[Snyk] Fix for 1 vulnerabilities

[nickfnblum]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: bull

The new version differs by 65 commits.

• f4d715e 3.17.0
• 8a4d3d4 docs: update CHANGELOG
• 6ffe279 chore: upgrade dependencies
• 923ef0c feat: better rate limiter (User info is not being correctly shown in Jira when merging - is this possible? atlassian/github-for-jira#1816)
• 09b9a7f Create node.js.yml
• 332a96b feat(sandbox): kill child workers gracefully (noissue: Set min workers to 5 and max to 15 atlassian/github-for-jira#1802)
• c23ed74 docs: document createClient option (Search of repository doesn't work when trying to create a branch from a Jira ticket atlassian/github-for-jira#1791)
• dfc9211 docs: add some notes to "Reusing Redis Connections" (Username missing from PR's atlassian/github-for-jira#1790)
• 712df1d Update REFERENCE.md
• 013c519 3.16.0
• 15bcef3 docs: update CHANGELOG
• b96fd32 test: give some time slack to rate limiter test
• 75eba49 test: replace uuid() by v4()
• b6a7aef test: more slack for rate limiter test
• 2905a4e chore: removed support for node 8
• 5abcb54 chore: updated yarn.lock
• ac2fc51 feat(rate-limiter): add grouping support
• 71df921 chore: upgrade eslint, deprecated node 8
• c49f8b0 fix: fix lint errors
• 990761a chore: remove utils.isEmpty
• 721172f chore: upgrade eslint java version to 2018
• aa5b99b fix(addbulk): do not mutate inputs
• 17da4e5 3.15.0
• 67a115c chore: upgrade dependencies

See the full diff

Package name: pg

The new version differs by 250 commits.

• 7ffe68e Publish
• 125a268 Update changelog
• da2bb85 Bump node-fetch from 2.6.0 to 2.6.1
• 7649890 Update SPONSORS.md
• c5445f0 Fix metadata for pg-connection-string
• a02dfac Replace semver with optional peer dependencies
• 5825843 Public export of DatabaseError
• e421167 Add ssl=true into the test
• 9cbea21 Solve issues caused by config.ssl = true
• 6be3b90 Add support for ?sslmode connection string param
• f0fc470 Update README.md (None spa test analytics client atlassian/github-for-jira#2330)
• 95b5daa Publish
• 1f0d3d5 Add test for pgpass check function scope
• 0758b76 Fix context (this) in _checkPgPass.
• acfbafa Publish
• 07ee1ba Bump version
• 65156e7 Small readme updates & auto-formatting
• 61e4b7f Merge pull request DISTURBED: add healtcheck endpoint to troubleshoot GHEs webhooks atlassian/github-for-jira#2309 from chris--young/ssl-err
• f4d123b Prevents bad ssl credentials from causing a crash
• 316bec3 Merge pull request Has anyone tried a forward slash in branch names, e.g., "dev/my-branch"? atlassian/github-for-jira#2294 from charmander/test-fixes
• 3edcbb7 Fix most SSL negotiation packet tests being ignored
• 1b022f8 Remove accidentally duplicated methods
• b8773ce Merge pull request ARC-2323 - Map IP block and SSO errors when users select in the dropdown atlassian/github-for-jira#2289 from brianc/dependabot/npm_and_yarn/lodash-4.17.19
• 692e418 Fix documenation typo in README (add timeout to spa request atlassian/github-for-jira#2291)

See the full diff

Package name: probot

The new version differs by 205 commits.

