[Snyk] Fix for 9 vulnerabilities

[nathang21]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

As this is a private repository, Snyk-bot does not have access. Therefore, this PR has been created automatically, but appears to have been created by a real user.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	No	No Known Exploit
	584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	No	No Known Exploit
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	No	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:bson:20180225	No	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Insecure Randomness npm:cryptiles:20180710	No	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution npm:extend:20180424	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:sshpk:20180409	No	Proof of Concept
	646/1000 Why? Mature exploit, Has a fix available, CVSS 5.2	Uninitialized Memory Exposure npm:stringstream:20180511	No	Mature

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: jimp

The new version differs by 206 commits.

• d64200c bump version number
• 8405867 include types in package
• a00b5e5 longer timeout needed
• ba15d12 accept height and width as strings (#500)
• b976b68 add getHeight and getWidth functions (#504)
• f321190 handle windows env vars (#502)
• 80d2001 closes #224
• 020acbc Update CONTRIBUTING.md
• 08dbab0 use default param. fixes calling with threshold 0 (#498)
• cc96e11 fix a bunch of spelling mistakes (#499)
• d907c03 Update README.md
• 7c608e8 Add module build (#492)
• f19e77f Promisify Functions (#486)
• 69de0fc remove only
• c488bff Switch away from BigNumber.js (#497)
• fb87f39 Mime (#496)
• da3ae0e Merge pull request #495 from hipstersmoothie/bundle-wins
• 262df3e saves a few kB
• 7c21e7b switch to bignumber module
• ed69e9b Merge pull request #494 from hipstersmoothie/update-deps
• 81d1c42 update deps
• b86d323 Merge pull request #491 from hipstersmoothie/fix-build
• ec7a37c have to babel es6 modules because babelify wont. tfilter targets the specific file
• 17de0cc Merge pull request #490 from hipstersmoothie/readme

See the full diff

Package name: mongoose

The new version differs by 250 commits.

• 76fae6d chore: release 5.3.9
• 40d4177 Merge pull request #7213 from NewEraCracker/master
• 751397c fix(document): run setter only once when doing `.set()` underneath a single nested subdoc
• 10837d4 test(document): repro #7196
• 10a63a9 Bump version of bson dependency to match mongodb-core
• d10274e docs(transactions): add example of aborting a transaction
• d245847 Merge branch 'master' of github.com:Automattic/mongoose
• 551a75b chore: add cpc to some pages that were missing it
• 1ca3514 Merge pull request #7210 from gfranco93/patch-1
• c1606b6 Merge pull request #7207 from lineus/fix-7098
• e9d538e Merge pull request #7203 from lineus/fix-7202
• 8f16b67 fix(document): surface errors in subdoc pre validate
• 87005a1 test(document): repro #7187
• 5b1d81c Documentation fix: fixed anchor link
• eebfb36 docs(query): add note re: cursor()
• c1e2617 docs(query): improve find() docs re: #7188
• 526f82d fix(query): run default functions after hydrating the loaded document
• 320d5f8 test(query): repro #7182
• 64c6d15 if our update schema path is a nested array do not skip query casting.
• 5d122e8 test for #7098
• 5ba13a7 refactor(test): move strictQuery tests to query.test.js since they do not use findOneAndUpdate()
• 4121629 chore: refer to correct issue #7178
• 22ed5d2 fix(query): handle strictQuery: 'throw' with nested path correctly
• 8c16354 test(query): repro #7152

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Insecure Randomness