[Snyk] Fix for 2 vulnerabilities

[pmartinov]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	701/1000 Why? Recently disclosed, Has a fix available, CVSS 8.3	Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-8172694	Yes	No Known Exploit
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Cross-site Scripting (XSS) SNYK-JS-MARKDOWNTOJSX-6258886	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @gen3/guppy

The new version differs by 60 commits.

• f1431d1 MIDRC-390 fix separate fields (Feat/ndh2 uc-cdis/data-portal#234)
• 7ee2eaa update apollo server and graphql (Fix/logging uc-cdis/data-portal#226)
• 5dd094e update react (fix(getSchema): use http agent for http://revproxy uc-cdis/data-portal#225)
• 88c3e36 update a handfull of dependencies and add some css to make table data look better (api key deletion was successful but portal pop up empty error message uc-cdis/data-portal#224)
• 01fec3d Remove core-js (fix(hostname): internal useage for openstack uc-cdis/data-portal#216)
• 4811ddf update storybook table to antd table from unsupported react-table (polish data portal for NHLBI uc-cdis/data-portal#222)
• 94a0c85 update eslint and fix formating errors (fix(login): better handle new empty commons uc-cdis/data-portal#223)
• a53a35a update a bunch of dev dependencies (Fix logging so its the user's IP not previous proxy IP uc-cdis/data-portal#221)
• f7e4ec2 update helmet to 7 (fix(shib): add shibbleth configuration uc-cdis/data-portal#220)
• f2172cc update node to 16 (Feat/config uc-cdis/data-portal#219)
• 1711ac3 fix: upgrade multiple dependencies with Snyk (chore(gtex): Add new GTEx commons uc-cdis/data-portal#196)
• 1622d79 fix: upgrade @ babel/runtime-corejs3 from 7.21.5 to 7.22.3 (Chore/router upgrade uc-cdis/data-portal#197)
• c1f4352 chore(deps): bump glob-parent and @ storybook/react (graph node's weight should be the max of all paths uc-cdis/data-portal#195)
• c8833be fix: upgrade node-fetch from 2.6.10 to 2.6.11 (tweak submission result to collapse 'full response' on error uc-cdis/data-portal#193)
• 8f39616 fix: upgrade multiple dependencies with Snyk (Fix/submit style uc-cdis/data-portal#194)
• 2257a22 upgrade @ gen3/ui-component to update dependencies (update keypair page for jwt tokens uc-cdis/data-portal#192)
• f2f91f3 fix: upgrade node-fetch from 2.6.9 to 2.6.10 (dictionary and api version only get updated to the footer after a while... uc-cdis/data-portal#191)
• 80eb79b fix: upgrade core-js from 3.30.1 to 3.30.2 (fix(Dictionary): tolerate , in enum props uc-cdis/data-portal#190)
• 3edeb3b fix: upgrade @ babel/core from 7.21.5 to 7.21.8 (Add Logos uc-cdis/data-portal#189)
• 66b7193 fix: upgrade @ babel/runtime-corejs3 from 7.21.0 to 7.21.5 (Feat/dict version uc-cdis/data-portal#188)
• 7dfa3d8 fix: upgrade multiple dependencies with Snyk (Feat/dict version uc-cdis/data-portal#187)
• a641ce4 (PXP-9147): add Count support to guppy connectedFilter and fix bugs (fix(align): fix align right file size uc-cdis/data-portal#180)
• 62de272 fix: upgrade eslint-plugin-jsx-a11y from 6.7.0 to 6.7.1 (Feat/dict version uc-cdis/data-portal#186)
• acf886e fix: upgrade multiple dependencies with Snyk (PXD-363 ⁃ style tiles should be configurable uc-cdis/data-portal#185)

See the full diff

Package name: @gen3/ui-component

The new version differs by 34 commits.