• 05297fb fix: remove update-notifier (ARC-1766 create branch permissions atlassian/github-for-jira#1706)
• 529197e build(deps-dev): bump got from 11.8.2 to 11.8.5
• 3d30acc build(deps-dev): bump semantic-release from 17.4.7 to 19.0.3
• 4b1ccf8 build(deps): bump semver-regex from 3.1.3 to 3.1.4
• 646b6a9 fix: logging of first octokit instance is not set (ARC-1742- Update success page to stay big mode atlassian/github-for-jira#1676) - thanks @ kammerjaeger @ markjm
• 7fd06d6 fix(deps): bump eventsource from 1.1.0 to 2.0.2
• 559f437 docs: fix localhost link protocol (Arc 1770 fix outbound proxy for oauth router atlassian/github-for-jira#1691)
• 3a7bbb2 docs: added an example of an aws deployment without the serverless framework (added debug on the client info since we are not getting expected res… atlassian/github-for-jira#1683)
• 12d9b05 docs: wrong log call in `onError` method (update volta atlassian/github-for-jira#1681)
• 1a73ff4 build(deps): bump minimist from 1.2.5 to 1.2.6
• 420f886 fix: Replaced hbs with express-handlebars ([QUICK-FIX] - Added an ID for console errors atlassian/github-for-jira#1659)
• 07fe1a7 build(deps): bump url-parse from 1.5.7 to 1.5.10
• ce9c3d1 build(deps): bump node-fetch from 2.6.1 to 2.6.7
• 9cf9be2 build(deps): bump url-parse from 1.5.3 to 1.5.7
• c34f64d docs: fix 404 links for classes and rel links (Backfill targetted atlassian/github-for-jira#1649)
• 5d232e2 docs(webhooks): `onAny` code sample fix (ARC 1727 - [UI] Update the loading & success page atlassian/github-for-jira#1648)
• dd9f5ae fix(security): bump minimal version of `hbs` (Remove the code access to old column atlassian/github-for-jira#1638)
• a85c7a6 build(package): bump package and package-lock (ARC-1443 remove db test migration script atlassian/github-for-jira#1636)
• ec92db2 docs(development): fix `ProbotOctokit` usage example (Ship It - Adding comments from GitHub to Jira  atlassian/github-for-jira#1637)
• 992b480 feat: customize account name for manifest creation flow using `GH_ORG` environment variable (prTitle and prRef are now hashed - removed payload dump on log atlassian/github-for-jira#1606)
• c83edcb style: prettier
• 073f087 fix(types): export `ApplicationFunction` (ARC-1701 - Repo search labels atlassian/github-for-jira#1631)
• bb068d9 fix: log json in production (Server to Cloud migration help atlassian/github-for-jira#1598)
• 25a4eca build(package): lock file

See the full diff

Package name: sequelize

The new version differs by 213 commits.

• 901bceb 6.1.0
• 6b32821 6.0.0-beta.7
• 0ca8d72 docs: prepare for v6 release (#12416)
• 663261b feat(sequelize): allow passing dialectOptions.options from url (#12404)
• c6e4192 fix(postgres): parse enums correctly when describing a table (#12409)
• e33d2bd fix(reload): include default scope (#12399)
• 5611ef0 build: update dependencies (#12395)
• e80501d fix(types): transactionType in Options (#12377)
• 4914367 fix(types): add clientMinMessages to Options interface (#12375)
• b71cd05 fix(query): preserve cls context for logger (#12328)
• 95f7fb5 fix(mssql): empty order array generates invalid FETCH statement (#12261)
• ed2d7a9 fix(model.destroy): return 0 with truncate (#12281)
• 72925cf fix: add missing fields to 'FindOrCreateType' (#12338)
• f367191 fix(query-generator): do not generate GROUP BY clause if options.group is empty (#12343)
• 7afd589 docs(sequelize): omitNull only works for CREATE/UPDATE queries
• f9e660f docs: update feature request template
• 2bf7f7b fix(typings): add support for optional values in "where" clauses (#12337)
• 65a9e1e fix(types): add Association into OrderItem type (#12332)
• 1b86729 docs: responsive (#12308)
• 59b8a7b fix(include): check if attributes specified for included through model (#12316)
• 6d87cc5 docs(associations): belongs to many create with through table
• a2dcfa0 fix(query): ensure correct return signature for QueryTypes.RAW (#12305)
• 0769aea refactor: cleanup query generators (#12304)
• 4d9165b feat(postgres): native upsert (#12301)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[probot-cc]

You have succesfully installed probot-cc, now please create a .github/customizable-comments.yml file in your repository to customize this message.