[Snyk] Fix for 1 vulnerabilities

[jadoonf]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[jadoonf]

📊 Package size report   No changes

File	Before	After
Total (Includes all files)	11.0 kB	11.0 kB
Tarball size	4.1 kB	4.1 kB

Unchanged files

File	Size
.github/workflows/explain.yml	736 B
.github/workflows/lstn.yml	432 B
.github/workflows/package-size-report.yml	536 B
.github/workflows/scanners.yml	1.0 kB
.github/workflows/test/lstn-cli-workflow.yml	2.0 kB
.github/workflows/test/lstn-dynamic.yml	378 B
.github/workflows/test/lstn-policy.yml	334 B
index.js	28 B
package.json	981 B
README.md	3.4 kB
rules.yml	1.2 kB

_{🤖 This report was automatically generated by pkg-size-action}

[github-actions]

listen.dev ∙ Security Report

critical 🚨 4

medium ⚠️ 7

low 🔷 1

🔍 The following behaviors have been detected in the dependency tree during installation

🚨 Critical severity

📑🔀	2 categories

• 📑 Metadata ∙ 1 package

  
  

  • 📦 chokidar@3.5.3 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗

    
    

    • This package has inconsistent dependencies in the tarball's package.json ∙ 1 total occurrence

      
      

      Name	Version	Transitive Dependency	Occurrences	More
      chokidar	3.5.3		1	🔗

• 🔀 Typosquatting ∙ 3 packages

  
  

  • 📦 jq@1.7.2 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗

    
    

    • The name of this package closely resembles other package names ("q") which are popular on NPM: it might be a typosquatting attempt ∙ 1 total occurrence

      
      

      Name	Version	Transitive Dependency	Occurrences	More
      jq	1.7.2		1	🔗

  • 📦 ink@3.2.0 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗

    
    

    • The name of this package closely resembles other package names ("ini") which are popular on NPM: it might be a typosquatting attempt ∙ 1 total occurrence

      
      

      Name	Version	Transitive Dependency	Occurrences	More
      ink	3.2.0		1	🔗

  • 📦 findit@2.0.0 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗

    
    

    • The name of this package closely resembles other package names ("findit2") which are popular on NPM: it might be a typosquatting attempt ∙ 1 total occurrence

      
      

      Name	Version	Transitive Dependency	Occurrences	More
      findit	2.0.0		1	🔗

---

⚠️ Medium severity

📡🔎	2 categories

• 📡 Dynamic instrumentation ∙ 1 package

  
  

  • 📦 jq@1.7.2 ∙ 4 occurrences ∙ 2 kind of issues ∙ open 🔗

    
    

    • npm install spawned a process ∙ 1 total occurrence

      
      

      Name	Version	Transitive Dependency	Occurrences	More
      contextify	0.1.15	✔️	1	🔗

    • unexpected outbound connection destination ∙ 3 total occurrences

      
      

      Name	Version	Transitive Dependency	Occurrences	More
      contextify	0.1.15	✔️	3	🔗

• 🔎 Static analysis ∙ 3 packages

  
  

  • 📦 rimraf@4.4.1 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗

    
    

    • install script detected in package.json ∙ 1 total occurrence

      
      

      Name	Version	Transitive Dependency	Occurrences	More
      rimraf	4.4.1		1	🔗

  • 📦 ink@3.2.0 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗

    
    

    • install script detected in package.json ∙ 1 total occurrence

      
      

      Name	Version	Transitive Dependency	Occurrences	More
      ink	3.2.0		1	🔗

  • 📦 glob@9.3.5 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗

    
    

    • install script detected in package.json ∙ 1 total occurrence

      
      

      Name	Version	Transitive Dependency	Occurrences	More
      glob	9.3.5		1	🔗

---

🔷 Low severity

📑	1 category

• 📑 Metadata ∙ 1 package

  
  

  • 📦 source-map-support@0.5.21 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗

    
    

    • This package version is 0.X.Y: the semver spec mandates those versions for initial development meaning that anything may change at any time and the public API of this package should not be considered stable. ∙ 1 total occurrence

      
      

      Name	Version	Transitive Dependency	Occurrences	More
      source-map-support	0.5.21		1	🔗

---

### 🚩 Some problems have been encountered

🔗 Package not analysed yet ∙ 1 occurrence ∙ Package not analysed yet

• @types/react@17.0.71

See docs 🔗

---

Powered by listen.dev