[Snyk] Security upgrade libxmljs from 0.19.7 to 0.19.8

[Praetor-Ian-Testing]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-LIBXMLJS-2348756	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: libxmljs

The new version differs by 7 commits.

• 27c9084 Merge branch 'master' of https://github.com/libxmljs/libxmljs
• 622360d v0.19.8
• 3d54d57 use github action to prebuild + upload assets to github (#595)
• 6cd3e04 Added encoding for toString() method (#482)
• 1768388 v0.19.8
• 2501807 Ensure parseXml/parseHtml input is string or buffer (#594)
• d6e4cf3 Adjust the version of the c++ standard libraries used to build on Mac. This fixes the build on Node 16 on Macs. (#593)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[sonatype-lift]

Critical OSS Vulnerability:

pkg:npm/libxmljs@0.19.8

2 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components

pkg:npm/libxmljs@0.19.8

CRITICAL Vulnerabilities (1)




[sonatype-2018-0585] CWE-91: XML Injection (aka Blind XPath Injection)

libxmljs - XPATH Injection via variables in XPATH expressions

The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-91

pkg:npm/minimatch@3.0.4

CRITICAL Vulnerabilities (1)




[sonatype-2021-4879] Unknown

minimatch - Regular Expression Denial of Service (ReDoS)

CVSS Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-1333

(at-me in a reply with help or ignore)

---

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]