[Snyk] Upgrade auditjs from 4.0.18 to 4.0.37

[snyk-bot]

Snyk has created this PR to upgrade auditjs from 4.0.18 to 4.0.37.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 19 versions ahead of your current version.
• The recommended version was released 24 days ago, on 2022-04-20.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Improper Input Validation SNYK-JS-XMLDOM-1534562	325/1000 Why? CVSS 6.5	No Known Exploit
	XML External Entity (XXE) Injection SNYK-JS-XMLDOM-1084960	325/1000 Why? CVSS 6.5	No Known Exploit
	Information Exposure SNYK-JS-LOG4JS-2348757	325/1000 Why? CVSS 6.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: auditjs

• 4.0.37 - 2022-04-20
  

  4.0.37 (2022-04-20)

  Bug Fixes

  • security(npm): lock colors library to 1.4.0 (#251) (36ae07f), closes #250
• 4.0.36 - 2022-02-08
  

  4.0.36 (2022-02-08)

  Bug Fixes

  • sonatype-2021-4879 in minimatch : 3.0.4 (384a99f)
• 4.0.35 - 2022-01-20
  

  4.0.35 (2022-01-20)

  Bug Fixes

  • CVE-2022-21704 in log4js : 6.3.0 (b7f1548)
• 4.0.34 - 2022-01-20
  

  4.0.34 (2022-01-20)

  Bug Fixes

  • CVE-2022-0235 in node-fetch : 2.6.1 (cde4677)
• 4.0.33 - 2021-10-25
  

  4.0.33 (2021-10-25)

  Bug Fixes

  • Error message formatting (#248) (c8acb04), closes #206
• 4.0.32 - 2021-09-16
  

  4.0.32 (2021-09-16)

  Bug Fixes

  • revert fix for SONATYPE-2021-1169, breaks eslint. needs more work (a7428e2)
  • SONATYPE-2021-1169 (74abe3c)
• 4.0.31 - 2021-09-07
  

  4.0.31 (2021-09-07)

  Bug Fixes

  • Make caching class return undefined if property does not exist (#247) (8e3b3ad)
  • use newer node version in CI release process, required to run semantic-release. (589e0ce)
  • use newly published @ xmldom/xmldom package. fixes #243 (9f8b646)
• 4.0.30 - 2021-08-09
  

  4.0.30 (2021-08-09)

  Bug Fixes

  • CVE-2021-32796, will change when xmldom@0.7.0 is published on npm (#242) (a6c8e32)
• 4.0.29 - 2021-08-05
  

  4.0.29 (2021-08-05)

  Bug Fixes

  • Initial move to yarn (#241) (88b063f)
• 4.0.28 - 2021-08-03
  

  4.0.28 (2021-08-03)

  Bug Fixes

  • workaround to fix issue #239. may convert to yarn later (2056567)
• 4.0.27 - 2021-07-30
• 4.0.26 - 2021-07-29
• 4.0.25 - 2021-03-12
• 4.0.24 - 2021-02-12
• 4.0.23 - 2021-01-11
• 4.0.22 - 2020-12-18
• 4.0.21 - 2020-12-17
• 4.0.20 - 2020-11-17
• 4.0.19 - 2020-11-06
• 4.0.18 - 2020-06-04

from auditjs GitHub release notes

Commit messages

Package name: auditjs

• 2ffc035 chore(release): 4.0.37 [skip ci]
• 36ae07f fix: security(npm): lock colors library to 1.4.0 ([BUG] trailing "/" on the end of the iq server url causes error sonatype-nexus-community/nexus-iq-chrome-extension#251)
• fefcd81 chore(release): 4.0.36 [skip ci]
• 384a99f fix: sonatype-2021-4879 in minimatch : 3.0.4
• 24d9791 chore(release): 4.0.35 [skip ci]
• 713f9b9 Merge branch 'main' of github.com:sonatype-nexus-community/auditjs
• b7f1548 fix: CVE-2022-21704 in log4js : 6.3.0
• f3b9175 chore(release): 4.0.34 [skip ci]
• cde4677 fix: CVE-2022-0235 in node-fetch : 2.6.1
• 1ba5920 use iq.sonatype.dev
• 3201e0f chore(release): 4.0.33 [skip ci]
• c8acb04 fix: Error message formatting (feat: get the list of applications for the options page sonatype-nexus-community/nexus-iq-chrome-extension#248)
• 88616e5 chore(release): 4.0.32 [skip ci]
• a7428e2 fix: revert fix for SONATYPE-2021-1169, breaks eslint. needs more work
• 74abe3c fix: SONATYPE-2021-1169
• e98ef83 chore(release): 4.0.31 [skip ci]
• 589e0ce fix: use newer node version in CI release process, required to run semantic-release.
• 2c354e4 ignore IDEA IDE config files
• 8e3b3ad fix: Make caching class return undefined if property does not exist (fix: 246/build valid purl from page sonatype-nexus-community/nexus-iq-chrome-extension#247)
• 9f8b646 fix: use newly published @ xmldom/xmldom package. fixes fix: add no recommended versions available sonatype-nexus-community/nexus-iq-chrome-extension#243
• 24cd807 chore(release): 4.0.30 [skip ci]
• a6c8e32 fix: CVE-2021-32796, will change when xmldom@0.7.0 is published on npm (bug: handle extra path after the version in URL sonatype-nexus-community/nexus-iq-chrome-extension#242)
• 9c7f614 use non-deprecated image, consolidate docker images into executor
• 6082260 chore(release): 4.0.29 [skip ci]

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[pull-dog]

*Ruff* 🐶 I wasn't able to find any Docker Compose files in your repository at any of the given paths in the pull-dog.json configuration file, or the default docker-compose.yml file 😩 Make sure the given paths are correct.

Files checked:

• docker-compose.yml

What is this?

Pull Dog is a GitHub app that makes test environments for your pull requests using Docker, from a docker-compose.yml file you specify. It takes 19 seconds to set up (we counted!) and there's a free plan available.

Visit our website to learn more.

Commands

• @pull-dog up to reprovision or provision the server.
• @pull-dog down to delete the provisioned server.

Troubleshooting

Need help? Don't hesitate to file an issue in our repository

Configuration

{
  "isLazy": false,
  "dockerComposeYmlFilePaths": [
    "docker-compose.yml"
  ],
  "expiry": "00:00:00",
  "conversationMode": "singleComment"
}

Trace ID
2a562cc0-d3fd-11ec-9ab7-e93886ef0851

[guardrails]

⚠️ We detected 1 security issue in this pull request:

Mode: paranoid | Total findings: 1 | Considered vulnerability: 1

Vulnerable Libraries (1)

Severity	Details
High	y18n@4.0.0 (t) - no patch available

More info on how to fix Vulnerable Libraries in General.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.