[Snyk] Fix for 23 vulnerabilities

[BitcoinOutput]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/insight/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ISMYJSONVALID-597165	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Arbitrary Code Execution SNYK-JS-ISMYJSONVALID-597167	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-JSONPOINTER-1577288	Yes	Proof of Concept
	811/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.8	Prototype Pollution SNYK-JS-JSONPOINTER-598804	Yes	Proof of Concept
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Directory Traversal SNYK-JS-MOMENT-2440688	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SSRI-1246392	Yes	Proof of Concept
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit
	410/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-Y18N-1021887	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: angular2-moment

The new version differs by 9 commits.

• 7be235f chore: release 1.9.0
• 5b9f458 cleanup: remove package-lock.json
• b56a6fa fix Test sighash (Transaction.hashForSignature()) bitpay/bitcore#190: update momentjs version
• 3ff85a8 Merge pull request script parsing should be more loose on pushdata bitpay/bitcore#188 from lukasz-kusnierz/master
• 4808635 amTimeAgo pipe updates it's output when locale changes
• 3cbf666 chore: release 1.8.0
• 27e165a chore: update yarn.lock
• 46f2885 Merge pull request Update README.md bitpay/bitcore#187 from wachri/master
• e9cb193 Remove node_modules from compield version

See the full diff

Package name: codecov

The new version differs by 36 commits.

• e427d90 feat(services): add azure pipelines ([Snyk] Security upgrade bcoin from 0.15.0 to 1.0.2 #114)
• 023d204 Use small HTTP dependency ([Snyk] Security upgrade elliptic from 6.5.3 to 6.5.6 #110)
• 500f308 Update Readme
• 0ce3c76 v3.1.0
• 7c1f16e fix: support `.codecov.yml`/`codecov.yml` files for token ([Snyk] Security upgrade bcoin from 0.15.0 to 1.0.2 #108)
• 1fff4dc Allow custom `yaml` file. ([Snyk] Fix for 1 vulnerabilities #107)
• 77d7a5e Add ESLint ([Snyk] Fix for 3 vulnerabilities #93)
• 625807c Removing Makefile ([Snyk] Fix for 3 vulnerabilities #104)
• 94cd1c6 Change from istanbul to nyc ([Snyk] Fix for 16 vulnerabilities #103)
• b0b580b Update README.md
• 08ca881 v3.0.4
• 012ef08 Update dependencies ([Snyk] Fix for 12 vulnerabilities #102)
• f954f91 Prettier ([Snyk] Fix for 21 vulnerabilities #101)
• 16efd18 Update README.md
• 49257a9 Update Readme
• 15cdae3 v3.0.3
• 39dc2d8 Support non-git/hg root dirs ([Snyk] Security upgrade bitcore-build from 8.22.2 to 8.25.38 #75)
• a19efbe Updated readme
• 31926f7 v3.0.2
• 1114b03 Stop outputting upload-token in logs ([Snyk] Fix for 12 vulnerabilities #97)
• e903e88 v3.0.1 ([Snyk] Fix for 3 vulnerabilities #96)
• 75cc0dd package: unpin request so i stop getting these vulnerability reports ([Snyk] Fix for 1 vulnerabilities #91)
• 4a7561e add -X s3 to disable uploading to s3 ([Snyk] Security upgrade bitcore-build from 8.25.7 to 8.25.38 #84)
• 19facba Replace the `cd` command with the `pwd` option. ([Snyk] Security upgrade bcoin from 0.15.0 to 1.0.2 #85)

See the full diff

Package name: karma

The new version differs by 250 commits.

• 42933c9 chore: release v4.2.0
• db1ea57 chore: update contributors
• a1049c6 chore: update eslint packages to latest and fix complaints ([BWS] Add SHIB to rate monitor bitpay/bitcore#3312)
• 70b72a9 fix(logging): Util inspect for logging the config. (Node 12 support bitpay/bitcore#3332)
• 1087926 fix typo: (Sync Time bitpay/bitcore#3334)
• 182c04d fix(reporter): format stack with 1-based column ("Releases" link in README.md does not take user to releases bitpay/bitcore#3325)
• f0c4677 docs(travis): Correct the docs to also show how to do it on Xenial (Remove/Add bcmonitor monitored coins with config bitpay/bitcore#3316)
• 3aea7ec chore(deps): update core-js -> ^3.1.3 (Erigon ETH Node Prune settings bitpay/bitcore#3321)
• 5e11340 chore: revert back to Mocha 4 ([Libs] Upgrade LTC bech32 dep; Remove from DOGE bitpay/bitcore#3313)
• 1205bce chore(test): fix flaky test cases (bitcore-lib-doge Unhandled Rejection (Error): Assertion failed  bitpay/bitcore#3314)
• 7f40349 Cleanup dependencies ([REF] remove white space in push notification strings bitpay/bitcore#3309)
• 7828bea chore: update braces and chokidar to latest versions ([FIX] balance cache for eth bitpay/bitcore#3307)
• fe9a1dd fix(server): Add error handler for webserver socket. (Add RSK support to Bitcore Wallet Client bitpay/bitcore#3300)
• 13ed695 chore: release v4.1.0
• d844a48 chore: update contributors
• ce6825f fix(client): Only create the funky object if message is not a string (Installation procedure and general documentation is utter garbage bitpay/bitcore#3298)
• 7968db6 fix(client): Enable loading different file types when running in parent mode without iframe (Update LICENSE bitpay/bitcore#3289)
• 6556ab4 fix(launcher): Log state transitions in debug (Update LICENSE bitpay/bitcore#3294)
• 7eb48c5 fix(middleware): log invalid filetype (Open commit bitpay/bitcore#3292)
• c7ebf0b chore: release v4.0.1
• c190c4a chore: update contributors
• 375bb5e fix(filelist): correct logger name. (Multisend CWC bitpay/bitcore#3262)
• c43f584 fix: remove vulnerable dependency combine-lists (Update LICENSE bitpay/bitcore#3273)
• 4ec4f6f fix: remove vulnerable dependency expand-braces (decrease cache time to 1 min for eth/xrp bitpay/bitcore#3270)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Arbitrary Code Execution
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn