(index): add ast version (`meta.ast`)
• 8ac6fb5 fix(index): emit `warnings` as an instance of `{Error}`
• 2c6033b test(Errors): remove stacktrace from snapshot
• 549ea08 fix(options): improved `ValidationError` messages
• fbf05de test: replace helpers with `@ webpack-utilities/test` ([Snyk] Security upgrade webpack-dev-server from 2.9.4 to 4.0.0 #386)
• daa0da8 chore(package): update `postcss` v6.0.0...7.0.0 (`dependencies`) ([Snyk] Fix for 2 vulnerabilities #375)
• 114db12 docs(README): add autoprefixing example ([Snyk] Security upgrade webpack-dev-server from 2.9.4 to 4.0.0 #380)
• 8772814 style(standard): fix linting issues
• 8ef443f ci(travis): build stages
• 6f10898 ci(appveyor): readd Appveyor CI ([Snyk] Security upgrade webpack-dev-server from 2.9.4 to 4.0.0 #381)
• 0bb835c ci(package): run tests in an explicit environment (`jest --env=node`) ([Snyk] Security upgrade webpack-dev-server from 2.9.4 to 4.0.0 #382)
• 5e2bca9 docs(README): replace `postcss-cssnext` with `postcss-preset-env` ([Snyk] Fix for 1 vulnerabilities #379)

See the full diff

Package name: webpack

The new version differs by 250 commits.

• 04f90c5 4.26.0
• e1df721 Merge pull request #8392 from vkrol/cherry-pick-terser-to-webpack-4
• a818def fix for changed API in terser plugin warningsFilter
• b39abf4 Rename test directories too
• 311a728 Switch from uglifyjs-webpack-plugin to terser-webpack-plugin
• a230148 Merge pull request #8351 from DeTeam/chunk-jsdoc-typo
• 7a0af76 Fix a typo in Chunk#split jsdoc comment
• 2361995 4.25.1
• e2a2016 Merge pull request #8338 from webpack/bugfix/issue-8293
• babe736 replace prefix/postfix even when equal for wrapped context
• dcd0d59 test for #8293
• af123a8 Merge pull request #8334 from webpack/bugfix/lint
• 36eb0bb move azure specific commands to azure-pipelines.yml
• 290094e 4.25.0
• 355590e Merge pull request #8250 from Aladdin-ADD/patch-3
• 0293c3a Merge pull request #8279 from smelukov/support-entry-progress
• 1ea411b Merge pull request #8139 from NaviMarella/FormatManifest
• 4b72635 exclude watch test cases
• e35d084 increase test timeout
• 6be1411 move schema into definitions
• 3d74504 add missing hooks to progress
• 56d8a8f prevent writing the same message multiple times to stderr
• 64e3826 use flags to show different parts of the progress message
• 8c5e74f Merge branch 'master' into support-entry-progress

See the full diff

Package name: webpack-dev-server

The new version differs by 250 commits.

• c5b9c7e chore(release): 4.6.0
• 1ba9720 fix: reload on warnings (#4056)
• 5026601 feat: allow to pass all `chokidar` options (#4025)
• 7e78bfa chore(deps-dev): bump webpack from 5.64.2 to 5.64.3 (#4054)
• f2a7d16 chore(deps-dev): bump memfs from 3.3.0 to 3.4.0 (#4055)
• d104b58 chore: remove redundant `eslint-disable` comments (#4053)
• e6330f5 chore: remove redundant snapshots (#4052)
• cf26a3f chore(deps): bump ws from 8.2.3 to 8.3.0 (#4051)
• 7823237 chore(deps-dev): bump lint-staged from 12.1.1 to 12.1.2 (#4048)
• 9b32c96 fix: reconnection logic (#4044)
• 5e7c001 chore(deps-dev): bump eslint from 8.2.0 to 8.3.0 (#4045)
• 12d6d52 chore(deps-dev): bump lint-staged from 12.0.2 to 12.1.1 (#4047)
• 7ed2ba3 chore(deps-dev): bump webpack from 5.64.1 to 5.64.2 (#4046)
• b497f68 docs: fix typo (#4042)
• 285487f chore(deps): remove unused (#4036)
• a19ee71 chore(deps-dev): bump acorn from 8.5.0 to 8.6.0 (#4040)
• 497e615 chore(deps): bump webpack-dev-middleware
• ec882db chore(deps-dev): bump typescript from 4.4.4 to 4.5.2 (#4034)
• 7d117de chore: update dependencies (#4033)
• a5b1c70 chore: update `schema-utils` (#4032)
• d3be607 chore(deps): bump @ babel/preset-env from 7.16.0 to 7.16.4 (#4030)
• 25bace8 chore(deps): bump @ babel/plugin-transform-runtime (#4031)
• 6a5b58d docs: fix `--https` option alignment (#4028)
• fd8c54a chore: remove redundant `eslint-disable` comments (#4024)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.