[Snyk] Upgrade minimist from 1.2.5 to 1.2.8

[mikr13]

Snyk has created this PR to upgrade minimist from 1.2.5 to 1.2.8.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 3 versions ahead of your current version.

• The recommended version was released 3 years ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PARSELINKHEADER-1582783	479	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	479	Proof of Concept
	Prototype Pollution SNYK-JS-UTILE-8706797	479	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	479	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	479	Proof of Concept
	Prototype Pollution SNYK-JS-ASYNC-2441827	479	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-1579269	479	Proof of Concept
	Cross-site Request Forgery (CSRF) SNYK-JS-AXIOS-6032459	479	Proof of Concept
	Excessive Platform Resource Consumption within a Loop SNYK-JS-BRACES-6838727	479	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	479	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	479	Proof of Concept
	Improper Handling of Extra Parameters SNYK-JS-FOLLOWREDIRECTS-6141137	479	Proof of Concept
	Prototype Pollution SNYK-JS-LODASHSET-1320032	479	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	479	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	479	Proof of Concept
	Code Injection SNYK-JS-SNYKGRADLEPLUGIN-8248487	479	No Known Exploit
	Code Injection SNYK-JS-SNYKPHPPLUGIN-8248485	479	No Known Exploit
	Command Injection SNYK-JS-SSH2-1656673	479	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579152	479	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579155	479	No Known Exploit
	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	479	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	479	No Known Exploit
	Symlink Attack SNYK-JS-TMP-11501554	479	Proof of Concept
	Prototype Pollution SNYK-JS-XML2JS-5414874	479	Proof of Concept
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-12613773	479	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-6124857	479	Proof of Concept
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-9292519	479	Proof of Concept
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-9403194	479	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-DIFF-14917201	479	Proof of Concept
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-2332181	479	Proof of Concept
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	479	Proof of Concept
	Open Redirect SNYK-JS-GOT-2932019	479	No Known Exploit
	Open Redirect SNYK-JS-GOT-2932019	479	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	479	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-I-1726768	479	No Known Exploit
	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	479	Proof of Concept
	Prototype Pollution SNYK-JS-JSYAML-13961110	479	No Known Exploit
	Prototype Pollution SNYK-JS-JSYAML-13961110	479	No Known Exploit
	Arbitrary File Write via Archive Extraction (Zip Slip) SNYK-JS-JSZIP-3188562	479	No Known Exploit
	Arbitrary File Write via Archive Extraction (Zip Slip) SNYK-JS-JSZIP-3188562	479	No Known Exploit
	Prototype Pollution SNYK-JS-LODASH-15053838	479	No Known Exploit
	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	479	No Known Exploit
	Command Injection SNYK-JS-SNYK-3037342	479	Proof of Concept
	Command Injection SNYK-JS-SNYK-3038622	479	Proof of Concept
	Code Injection SNYK-JS-SNYK-3111871	479	No Known Exploit
	Command Injection SNYK-JS-SNYKDOCKERPLUGIN-3039679	479	Proof of Concept
	Command Injection SNYK-JS-SNYKGOPLUGIN-3037316	479	Proof of Concept
	Command Injection SNYK-JS-SNYKGRADLEPLUGIN-3038624	479	Proof of Concept
	Command Injection SNYK-JS-SNYKMVNPLUGIN-3038623	479	Proof of Concept
	Command Injection SNYK-JS-SNYKPYTHONPLUGIN-3039677	479	Proof of Concept
	Command Injection SNYK-JS-SNYKSBTPLUGIN-3038626	479	Proof of Concept
	Command Injection SNYK-JS-SNYKSNYKCOCOAPODSPLUGIN-3038625	479	Proof of Concept
	Command Injection SNYK-JS-SNYKSNYKHEXPLUGIN-3039680	479	Proof of Concept
	Directory Traversal SNYK-JS-TAR-15032660	479	Proof of Concept
	Improper Handling of Unicode Encoding SNYK-JS-TAR-15038581	479	Proof of Concept
	Directory Traversal SNYK-JS-TAR-15127355	479	No Known Exploit
	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	479	Proof of Concept
	Symlink Attack SNYK-JS-TMP-11501554	479	Proof of Concept
	Symlink Attack SNYK-JS-TMP-11501554	479	Proof of Concept
	Prototype Pollution SNYK-JS-MINIMIST-2429795	479	Proof of Concept
	Uninitialized Memory Exposure npm:utile:20180614	479	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	479	Proof of Concept
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-2396346	479	No Known Exploit
	Insertion of Sensitive Information into Log File SNYK-JS-SNYK-10497607	479	Proof of Concept

Release notes

Package name: minimist

• 1.2.8 - 2023-02-09
  

  v1.2.8

• 1.2.7 - 2022-10-11
  

  v1.2.7

• 1.2.6 - 2022-03-22
  

  v1.2.6

• 1.2.5 - 2020-03-12
  

  v1.2.5

from minimist GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[Copilot]

Pull request overview

This is an automated security upgrade PR from Snyk that updates the minimist package from version 1.2.5 to 1.2.8 to address multiple security vulnerabilities, primarily prototype pollution issues. The upgrade spans 3 patch versions released between March 2022 and February 2023.

Changes:

• Updated minimist dependency from ^1.2.5 to ^1.2.8 in package.json
• Updated package-lock.json to reflect minimist 1.2.8

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The package.json has been updated to minimist 1.2.8, and package-lock.json reflects this change correctly. However, yarn.lock still references minimist 1.2.5. This inconsistency between lock files means that users installing with yarn will still get the vulnerable version 1.2.5, defeating the purpose of this security upgrade. The yarn.lock file needs to be regenerated using yarn install or yarn upgrade minimist@^1.2.8 to ensure consistency across package managers.