[Snyk] Security upgrade snyk from 1.389.0 to 1.518.0

[Omrisnyk]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • large-file/package.json
  • large-file/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	220/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00097, Social Trends: No, Days since published: 959, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.08, Likelihood: 2.42, Score Version: V5	Server-side Request Forgery (SSRF) SNYK-JS-NETMASK-6056519	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: snyk

• 1.518.0 - 2021-03-30
  

  1.518.0 (2021-03-30)

  Bug Fixes

  • replace vulnerable proxy dependency (6d67579)

  Features

  • support lowercase http_proxy envvars (0d0c76a)
• 1.517.0 - 2021-03-30
  

  1.517.0 (2021-03-30)

  Features

  • add @ snyk/fix as a dep (c68c7da)
  • improve snyk fix spinner output (23bd100)
  • introduce snyk fix CLI command (626ff6d)
  • output the fixSummary provided by @ snyk/fix (34df01d)
  • skip failed snyk test paths when fixing (4ef96f5)
• 1.516.0 - 2021-03-30
  

  1.516.0 (2021-03-30)

  Features

  • basic pip fix -r support (0384020)
  • do not skip files with -r directive (66ca77a)
  • fix individual file with provenance (6e84322)
  • include pins optionally (f94c558)
  • v1 support for previously fixed reqs.txt (b286418)
• 1.515.0 - 2021-03-30
  

  1.515.0 (2021-03-30)

  Features

  • introduce envvar to control HTTP-HTTPS upgrade behavior (165b4b9)
• 1.514.0 - 2021-03-29
  

  1.514.0 (2021-03-29)

  Features

  • map 'critical' severity to 'error' in sarif format (30fbd0e)
• 1.513.0 - 2021-03-29
  

  1.513.0 (2021-03-29)

  Features

  • update code-client 3.4.0 (4631059)
• 1.512.0 - 2021-03-29
  

  1.512.0 (2021-03-29)

  Features

  • use break cycles logic of depgraph (a62594b)
• 1.511.0 - 2021-03-26
  

  1.511.0 (2021-03-26)

  Features

  • delete iac cache directory after test (b6803e8)
• 1.510.0 - 2021-03-26
  

  1.510.0 (2021-03-26)

  Bug Fixes

  • support package.json missing name property (c8738d5)
• 1.509.0 - 2021-03-23
  

  1.509.0 (2021-03-23)

  Bug Fixes

  • make transitive deps lowercase in python (ab08b62)

  Features

  • requirements parser records newLine (2623eac)
  • updateDependencies uses parsed data not contents (517e179)
• 1.508.0 - 2021-03-23
• 1.507.0 - 2021-03-23
• 1.506.0 - 2021-03-23
• 1.505.0 - 2021-03-22
• 1.504.0 - 2021-03-22
• 1.503.0 - 2021-03-21
• 1.502.0 - 2021-03-19
• 1.501.0 - 2021-03-19
• 1.500.0 - 2021-03-18
• 1.499.0 - 2021-03-18
• 1.498.0 - 2021-03-18
• 1.497.0 - 2021-03-18
• 1.496.0 - 2021-03-18
• 1.495.0 - 2021-03-17
• 1.494.0 - 2021-03-17
• 1.493.0 - 2021-03-17
• 1.492.0 - 2021-03-17
• 1.491.0 - 2021-03-16
• 1.490.0 - 2021-03-16
• 1.489.0 - 2021-03-15
• 1.488.0 - 2021-03-15
• 1.487.0 - 2021-03-15
• 1.486.0 - 2021-03-14
• 1.485.0 - 2021-03-12
• 1.484.0 - 2021-03-12
• 1.483.0 - 2021-03-10
• 1.482.0 - 2021-03-10
• 1.481.0 - 2021-03-10
• 1.480.0 - 2021-03-10
• 1.479.0 - 2021-03-10
• 1.478.0 - 2021-03-09
• 1.477.0 - 2021-03-09
• 1.476.0 - 2021-03-08
• 1.475.0 - 2021-03-08
• 1.474.0 - 2021-03-07
• 1.473.0 - 2021-03-05
• 1.472.0 - 2021-03-05
• 1.471.0 - 2021-03-04
• 1.470.0 - 2021-03-04
• 1.469.0 - 2021-03-04
• 1.468.0 - 2021-03-04
• 1.467.0 - 2021-03-02
• 1.466.0 - 2021-03-02
• 1.465.0 - 2021-03-02
• 1.464.0 - 2021-03-01
• 1.463.0 - 2021-03-01
• 1.462.0 - 2021-02-28
• 1.461.0 - 2021-02-26
• 1.460.0 - 2021-02-24
• 1.459.0 - 2021-02-22
• 1.458.0 - 2021-02-19
• 1.457.0 - 2021-02-18
• 1.456.0 - 2021-02-17
• 1.455.0 - 2021-02-15
• 1.454.0 - 2021-02-12
• 1.453.0 - 2021-02-12
• 1.452.0 - 2021-02-11
• 1.451.0 - 2021-02-11
• 1.450.0 - 2021-02-10
• 1.449.0 - 2021-02-10
• 1.448.0 - 2021-02-09
• 1.447.0 - 2021-02-08
• 1.446.0 - 2021-02-05
• 1.445.0 - 2021-02-04
• 1.444.0 - 2021-02-04
• 1.443.0 - 2021-02-04
• 1.442.0 - 2021-02-04
• 1.441.0 - 2021-02-04
• 1.440.5 - 2021-02-03
• 1.440.4 - 2021-02-01
• 1.440.3 - 2021-02-01
• 1.440.2 - 2021-02-01
• 1.440.1 - 2021-01-28
• 1.440.0 - 2021-01-28
• 1.439.4 - 2021-01-28
• 1.439.3 - 2021-01-27
• 1.439.2 - 2021-01-27
• 1.439.1 - 2021-01-25
• 1.439.0 - 2021-01-21
• 1.438.0 - 2021-01-20
• 1.437.4 - 2021-01-13
• 1.437.3 - 2020-12-22
• 1.437.2 - 2020-12-16
• 1.437.1 - 2020-12-15
• 1.437.0 - 2020-12-14
• 1.436.0 - 2020-12-10
• 1.435.1 - 2020-12-10
• 1.435.0 - 2020-12-10
• 1.434.4 - 2020-12-09
• 1.434.3 - 2020-12-08
• 1.434.2 - 2020-12-04
• 1.434.1 - 2020-12-04
• 1.434.0 - 2020-12-03
• 1.433.0 - 2020-12-01
• 1.432.1 - 2020-12-01
• 1.432.0 - 2020-12-01
• 1.431.4 - 2020-11-30
• 1.431.3 - 2020-11-30
• 1.431.2 - 2020-11-27
• 1.431.1 - 2020-11-24
• 1.431.0 - 2020-11-24
• 1.430.2 - 2020-11-23
• 1.430.1 - 2020-11-23
• 1.430.0 - 2020-11-20
• 1.429.0 - 2020-11-20
• 1.428.2 - 2020-11-19
• 1.428.1 - 2020-11-19
• 1.428.0 - 2020-11-18
• 1.427.2 - 2020-11-17
• 1.427.1 - 2020-11-17
• 1.427.0 - 2020-11-15
• 1.426.0 - 2020-11-13
• 1.425.4 - 2020-11-13
• 1.425.3 - 2020-11-11
• 1.425.2 - 2020-11-10
• 1.425.1 - 2020-11-09
• 1.425.0 - 2020-11-09
• 1.424.4 - 2020-11-05
• 1.424.3 - 2020-11-05
• 1.424.2 - 2020-11-04
• 1.424.1 - 2020-11-04
• 1.424.0 - 2020-11-03
• 1.423.0 - 2020-11-03
• 1.422.1 - 2020-11-03
• 1.422.0 - 2020-11-02
• 1.421.1 - 2020-10-29
• 1.421.0 - 2020-10-28
• 1.420.2 - 2020-10-28
• 1.420.1 - 2020-10-25
• 1.420.0 - 2020-10-23
• 1.419.1 - 2020-10-21
• 1.419.0 - 2020-10-20
• 1.418.0 - 2020-10-20
• 1.417.0 - 2020-10-20
• 1.416.0 - 2020-10-19
• 1.415.0 - 2020-10-18
• 1.414.1 - 2020-10-16
• 1.414.0 - 2020-10-15
• 1.413.5 - 2020-10-15
• 1.413.4 - 2020-10-15
• 1.413.3 - 2020-10-13
• 1.413.2 - 2020-10-09
• 1.413.1 - 2020-10-09
• 1.413.0 - 2020-10-09
• 1.412.0 - 2020-10-09
• 1.411.0 - 2020-10-09
• 1.410.4 - 2020-10-08
• 1.410.3 - 2020-10-07
• 1.410.2 - 2020-10-06
• 1.410.1 - 2020-10-06
• 1.410.0 - 2020-10-06
• 1.409.1 - 2020-10-05
• 1.409.0 - 2020-10-05
• 1.408.0 - 2020-10-05
• 1.407.0 - 2020-10-05
• 1.406.0 - 2020-10-01
• 1.405.1 - 2020-09-30
• 1.405.0 - 2020-09-30
• 1.404.0 - 2020-09-29
• 1.403.0 - 2020-09-29
• 1.402.0 - 2020-09-28
• 1.401.0 - 2020-09-25
• 1.400.0 - 2020-09-24
• 1.399.1 - 2020-09-22
• 1.399.0 - 2020-09-21
• 1.398.1 - 2020-09-16
• 1.398.0 - 2020-09-15
• 1.397.1 - 2020-09-15
• 1.397.0 - 2020-09-15
• 1.396.0 - 2020-09-15
• 1.395.0 - 2020-09-14
• 1.394.0 - 2020-09-14
• 1.393.1 - 2020-09-14
• 1.393.0 - 2020-09-10
• 1.392.1 - 2020-09-08
• 1.392.0 - 2020-09-08
• 1.391.1 - 2020-09-07
• 1.391.0 - 2020-09-07
• 1.390.0 - 2020-09-07
• 1.389.0 - 2020-09-04

from snyk GitHub release notes

Commit messages

Package name: snyk

The new version differs by 250 commits.

• 8987918 Merge pull request [Snyk(Unlimited)] Upgrade lodash from 4.17.10 to 4.17.15 snyk-fixtures/npm-lockfiles#1781 from snyk/fix/replace-proxy
• eec11b7 test: raise timeout for snyk protect tests hitting real Snyk API
• 8045ceb test: update proxy tests for the new proxy global-agent
• 0d0c76a feat: support lowercase http_proxy envvars
• e597846 test(proxy): acceptance test for Proxy envvar settings
• 6d67579 fix: replace vulnerable proxy dependency
• 1449c57 Merge pull request [Snyk(Unlimited)] Upgrade verbosity from 0.9.2 to 0.10.1 snyk-fixtures/npm-lockfiles#1707 from snyk/feat/snyk-fix
• 3d872fb test: assert exact errors for unsupported
• 5ebd685 Merge pull request [Snyk(Unlimited)] Upgrade qs from 0.0.6 to 0.6.6 snyk-fixtures/npm-lockfiles#1777 from snyk/feat/fix-with-version-provenance
• 17e3431 Merge pull request [Snyk(Unlimited)] Upgrade node-uuid from 1.4.0 to 1.4.8 snyk-fixtures/npm-lockfiles#1778 from snyk/feat/dont-force-https
• fdd7f1a docs: update SNYK_HTTP_PROTOCOL_UPGRADE description
• 165b4b9 feat: introduce envvar to control HTTP-HTTPS upgrade behavior
• 77e6665 chore: lerna release with exact version
• f14819f Merge pull request [Snyk(Unlimited)] Upgrade verbosity from 0.9.2 to 0.10.1 snyk-fixtures/npm-lockfiles#1760 from snyk/feat/support-critical-in-sarif
• b286418 feat: v1 support for previously fixed reqs.txt
• 0384020 feat: basic pip fix -r support
• f94c558 feat: include pins optionally
• 66ca77a feat: do not skip files with -r directive
• bc44f9a refactor: fix individual reqs manifest
• 6e84322 feat: fix individual file with provenance
• 9ed99f3 Merge pull request [Snyk(Unlimited)] Upgrade @thebespokepixel/string from 0.5.2 to 0.5.10 snyk-fixtures/npm-lockfiles#1764 from snyk/feat/update-code-client
• c92599b Merge pull request [Snyk(Unlimited)] Upgrade qs from 0.0.6 to 0.6.6 snyk-fixtures/npm-lockfiles#1774 from snyk/refactor/change-binaries-release-script
• ca508ac test: smoke test for `snyk fix`
• c68c7da feat: add @ snyk/fix as a dep

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)