[Snyk] Fix for 2 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	748/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.1	Improper Privilege Management SNYK-JS-SHELLJS-2332187	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:underscore.string:20170908	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: grunt-contrib-jshint

The new version differs by 23 commits.

• 1910674 3.1.0
• b7edf02 update jshint to ~2.13.0
• 270d8dd Merge pull request #303 from gruntjs/dependabot/npm_and_yarn/path-parse-1.0.7
• 77dca66 Bump path-parse from 1.0.6 to 1.0.7
• 1028d82 Merge pull request #301 from gruntjs/dependabot/npm_and_yarn/hosted-git-info-2.8.9
• eb0314f Bump hosted-git-info from 2.8.8 to 2.8.9
• 337623c Merge pull request #300 from gruntjs/dependabot/npm_and_yarn/lodash-4.17.21
• 51e07d4 Bump lodash from 4.17.20 to 4.17.21
• 9c08ff1 Merge pull request #299 from gruntjs/dependabot/npm_and_yarn/y18n-4.0.1
• 7834701 Bump y18n from 4.0.0 to 4.0.1
• d4359aa Merge pull request #298 from gruntjs/dependabot/npm_and_yarn/ini-1.3.8
• 52f5e31 Bump ini from 1.3.5 to 1.3.8
• 8f597c2 Add changelog
• fc210e7 Merge pull request #275 from raddevon/patch-1
• 03f4302 Merge pull request #297 from gruntjs/peer-dep
• 01d13d2 Remove Grunt peerDependency
• c78f6ee Merge pull request #296 from gruntjs/chalk-upt
• 656f31b Update chalk
• 16ee83d Merge pull request #295 from gruntjs/uptdate-deps-oct
• df2b06d Update dependencies, switch to github actions
• 9bb54cd Merge pull request #291 from gruntjs/dependabot/npm_and_yarn/lodash-4.17.15
• d2e4063 Bump lodash from 4.17.10 to 4.17.15
• 7a6fec4 Ensures errors in stdoutEqual callback are logged

See the full diff

Package name: underscore.string

The new version differs by 9 commits.

• 6a65c38 Version 3.3.6
• a1bc91a fixup! Prepare for 3.3.6
• d69c845 Prepare for 3.3.6
• d095c4a Compile dist
• 6cd50d1 Bump version in manifests to current
• acb31a6 Add lock file and pin node.js
• df8dc9e Disable broken eslint rules for now
• 095972b Update deps
• 87ddc29 Release 3.3.5

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic