[Snyk] Fix for 9 vulnerabilities

[ahmed-dinar]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

  • package.json

• Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
  Find out more.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKED-174116	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKED-2342073	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKED-2342082	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKED-451540	Yes	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKED-584281	Yes	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Cross-site Scripting (XSS) SNYK-JS-STRIPTAGS-1312310	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: blessed-contrib

The new version differs by 88 commits.

• ecd48d9 fix: upgrade to marked@4 fixing security issues
• 410c6d7 4.10.1
• aeb95f9 fix(tree): add type declaration (#216)
• d981f1f fix(tree): now passes selectFg and selectBg options in tree, to list. (#196)
• 2ea98c6 feat: add support for displaying arbitrary numbers in donuts core text (#214)
• 48ef9c9 4.9.0
• e8eb98a fix: update deps
• df3b782 4.8.21
• 0414fd7 fix(sparkline): incorrect types for `setData` (#206)
• 6fc04e2 Merge remote-tracking branch 'upstream/master'
• 55d4ad6 4.8.20
• 92dd7e1 fix(table): add mouse option in table widget (#191)
• 460ddd1 4.8.19
• e34f19e fix: update marked-terminal dep (#187)
• 4b690bc chore(package): lint rules and package changes (#182)
• 2957fad fix(security): update vulnerable dependency
• a497e6d 4.8.16
• 87b6a5b 4.8.15
• 567c34a add some missing definitions in TableOptions (#172)
• 9d715d8 fix(markdown): markdown breaks options.style (#169)
• 5d06b5f 4.8.14
• f0e8bf7 fix: broken lodash deeps requirement on non existing >4.7.11
• 854fdc9 4.8.13
• 651a0d9 fix(dependencies): apply snyk security update (#167)

See the full diff

Package name: chalk

The new version differs by 53 commits.

• 3fca615 2.0.0
• f66271e Add tagged template literal (#163)
• 23ef1c7 fix linter errors
• c015568 add rainbow example
• 09fb2d8 Re-implement `chalk.enabled` (#160)
• 608242a spoof supports-color
• 18f2e7c add host information output
• 523b998 Revert "TEMPORARY: emergency travis CI fix (see comments)"
• 54975fb TEMPORARY: emergency travis CI fix (see comments)
• 1d73b21 Improve readme
• 6f4d6b3 Bump dependencies
• 8702496 Remove `chalk.styles`
• 0412cdf Minor code improvements
• 249b9ac ES2015ify the codebase
• cb3f230 Add RGB (256/Truecolor) support (#140)
• dbae68d Update dependent package count in the readme (#154)
• 9b60021 Drop support for Node.js 0.10 and 0.12
• 0d21449 check parent builder object for enabled status (#142)
• 5a69476 add XO badge
• 492f11f add example file
• 4ce73b6 make XO happy
• 7c02cf4 Add log statement to chalk examples (#129)
• 835ca3d You've just reached 10,000 dependent modules. (#122)
• 74c087d minor doc improvements (#120)

See the full diff

Package name: inquirer

The new version differs by 67 commits.

• 68fcbcb 3.2.0
• e16575c Bump dependencies
• 3f2c74b fix(package): update chalk to version 2.0.0
• 2e9eb3e Allow non-string values as a list default option (#558)
• 5dbd186 [fix] #293 Exit script when SIGINT signal received (#564)
• 625965e Fixed typo (#563)
• babdfb2 Add Plugins Section to README.md (#559)
• 810c138 fix(package): update strip-ansi to version 4.0.0
• 13d3100 3.1.1
• 60b27f0 Setup coverage in codacy
• 62fde13 Bump dev dependencies
• 3f465b4 Move eslint configs to own file (easier to integrate in third party)
• 948f8dc Keep password prompt silenced after error - Fix #553 #546
• 11f5854 chore(package): update sinon to version 2.3.4 (#550)
• e612cc5 3.1.0
• 148cb71 Update eslint-config-xo-space to the latest version 🚀 (#516)
• 3b93dd5 call chalk.reset() after message prompt (#544)
• 3ff39a6 chore(package): update chai to version 4.0.1 (#541)
• 76f1bfe upgrade external-editor to 2.0.4 (#535)
• da4eceb pass current answers hash to filter (#533)
• f99b398 Use rx-lite-aggregates instead of full rx (#532)
• 20119a2 fix(package): update ansi-escapes to version 2.0.0 (#527)
• e294e16 Update validate fn param docs (#526)
• 5b3a4a2 Add masked password example

See the full diff

Package name: striptags

The new version differs by 18 commits.

• f252a6b Merge pull request from GHSA-qxg5-2qff-p49r
• 2719515 fix: throw TypeError if 'html' is non-string argument
• 27a5dd9 Update README.md example output
• 127f2fb v3.1.1
• f80b3b8 add typings
• 94ceaf6 v3.1.0
• 9ed9eb0 Add IE11 support using minimal polyfill
• 5eb9357 Fix typo in README.md
• 7179485 Add notice about uglifyjs issues
• 7427951 v3.0.1
• 517fd77 Fix AMD bindings and fix AMD test.
• cd53825 v3.0.0
• 9d9a804 Update README.md
• eb4d1f0 Add test for streaming mode w/ allowable_tags.
• adf53b6 Update mocha version and rewrite tests.
• 86e95d2 Remove HTML test coverage command and JSHint config.
• 969cebd Move module back into src/ directory.
• dd1ed03 Rewrite core module.

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Proof of Concept
	469/1000 Why? Has a fix available, CVSS 5.1	Remote Memory Exposure npm:request:20160119	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 More lessons are available in Snyk Learn