HeroDevs ARP remediation (run 1785503532881)

[nes-auto-remediation-dev]

Your HeroDevs GitHub integration scanned all 2,072 dependencies in this repo for end-of-life and vulnerable packages. Here's what it found: 23 dependencies are swapped to secured versions below. 87 more are being actively patched by our engineers right now. 2 already have a version-bump PR open for your review below.

---

✅ 23 dependencies secured — replaced with patched versions

These were already on the HeroDevs fork point, so we swapped them straight to secured versions. Your code still imports them under the same names — we just pointed package.json at each HeroDevs-secured @neverendingsupport version below, so nothing in your code changes.

Package	Previous version	HeroDevs secured version
ip	1.1.9	1.1.9-ip-1.1.10
http-proxy-middleware	0.19.2	0.19.2-http-proxy-middleware-0.19.4
webpack-dev-middleware	3.7.3	3.7.3-webpack-dev-middleware-3.7.4
elliptic	6.6.1	6.6.1-elliptic-6.6.3
@angular/compiler	9.1.13	9.1.13-angular-9.1.24
@angular/core	9.1.13	9.1.13-angular-9.1.24
@angular/animations	12.2.17	12.2.17-angular-12.3.8
@angular/core	12.2.17	12.2.17-angular-12.3.8
@angular/common	12.2.17	12.2.17-angular-12.3.8
@angular/compiler	12.2.17	12.2.17-angular-12.3.8
@angular/forms	12.2.17	12.2.17-angular-12.3.8
@angular/platform-browser	12.2.17	12.2.17-angular-12.3.8
@angular/platform-browser-dynamic	12.2.17	12.2.17-angular-12.3.8
@angular/platform-server	12.2.17	12.2.17-angular-12.3.7
@angular/router	12.2.17	12.2.17-angular-12.3.8
@angular-devkit/build-angular	12.2.18	12.2.18-angular-cli-12.2.22
@angular/compiler-cli	12.2.17	12.2.17-angular-12.3.8
@angular-devkit/core	12.2.18	12.2.18-angular-cli-12.2.22
@ngtools/webpack	12.2.18	12.2.18-angular-cli-12.2.22
@angular-devkit/core	12.2.18	12.2.18-angular-cli-12.2.22
@angular/cli	12.2.18	12.2.18-angular-cli-12.2.22
@angular-devkit/schematics	12.2.18	12.2.18-angular-cli-12.2.22
@angular/language-service	12.2.17	12.2.17-angular-12.3.8

---

🕐 87 dependencies in progress — HeroDevs engineers are actively patching

These 87 carry a known vulnerability with no drop-in yet. HeroDevs engineers are building, testing, and verifying a secured version for each one. Once a fix is ready we verify it against your installed version and ship it automatically.

Package	Version	CVEs	Highest severity
lodash	4.17.21	2	High (7.2)
semver	5.7.1	1	Medium (5.3)
brace-expansion	1.1.11	4	High (7.5)
request	2.88.2	1	Medium (6.1)
form-data	2.3.3	2	High (7.5)
ajv	6.12.6	1	Low (2.9)
tough-cookie	2.5.0	1	Medium (6.5)
uuid	3.4.0	1	High (7.5)
cookie	0.4.1	1	Not scored
on-headers	1.0.2	1	Low (3.4)
ws	7.4.6	2	High (7.5)
word-wrap	1.2.3	1	Medium (5.3)
got	9.6.0	1	Medium (5.3)
cipher-base	1.0.4	1	Critical (9.1)
sha.js	2.4.11	1	Critical (9.1)
browserify-sign	4.2.1	1	Medium (6.5)
bn.js	4.12.0	1	Medium (5.3)
pbkdf2	3.1.2	2	Not scored
@tootallnate/once	1.1.2	1	Low (3.3)
tmp	0.0.33	2	Low (2.5)
picomatch	2.3.1	2	High (7.5)
braces	3.0.2	1	High (7.5)
js-yaml	4.1.0	3	High (7.5)
cross-spawn	7.0.3	1	High (7.5)
micromatch	3.1.10	1	Medium (5.3)
diff	4.0.2	1	Not scored
serialize-javascript	6.0.0	3	High (8.1)
tar	6.1.11	13	High (8.8)
http-cache-semantics	4.1.0	1	Medium (5.3)
loader-utils	1.4.0	3	Critical (9.8)
json5	1.0.1	1	High (7.1)
shell-quote	1.7.3	2	High (8.1)
decode-uri-component	0.2.0	1	High (7.5)
terser	4.8.0	1	Medium (5.3)
debug	4.1.1	1	Medium (5.3)
postcss	7.0.39	4	High (7.5)
svgo	1.3.2	1	High (8.2)
nth-check	1.0.2	1	High (7.5)
xml2js	0.4.23	1	Medium (5.3)
webpack-dev-server	3.11.2	6	Medium (6.5)
ansi-html	0.0.7	1	High (7.5)
node-forge	0.10.0	13	High (8.6)
websocket-driver	0.7.4	2	Not scored
@babel/core	7.14.8	1	Low (3.2)
@babel/runtime	7.14.8	1	Medium (6.2)
yaml	1.10.2	1	Medium (4.3)
minimatch	3.0.4	4	High (7.5)
piscina	3.1.0	1	High (8.1)
webpack	5.50.0	4	Critical (9.8)
axios	0.21.4	23	High (8.6)
lodash.pick	4.4.0	1	High (7.4)
path-to-regexp	0.1.7	2	High (7.5)
jszip	3.7.1	1	High (7.3)
minimist	1.2.5	1	Critical (9.8)
@babel/plugin-transform-modules-systemjs	7.16.7	1	High (8.2)
nanoid	3.2.0	1	Medium (4.3)
qs	6.5.2	2	High (7.5)
prismjs	1.27.0	1	Medium (4.9)
handlebars	4.7.7	8	Critical (9.8)
@cypress/request	2.88.10	1	Medium (6.1)
ansi-regex	3.0.0	1	High (7.5)
async	2.6.3	1	High (7.8)
express	4.17.1	2	Medium (6.1)
body-parser	1.19.0	2	High (7.5)
send	0.17.1	1	Medium (5)
serve-static	1.14.1	1	Medium (5)
eventsource	1.1.0	1	High (8.1)
adm-zip	0.4.16	1	High (7.5)
esbuild	0.12.24	1	Medium (5.3)
tar-fs	2.0.0	3	High (7.5)
follow-redirects	1.14.8	3	High (7.3)
ejs	3.1.6	2	Critical (9.8)
@babel/helpers	7.16.7	1	Medium (6.2)
node-fetch	2.6.1	1	High (8.8)
@babel/traverse	7.16.7	1	Critical (9.3)
@sideway/formula	3.0.0	1	Medium (5.5)
flatted	3.2.4	2	High (7.5)
joi	17.5.0	1	Medium (5.3)
playwright	1.17.1	1	Medium (5.3)
jpeg-js	0.4.3	1	High (7.5)
rollup	2.63.0	2	Medium (6.1)
url-parse	1.5.7	2	Medium (6.5)
@babel/runtime-corejs3	7.16.7	1	Medium (6.2)
@octokit/request	5.6.2	1	Medium (5.3)
@octokit/request-error	2.1.0	1	Medium (5.3)
@octokit/plugin-paginate-rest	2.17.0	1	Medium (5.3)
simple-git	2.48.0	6	Critical (9.8)

---

🔧 2 dependencies need your review — HeroDevs already opened the version bumps

These 2 dependencies have a newer patch release available (same major and minor, so no breaking changes). We opened a separate pull request for each one below. Review, test, and merge each PR.

Package	Your version	Patch version	Pull request
is-accessor-descriptor	1.0.0	1.0.1	#3
is-data-descriptor	1.0.0	1.0.1	#4

---

Additionally, HeroDevs is continuously monitoring 836 other end-of-life dependencies in this repository that have no known vulnerability today. The moment one is exploited, our engineers will build, test, and push a secured version automatically.

---

What changed

• package.json: 23 packages aliased to their @neverendingsupport secured versions
• package-lock.json: regenerated against HeroDevs-resolved versions

Opened automatically by HeroDevs