• 236fe1b update all dependencies and resolve all warnings and security vulnerabilities ([Snyk] Security upgrade graphiql from 1.4.7 to 1.7.1 #151)
• 609b6a9 fix: upgrade stylelint from 15.6.3 to 15.7.0 ([Snyk] Fix for 1 vulnerabilities #150)
• bc25dd7 fix: upgrade babel-loader from 9.0.0 to 9.1.2 ([Snyk] Fix for 3 vulnerabilities #149)
• d237e2d fix: package.json & package-lock.json to reduce vulnerabilities ([Snyk] Fix for 7 vulnerabilities #147)
• d0fd73c fix: upgrade stylelint from 15.6.2 to 15.6.3 ([Snyk] Fix for 2 vulnerabilities #148)
• 2ce55c7 fix: upgrade multiple dependencies with Snyk ([Snyk] Fix for 7 vulnerabilities #146)
• de2548b fix: upgrade multiple dependencies with Snyk ([Snyk] Fix for 2 vulnerabilities #144)
• 4614769 fix: upgrade postcss from 8.4.23 to 8.4.24 ([Snyk] Fix for 4 vulnerabilities #145)
• 8e1b16c upgrade storybook and run eslint ([Snyk] Fix for 62 vulnerabilities #143)
• 019c218 release 0.11.3 security fixes ([Snyk] Fix for 62 vulnerabilities #142)
• 4647a39 [Snyk] Upgrade antd from 4.24.7 to 4.24.9 ([Snyk] Fix for 1 vulnerabilities #141)
• bb9ad5d fix: upgrade stylelint from 15.0.0 to 15.6.0 ([Snyk] Fix for 1 vulnerabilities #140)
• 277ce93 [Snyk] Upgrade react-select-async-paginate from 0.4.1 to 0.7.2 ([Snyk] Fix for 3 vulnerabilities #135)
• 0502aae fix: upgrade postcss-loader from 7.1.0 to 7.3.0 ([Snyk] Security upgrade @gen3/guppy from 0.14.3 to 0.17.0 #139)
• 805f522 fix: upgrade eslint-plugin-import from 2.26.0 to 2.27.5 ([Snyk] Fix for 1 vulnerabilities #138)
• 54bbe28 fix: upgrade recharts from 2.3.0 to 2.5.0 ([Snyk] Fix for 1 vulnerabilities #137)
• 08b9349 fix: upgrade multiple dependencies with Snyk ([Snyk] Fix for 1 vulnerabilities #136)
• d5fdebf [Snyk] Fix for 1 vulnerabilities ([Snyk] Fix for 3 vulnerabilities #134)
• 1b16ca7 fix: package.json & package-lock.json to reduce vulnerabilities ([Snyk] Fix for 2 vulnerabilities #133)
• 67c547d fix: package.json & package-lock.json to reduce vulnerabilities ([Snyk] Fix for 1 vulnerabilities #132)
• 9fa574a fix: upgrade postcss-preset-env from 7.3.1 to 7.8.3 ([Snyk] Fix for 1 vulnerabilities #126)
• 6411b5c fix: upgrade stylelint from 14.6.1 to 14.15.0 ([Snyk] Fix for 1 vulnerabilities #125)
• 80017c5 fix: upgrade eslint-plugin-react from 7.28.0 to 7.31.11 ([Snyk] Fix for 31 vulnerabilities #124)
• fc556a4 [Snyk] Upgrade: @ babel/core, @ babel/preset-env, @ babel/preset-react ([Snyk] Fix for 1 vulnerabilities #123)

See the full diff

Package name: @storybook/addon-actions

The new version differs by 250 commits.

• 05070ca v6.5.0
• 88c6a62 Update root, peer deps, version.ts/json to 6.5.0 [ci skip]
• ca93284 6.5.0 changelog
• ff28cd9 6.5.0-rc.1 next.json version file
• 9e1f519 Update git head to 6.5.0-rc.1, update yarn.lock
• 3f09d4e v6.5.0-rc.1
• 82b7ac1 Update root, peer deps, version.ts/json to 6.5.0-rc.1 [ci skip]
• 4b50e28 6.5.0-rc.1 changelog
• 0a6e347 Merge pull request #18220 from storybookjs/improve/detection-webpack5
• 95a5c80 move nextjs detection up
• 152e441 Merge pull request #18248 from storybookjs/18177-fix-conditional-args-fail-gracefully
• 2948cae ArgsTable: Gracefully handle conditional args failures
• f837e31 Merge pull request #18246 from storybookjs/chore_docs_adds_mdx2_steps
• 73cf6ba adds MDX 2 docs and gotchas
• 64b07fe Merge pull request #18244 from storybookjs/chore_docs_cleanup_broken_links
• fef1a32 Fixes broken links
• 82ce9de Merge pull request #18231 from Tomastomaslol/issue-18143-reset-button-broken-for-URL-values
• ebf9341 Merge pull request #18038 from bisubus/fix-vue3-tsx
• 9583cea remove repeated test
• 1b396fd 6.5.0-rc.0 next.json version file
• 6cc69b5 Update git head to 6.5.0-rc.0, update yarn.lock
• c27fd9e v6.5.0-rc.0
• b56b1ce re add reset of args that was not set initially. Extend tests for onResetArgs
• 19ba77b Update root, peer deps, version.ts/json to 6.5.0-rc.0 [ci skip]

See the full diff

Package name: @storybook/react

The new version differs by 250 commits.

• 4f2afa6 v7.0.0
• 03292b0 Update root, peer deps, version.ts/json to 7.0.0 [ci skip]
• b2dc5cf Revert "Update root, peer deps, version.ts/json to 7.0.0 [ci skip]"
• 7f391a3 Update root, peer deps, version.ts/json to 7.0.0 [ci skip]
• f0b53cb 7.0.0 changelog
• 930917d Merge pull request #21856 from storybookjs/docs/interactions-addon-migration
• f1c13da 7.0.0-rc.11 next.json version file [skip ci]
• 512a2ae Update git head to 7.0.0-rc.11, update yarn.lock [ci skip]
• 908c324 v7.0.0-rc.11
• 5edc7c0 Update root, peer deps, version.ts/json to 7.0.0-rc.11 [ci skip]
• 324d9bb 7.0.0-rc.11 changelog
• 37d9737 interactions debugger is now default
• 9682f7c Merge pull request #21833 from storybookjs/kasper/fix-strict-args-decorator-with-interface
• a08ffc7 Put @ storybook/csf version back into next
• 2cc1d36 Merge pull request #21850 from storybookjs/fix/tone-down-dependency-alerts
• 941103b Merge pull request #21851 from storybookjs/valentin/export-application-config-decorator
• 31700c0 Export applicationConfig decorator and adjust documentation for usage
• 3d9544f Merge pull request #21846 from storybookjs/chore_docs_webpack_tweaks
• 79b590b Tweaks to the Webpack docs
• d193be5 Merge pull request #21836 from storybookjs/fix/downgrade-remark-deps
• 79b1fde Merge pull request #21832 from storybookjs/fix/polyfill-global
• 590f053 downgrade remark related dependencies
• b421d95 only provide critical duplicated dependency warning on major version difference
• acace30 Merge pull request #21724 from jungpaeng/docs/fix-controls

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)