[Snyk] Upgrade pacote from 11.2.3 to 11.3.5

[DewaldV]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade pacote from 11.2.3 to 11.3.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 10 versions ahead of your current version.
• The recommended version was released 2 years ago, on 2021-07-02.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Arbitrary File Write SNYK-JS-TAR-1579155	425/1000 Why? CVSS 8.5	No Known Exploit
	Arbitrary File Overwrite SNYK-JS-TAR-1536528	425/1000 Why? CVSS 8.5	No Known Exploit
	Arbitrary File Overwrite SNYK-JS-TAR-1536531	425/1000 Why? CVSS 8.5	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579147	425/1000 Why? CVSS 8.5	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579152	425/1000 Why? CVSS 8.5	No Known Exploit
	Command Injection SNYK-JS-NPMCLIGIT-1536784	425/1000 Why? CVSS 8.5	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	425/1000 Why? CVSS 8.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: pacote

• 11.3.5 - 2021-07-02
  

  11.3.5

• 11.3.4 - 2021-06-02
  

  11.3.4

• 11.3.3 - 2021-04-23
  

  11.3.3

• 11.3.2 - 2021-04-22
  

  11.3.2

• 11.3.1 - 2021-03-22
  

  11.3.1

• 11.3.0 - 2021-03-08
  

  11.3.0

• 11.2.7 - 2021-02-18
  

  11.2.7

• 11.2.6 - 2021-02-05
  

  11.2.6

• 11.2.5 - 2021-02-04
  

  11.2.5

• 11.2.4 - 2021-02-01
  

  11.2.4

• 11.2.3 - 2021-01-20

from pacote GitHub release notes

Commit messages

Package name: pacote

• 3557b0e 11.3.5
• e7e6f0d Merge pull request Bump got from 10.7.0 to 12.5.3 joebowbeer/regsync#84 from npm/lk/handle-pathspec-error
• ac56329 Merge pull request Bump @babel/preset-env from 7.16.11 to 7.20.2 joebowbeer/regsync#80 from npm/isaacs/unpack-no-mtime
• 7660b0b Merge pull request Bump @babel/core from 7.17.5 to 7.20.2 joebowbeer/regsync#81 from npm/isaacs/include-all-dep-types-when-preparing
• c76c279 rethrow git pathspec errors when cloning from a hosted service
• 6ad9ede Merge pull request Bump babel-jest from 26.6.3 to 29.3.0 joebowbeer/regsync#82 from npm/lk/handle-git-errors
• c285551 @ npmcli/git@2.1.0, update tests to work with latest hosted-git-info
• 0328fe0 fix: do not do dry-run/package-lock installs for preparation
• b76f51a fix: include all dep types when building for prepare
• 2ed5b64 fix: do not set mtime when unpacking
• 745265a 11.3.4
• bec3715 npm-registry-fetch@11.0.0
• 9629c64 11.3.3
• d97e2fb Merge pull request Bump yargs from 16.2.0 to 17.6.1 joebowbeer/regsync#78 from npm/gar/normalize-manifest
• 14264d2 fix(registry): normalize registry manifests
• 42e977a 11.3.2
• 4311985 update tap, test on node 16
• e0128a7 npm-registry-fetch@10.0.0
• 500a34f Cache the tarballs in pacote
• 99738cd tap@15, remove require-inject
• 1430efa reinstall with latest npm v7
• ad54e6d 11.3.1
• 143a0b9 fix: force gzip compression level to 9 (Bump yargs from 16.2.0 to 17.6.0 joebowbeer/regsync#71)
• fef420c 11.3.0

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs