[Snyk] Fix for 7 vulnerabilities

[TinyMan]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	No	No Known Exploit
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	No	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	No	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	No	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: request-promise-native

The new version differs by 23 commits.

• 578970f Version 1.0.9
• 8388f42 chore: bumped request-promise-core due to security vulnerability of lodash
• f53ac09 docs: reference to request deprecation and alternative libs
• 1165c4e Merge pull request #58 from shisama/readme-shows-deprecation
• 086632b docs: deprecated as well as request
• 6498be1 Version 1.0.8
• 3e8df67 Merge branch 'master' of https://github.com/request/request-promise-native
• 1592a31 chore: updated request-promise-core that updates lodash
• 171f3b5 Merge pull request [Snyk] Security upgrade snyk from 1.685.0 to 1.996.0 #46 from tbjgolden/docs/clarify-es6-finally
• 239ce46 docs: es6+, finally
• 2ae195a Version 1.0.7
• ecf8621 fix: tough-cookie version
• 7c5f721 chore: updated publish-please config
• 7ad655a Version 1.0.6 (now really)
• 1240b80 fix: updated indirect lodash dependency to fix security vulnerability
• 80947a1 Version 1.0.6
• ad529a3 chore: fix ci build for node v8+
• c2c54c4 Merge pull request Update eslint to the latest version 🚀 #33 from jasonmit/u/jasonmit/fix-node-6
• 67f7ed2 Merge branch 'master' into u/jasonmit/fix-node-6
• 4633d4c fix: breaking change in tough-cookie v3
• 14aa6ee chore: added node 8 and 10 to ci build
• 9cfcaaa Update package.json
• 049152b fix: target tough-cookie 2.x to preserve node 6 support

See the full diff

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Command Injection