[Snyk] Fix for 2 vulnerabilities

[lholmquist]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Improper Privilege Management SNYK-JS-SHELLJS-2332187	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: grunt-contrib-jshint

The new version differs by 37 commits.

• 1910674 3.1.0
• b7edf02 update jshint to ~2.13.0
• 270d8dd Merge pull request #303 from gruntjs/dependabot/npm_and_yarn/path-parse-1.0.7
• 77dca66 Bump path-parse from 1.0.6 to 1.0.7
• 1028d82 Merge pull request #301 from gruntjs/dependabot/npm_and_yarn/hosted-git-info-2.8.9
• eb0314f Bump hosted-git-info from 2.8.8 to 2.8.9
• 337623c Merge pull request #300 from gruntjs/dependabot/npm_and_yarn/lodash-4.17.21
• 51e07d4 Bump lodash from 4.17.20 to 4.17.21
• 9c08ff1 Merge pull request #299 from gruntjs/dependabot/npm_and_yarn/y18n-4.0.1
• 7834701 Bump y18n from 4.0.0 to 4.0.1
• d4359aa Merge pull request #298 from gruntjs/dependabot/npm_and_yarn/ini-1.3.8
• 52f5e31 Bump ini from 1.3.5 to 1.3.8
• 8f597c2 Add changelog
• fc210e7 Merge pull request #275 from raddevon/patch-1
• 03f4302 Merge pull request #297 from gruntjs/peer-dep
• 01d13d2 Remove Grunt peerDependency
• c78f6ee Merge pull request #296 from gruntjs/chalk-upt
• 656f31b Update chalk
• 16ee83d Merge pull request #295 from gruntjs/uptdate-deps-oct
• df2b06d Update dependencies, switch to github actions
• 9bb54cd Merge pull request #291 from gruntjs/dependabot/npm_and_yarn/lodash-4.17.15
• d2e4063 Bump lodash from 4.17.10 to 4.17.15
• cfd9ade Merge pull request #290 from gruntjs/ver
• 12045c1 v2.1.0

See the full diff

Package name: grunt-contrib-uglify

The new version differs by 5 commits.

• f65dbb9 v4.0.1. (#535)
• b33a071 upgrade devDependencies (#536)
• 1e40037 upgrade to uglify-js 3.5.0 (#534)
• 33724cd update links to uglifyJS documentation (#530)
• 5cdebda v4.0.0. (#527)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)