[Snyk] Fix for 1 vulnerabilities

[Matthelonianxl]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-LODASH-6139239	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: eth-json-rpc-filters

The new version differs by 20 commits.

• 527b7d8 4.2.0 (Double announce of block MetaMask/web3-provider-engine#30)
• 4b75d43 json-rpc-engine@5.3.0, eth-json-rpc-middleware@6.0.0 (cache - address blockchain reorgs MetaMask/web3-provider-engine#29)
• f80a35c Use ganache-core/websocket@1.0.32 (Caching - handle in-flight caching MetaMask/web3-provider-engine#28)
• cbd9c6d Use mkdirp@0.5.5 and minimist@1.2.5 (filter race condition MetaMask/web3-provider-engine#27)
• f24b145 Use lodash@4.17.19 (strategy and api for sync method support MetaMask/web3-provider-engine#26)
• f691cb8 Add empty lint command
• 0ef64e2 Add .nvmrc and CircleCI config ([Snyk] Fix for 14 vulnerabilities #24)
• a16f255 Use kind-of@6.0.3 ([Snyk] Fix for 3 vulnerabilities #23)
• c64e248 Update minimum eth-json-rpc-middleware version ([Snyk] Fix for 1 vulnerabilities #22)
• e5aa8c2 Use elliptic@6.5.3 ([Snyk] Security upgrade ws from 5.2.2 to 5.2.4 #21)
• c632ea3 Sync yarn.lock
• b026f13 Bump decompress from 4.2.0 to 4.2.1 ([Snyk] Fix for 1 vulnerabilities #20)
• 70bf079 Add CODEOWNERS file ([Snyk] Fix for 19 vulnerabilities #19)
• 722baec yarn import ([Snyk] Fix for 8 vulnerabilities #18)
• d801fa4 Add LICENSE file ([Snyk] Security upgrade eth-json-rpc-filters from 4.1.0 to 5.1.0 #15)
• 2300ef1 Merge pull request [Snyk] Fix for 1 vulnerabilities #10 from rekmarks/sub-mgr-destroy
• f65240c throw if used after destruction
• ae0de21 update destroy function
• a272f4a 4.1.1
• c7780ed add destroy method to sub mgr; fixups

See the full diff

Package name: eth-json-rpc-infura

The new version differs by 23 commits.

• 2d38ad6 5.1.0 (Make nonce/gas/gasPrice lookups optional in hooked-wallet MetaMask/web3-provider-engine#41)
• 69b3d37 json-rpc-engine@5.3.0, eth-json-rpc-middleware@6.0.0 (Implement hooked-wallet-ethtx to support signing with ethereumjs-tx MetaMask/web3-provider-engine#40)
• 1d44f59 Bump node-fetch from 2.6.0 to 2.6.1 (Zen and the art of provider engine maintenance  MetaMask/web3-provider-engine#39)
• 866c28e v5.0.0 (DB Provider MetaMask/web3-provider-engine#36)
• 978f76c Update package metadata (Use runCall() instead of runTx() in the VMSubprovider MetaMask/web3-provider-engine#38)
• b305099 Remove Babel (VM Subprovider Squelching errors MetaMask/web3-provider-engine#37)
• 80560f3 Use Infura API v3 (wallet subp - track pending nonce MetaMask/web3-provider-engine#32)
• 34d0cd2 Add files pattern to package.json
• 303036f Fix CHANGELOG.md links
• 5ed7f89 v4.1.0 (refactor - provider-subprovider parity MetaMask/web3-provider-engine#31)
• 24a1d0e Use shared ESLint config (Double announce of block MetaMask/web3-provider-engine#30)
• f2c3929 Use node-fetch in place of cross-fetch (cache - address blockchain reorgs MetaMask/web3-provider-engine#29)
• bafc9ef Use eth-rpc-errors@3.0.0 (Caching - handle in-flight caching MetaMask/web3-provider-engine#28)
• b0407f8 Use eth-json-rpc-middleware@4.4.1 ([Snyk] Security upgrade eth-json-rpc-filters from 4.1.0 to 5.1.0 #15)
• 8d0588c Add CODEOWNERS file (strategy and api for sync method support MetaMask/web3-provider-engine#26)
• f7d4c1a Add nvmrc and CircleCI config (filter race condition MetaMask/web3-provider-engine#27)
• c6d0080 yarn import (cache - dont cache old data MetaMask/web3-provider-engine#25)
• 68603e0 Add LICENSE file ([Snyk] Fix for 3 vulnerabilities #23)
• 77df395 Bump elliptic from 6.5.0 to 6.5.3 ([Snyk] Fix for 1 vulnerabilities #22)
• 5ceb8f9 Bump lodash from 4.17.15 to 4.17.19 ([Snyk] Fix for 1 vulnerabilities #20)
• c1b1550 Bump minimist from 1.2.0 to 1.2.5 ([Snyk] Fix for 6 vulnerabilities #16)
• d452be3 4.0.2
• 43c7349 deps - move tape to devDeps

See the full diff

Package name: eth-json-rpc-middleware

The new version differs by 45 commits.

• 0715b38 6.0.0 (Add new methods to Etherscan MetaMask/web3-provider-engine#57)
• aa7c8dc Remove VM middleware, dependencies (Add three methods to etherscan subprovider MetaMask/web3-provider-engine#56)
• 4f2afef 5.1.0 (Support POST method for Etherscan.io MetaMask/web3-provider-engine#54)
• b4ed397 eth-rpc-errors@3.0.0 (Overreporting from filters MetaMask/web3-provider-engine#55)
• 34109a2 json-rpc-engine@5.3.0 (Use super call for cleaner code in hooked-wallet-ethtx MetaMask/web3-provider-engine#53)
• 1552606 v5.0.3 (Support for homestead/delegatecall MetaMask/web3-provider-engine#52)
• 2b513d9 Use node-fetch directly as ponyfill ('Validator' provider MetaMask/web3-provider-engine#51)
• b402e1e Bump decompress from 4.2.0 to 4.2.1 (Support selecting which methods to override when adding a provider to the chain MetaMask/web3-provider-engine#50)
• 64c9f87 Use bl@1.2.3 (Moving to ethereumjs MetaMask/web3-provider-engine#44)
• 7f9709f Add CODEOWNERS file (Cache: do not fail when block.number = 0 MetaMask/web3-provider-engine#48)
• ff652e7 Use elliptic@6.5.3 (Solidity compiler subprovider MetaMask/web3-provider-engine#47)
• 5c24cc3 Add .nvmrc and CircleCI config (Defining non-standard RPC method for transaction list MetaMask/web3-provider-engine#49)
• e1aaed6 Use lodash@4.17.19 (Make nonce/gas/gasPrice lookups optional in hooked-wallet MetaMask/web3-provider-engine#41)
• c4f4922 5.0.2 (Implement hooked-wallet-ethtx to support signing with ethereumjs-tx MetaMask/web3-provider-engine#40)
• 5cb2c24 normalize from address in sendTransaction (Zen and the art of provider engine maintenance  MetaMask/web3-provider-engine#39)
• 0416d68 5.0.1 (Use runCall() instead of runTx() in the VMSubprovider MetaMask/web3-provider-engine#38)
• 0c3cb59 Fix decryptMessage bug (VM Subprovider Squelching errors MetaMask/web3-provider-engine#37)
• 15c403b Add files field to package.json (DB Provider MetaMask/web3-provider-engine#36)
• 55d6f64 5.0.0 (VM Subprovider fixes MetaMask/web3-provider-engine#35)
• ad50873 Fix: body.error.toString() returns "[object Object]" ([Snyk] Fix for 1 vulnerabilities #20)
• 2eac97d Update wallet middleware errors (vm subp - relies on currentBlock MetaMask/web3-provider-engine#34)
• f31c7dc Normalize and require keyholder address (cache - address blockchain reorgs MetaMask/web3-provider-engine#29)
• aa76400 Remove signTypedData_v0 (wallet subp - track pending nonce MetaMask/web3-provider-engine#32)
• fe33eb6 Always require getAccounts option (refactor - provider-subprovider parity MetaMask/web3-provider-engine#31)

See the full diff

Package name: ethereumjs-block

The new version differs by 47 commits.

• 128069d Bumped version to v2.2.2, added CHANGELOG entry
• bd2a98e Fixed Travis xvfb issue, added Node 10 and 12
• 2675349 Adds difficulty bomb delay for Muir Glacier hard fork
• 7d34c54 Adding difficulty tests from ethereum/tests
• 30bf607 Bump version to v2.2.1, prepare changelog
• 58ed0a9 Update ethereumjs-tx to v2.1.1
• c5dcbbc Merge pull request subp - hooked wallet - autofail if tx.from doesnt match MetaMask/web3-provider-engine#66 from ethereumjs/remove-tests-from-dist
• c899dc0 Limit the files included in the package to main directory js files, post-added to v2.2.0 release from Adding tests for etherscan MetaMask/web3-provider-engine#65
• b8a3fbf Merge pull request Adding tests for etherscan MetaMask/web3-provider-engine#65 from ethereumjs/new-release-v220
• 49fe4c4 Bumped version to v2.2.0, added CHANGELOG entry
• 97ff421 Merge pull request Add 0x prefix to the LogFilter.address MetaMask/web3-provider-engine#64 from ethereumjs/update-ethereumjs-common-version
• 9dbb00b Update to ethereumjs-common v1.1.0
• 69c73b1 Merge pull request add network option for EtherScan subprovider MetaMask/web3-provider-engine#62 from nicholasjpaterno/master
• a323580 Update index.js error messages
• f8dbba1 Merge pull request Enable homestead featureset in the vm subprovider. MetaMask/web3-provider-engine#61 from ethereumjs/remove-ethereumjs-testing
• d61da4b Remove ethereumjs-testing dependency
• f255f80 Merge pull request "Emulate"/"Substitute" provider MetaMask/web3-provider-engine#60 from whymarrh/buffer-from
• 635682c Replace uses of deprecated `new Buffer` with Buffer.from
• 316968a Merge pull request Add two methods to etherscan subprovider MetaMask/web3-provider-engine#59 from ethereumjs/new-release-v210
• 7019144 Bumped version to v2.1.0, added CHANGELOG entry
• ed4e13e Merge pull request Add new methods to Etherscan MetaMask/web3-provider-engine#57 from ethereumjs/update-chain-tests
• fd59696 Merge branch 'master' into update-chain-tests
• fce008d Merge pull request Support POST method for Etherscan.io MetaMask/web3-provider-engine#54 from alextsg/eip1234
• 3156050 Update chain test data

See the full diff

Package name: ethereumjs-vm

The new version differs by 250 commits.

• c1316fc docs: update
• c389bbb Merge pull request #739 from ethereumjs/vm/release-v4.2.0
• 40ae3cf vm: version bump to 4.2.0
• 7256b20 vm: adding bugfix commit
• 82fa4de vm: explicitly duplicate bignumbers on stack (#733)
• a1dad88 vm: v4.2.0 release notes
• 119808e Merge pull request #663 from ethereum-ts/kk/support-run-block-run-tx-opts
• 46a79d7 Merge branch 'master' into kk/support-run-block-run-tx-opts
• a39c785 Merge pull request #662 from rumkin/b/install-repo
• b5a0890 support in runBlock runTx options
• fef4a99 Fix installation issue. Update level package
• 1824cd0 Merge pull request #658 from ethereumjs/ts-node-api-tests
• 2eb3082 running API tests with ts-node
• 599c2f4 Merge pull request #656 from ethereumjs/fix-autolabeler
• 8b26cfb Merge branch 'master' into fix-autolabeler
• 9e7dc98 Merge pull request #654 from ethereumjs/run-tests-ts
• 85bc0ee Merge branch 'master' into run-tests-ts
• 4671270 Update labeler.yml
• 15dabb7 Merge pull request #653 from ethereumjs/addAPIStateManagerTestsToKarma
• 32f6962 Adding back the stack size variable, in the new format
• 16ed4dc Updating docs pointing ts-node changes
• 301d831 Making necessary changes to test runners for ts-node
• 17672a3 Adding ts-node to some npm scripts
• b52d633 Renaming build:dist to build, for consistency

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution