[Snyk] Fix for 5 vulnerabilities

[schalla0791]

Snyk has created this PR to fix 5 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	696
	Improper Input Validation SNYK-JS-FOLLOWREDIRECTS-6141137	686
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	646
	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	646
	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	631

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Input Validation
🦉 Regular Expression Denial of Service (ReDoS)

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"@kubernetes/client-node","from":"0.18.1","to":"0.21.0"},{"name":"axios","from":"1.3.4","to":"1.6.8"},{"name":"nodemon","from":"2.0.21","to":"3.0.0"}],"env":"prod","issuesToFix":[{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-FOLLOWREDIRECTS-6141137","priority_score":686,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Input Validation"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-FOLLOWREDIRECTS-6444610","priority_score":646,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Information Exposure"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-INFLIGHT-6095116","priority_score":631,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.2","score":310},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Missing Release of Resource after Effective Lifetime"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-SEMVER-3247795","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-TAR-6476909","priority_score":646,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Uncontrolled Resource Consumption ('Resource Exhaustion')"}],"prId":"8c348480-9601-4ea5-8f32-4431d8b6b136","prPublicId":"8c348480-9601-4ea5-8f32-4431d8b6b136","packageManager":"npm","priorityScoreList":[686,646,631,696,646],"projectPublicId":"ce7b5151-662f-4c28-a5d6-0076f442e07f","projectUrl":"https://app.snyk.io/org/intelops/project/ce7b5151-662f-4c28-a5d6-0076f442e07f?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["priorityScore"],"type":"auto","upgrade":["SNYK-JS-FOLLOWREDIRECTS-6141137","SNYK-JS-FOLLOWREDIRECTS-6444610","SNYK-JS-INFLIGHT-6095116","SNYK-JS-SEMVER-3247795","SNYK-JS-TAR-6476909"],"vulns":["SNYK-JS-FOLLOWREDIRECTS-6141137","SNYK-JS-FOLLOWREDIRECTS-6444610","SNYK-JS-INFLIGHT-6095116","SNYK-JS-SEMVER-3247795","SNYK-JS-TAR-6476909"],"patch":[],"isBreakingChange":true,"remediationStrategy":"vuln"}'

[dryrunsecurity]

DryRun Security Summary

This pull request updates the dependencies of the project, including the @kubernetes/client-node, axios, and nodemon packages, to address known security vulnerabilities and improve the overall security and stability of the application.

Expand for full summary

Summary:

The changes in this pull request are focused on updating the dependencies of the project, including the @kubernetes/client-node, axios, and nodemon packages. These updates are generally positive from an application security perspective, as they can address known security vulnerabilities and improve the overall security and stability of the application.

The update to the @kubernetes/client-node dependency is particularly important, as this library is used to interact with the Kubernetes API. Keeping this dependency up-to-date is crucial to ensure the application can take advantage of the latest security features and bug fixes in the Kubernetes API client. The updates to the axios library, which is a popular HTTP client used in many Node.js applications, are also a good practice to adopt.

While these dependency updates are generally a positive change, it's important to review the release notes and changelogs of the updated dependencies to ensure there are no known security vulnerabilities or breaking changes that could impact the application. Additionally, the application should be thoroughly tested to ensure the updates do not introduce any unintended consequences or regressions.

Files Changed:

1. package.json: The version of the @kubernetes/client-node dependency has been updated from ^0.18.1 to ^0.21.0, the axios dependency has been updated from ^1.3.4 to ^1.6.8, and the nodemon development dependency has been updated from ^2.0.21 to ^3.0.0.
2. package-lock.json: This file has been updated to reflect the changes in the package.json file, including the updates to the @kubernetes/client-node, axios, and nodemon dependencies.

Code Analysis

We ran 9 analyzers against 2 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.