[Snyk] Fix for 2 vulnerabilities

[Fadyio]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • backend/package.json
  • backend/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: passport-auth0

The new version differs by 37 commits.

• 3fe9208 Release v1.4.1 (#147)
• 7e5bd48 Fix build status badge (#145)
• 1aaf257 [SDK-2811] Replace request with axios (#144)
• 53dc43e Run CI on Node 12, 14 and 16 (#143)
• 45a3d21 Run npm audit fix (#142)
• 3feaf0f fix: upgrade request from 2.88.0 to 2.88.2 (#140)
• 4927efb fix: upgrade passport-oauth2 from 1.5.0 to 1.6.0 (#141)
• fb0608d Merge pull request #139 from auth0/circleci-project-setup
• ecec81e Migrate to CircleCI
• 1920790 Update lock file - ajv (#138)
• 7a672c8 Merge pull request #136 from auth0/add-templates
• 77f1ec9 Update config.yml
• 52b5dc7 Setup pull-request and issue templates
• 8fd4b15 Merge pull request #135 from auth0/davidpatrick-patch-1
• 684fbb6 README Update with Maintenance Advisory
• f19e222 Merge pull request #134 from auth0/add-templates
• f3b1214 update issue template config.yml
• e7faa31 Setup pull-request and issue templates
• 97da27d Merge pull request #133 from auth0/add-codeowners-eng
• 81ce782 Setup the CODEOWNERS for pull request reviews
• 6b715cf Merge pull request #132 from auth0/release-1.4.0
• 34c855a Release v1.4.0
• c453513 Merge pull request #131 from alexbjorlig/allow-extra-params
• 0b7f58e Merge branch 'master' into allow-extra-params

See the full diff

Package name: winston-loggly-bulk

The new version differs by 53 commits.

• 9f925a1 Merge pull request [Snyk] Security upgrade typeorm from 0.3.14 to 0.3.18 #93 from loggly/temp-gold
• 103a756 G1C-1760 Update package version
• 7e208a5 Fix
• 2ccecb6 3.2.1
• 435d36d LOG-10856 upgrade node-loggly-bulk ([Snyk] Upgrade: react, react-dom #75)
• 1af15d6 3.2.0
• 35c54ed LOG-11499 update dependencies for security reasons ([Snyk] Upgrade @types/react-datepicker from 2.3.0 to 2.11.1 #74)
• c058aff 3.1.1
• 632e8f2 Merge pull request build(deps): bump moment-timezone from 0.5.28 to 0.5.35 in /backend #66 from alfasin/master
• c56320e Print an error to console when fails to deliver a log event to Loggly
• 2542c24 Merge pull request Bump qs from 6.5.2 to 6.5.3 in /backend #59 from loggly/LOG-8039-update
• cc945fa set version stable
• 6653450 update version
• 7f45e1b update readme
• a46d63c fix "details" prop duplicity
• bc2a7ba code cleaning
• 32d20ec fix empty details
• 65d4270 redo tests
• 644466d use lodash.clonedeep instead of clone
• 583e02e fix sending splats
• 95225d9 update version
• efb5a49 code cleaning
• 3d9ca73 remove legacy code
• 8df87fe Merge remote-tracking branch 'origin/master' into LOG-8039-update

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)
🦉 Prototype Pollution