[Snyk] Fix for 1 vulnerabilities

[ajesse11x]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	551/1000 Why? Recently disclosed, Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gulp-autoprefixer

The new version differs by 13 commits.

• ede5a11 8.0.0
• a953087 Require Node.js 12 and upgrade dependencies
• 87ff53d Move to GitHub Actions (#117)
• c5e7214 7.0.1
• da50fd2 Make Gulp an optional peer dependency
• 40fba84 7.0.0
• ab49120 Require Node.js 8 and Gulp 4
• 83cc576 Enable the repo sponsor button
• adec1a7 6.1.0
• 7b080bf Upgrade dependencies
• dfe3919 6.0.0
• c225cbd Upgrade `autoprefixer` and `postcss`
• ea0b7f8 Require Node.js 6

See the full diff

Package name: understrap

The new version differs by 250 commits.

• 1a9747b Merge pull request #1279 from understrap/release/0.9.6
• a2d77e7 Merge pull request #1273 from schnoggo/master
• 032d711 Updates version umber and changelog.
• 2169a04 Merge remote-tracking branch 'remotes/origin/includes' into release/0.9.6
• b67af17 Use get_theme_file_path() to make include files child theme friendly.
• a415b82 Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/ua-parser-js-0.7.28' into update/dependencies
• 5033d8a Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/lodash-4.17.21' into update/dependencies
• a504ac2 Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/hosted-git-info-2.8.9' into update/dependencies
• c53120c Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/postcss-8.2.10' into update/dependencies
• 78ed1e1 Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/browserslist-4.16.6' into update/dependencies
• b40ada9 Merge remote-tracking branch 'remotes/origin/dependabot/npm_and_yarn/ws-7.4.6' into update/dependencies
• dc0f6e0 Make the credits links https.
• 2b7720e Merge pull request #1270 from understrap/point-release
• 9789232 increments version number.
• 60fff40 Bump ws from 7.4.3 to 7.4.6
• c7990df Bump browserslist from 4.16.1 to 4.16.6
• 78da2f7 Bump postcss from 8.2.9 to 8.2.10
• 8f761fc Bump hosted-git-info from 2.8.8 to 2.8.9
• 068e3af Bump lodash from 4.17.20 to 4.17.21
• 0dc4cc1 Bump ua-parser-js from 0.7.23 to 0.7.28
• 44edc3d Merge pull request #1251 from IanDelMar/deps
• 6f7e7dd Bump @ babel/preset-env from 7.13.12 to 7.13.15
• aa35e25 Bump @ babel/core from 7.13.14 to 7.13.15
• 34c6599 Bump squizlabs/php_codesniffer from 3.5.8 to 3.6.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Input Validation