[Snyk] Fix for 1 vulnerabilities

[jwlh]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-LODASH-6139239	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: newrelic

The new version differs by 250 commits.

• f35a229 release: 6.5.0 (2020-03-19)
• 5779e3c Updated release notes
• 435d053 Merge pull request #1969 from NodeJS-agent/ntzaperas/attribute-rename
• 3d0dbd2 Rename span error attribute
• a01821f Fix span error attributes appearing on span intrinsics
• 76e0572 Updated changelog for v6.5.0.
• cd9406c Merge pull request #1966 from NodeJS-agent/ntzaperas/lasp-span-errors
• bfb2e70 Remove span_error_attributes feature flag
• 613a285 Test span error attributes and HSM/ignore
• a4ac95b Merge pull request #1964 from NodeJS-agent/mgoin/ConvertAgentAggregatorsUnitTests
• 2de8843 Merge pull request #1959 from NodeJS-agent/mgoin/ConvertAgentsUnitTestFullyTap
• 3f53da6 Converts event-aggregator.test.js to fully use tap API.
• e339089 Use the same attributes on spans as on TransactionErrors
• 0166c8a Span error attributes should adhere to security policy
• de2658d Converts base-aggregator.test.js to fully use tap API.
• 1e036e5 Converts synthetics.test.js to fully use tap API.
• 6d75845 Converts intrinsics.test.js to fully use tap API.
• 8c43fc6 Converts agent.test.js to fully use tap API.
• ade4dc3 Merge pull request #1957 from NodeJS-agent/ntzaperas/NODE-2307-error-attrs-on-spans
• 2ce89a6 Put span error attributes behind a feature flag
• 9013e0f Tests for span error attributes
• 64c6d47 Update tests to match new error interface
• ecae7a2 Add error info to span and link to TransactionError events
• 233e48e Merge pull request #1956 from NodeJS-agent/mgoin/NODE-2314-EventHandlersNotCleaningUp

See the full diff

Package name: request-promise

The new version differs by 28 commits.

• 4bc186d Version 4.2.6
• 4c7d51d chore: bumped request-promise-core due to security vulnerability of lodash
• f364ee4 docs: reference to request deprecation and alternative libs
• 873d156 Merge pull request #341 from shisama/patch-1
• 052331d docs: deprecate this package
• b4dafe4 docs: fixed link
• fd52247 Version 4.2.5
• a27ba86 chore: updated request-promise-core that updates lodash
• 4e3b7ed Version 4.2.4
• 94be6fe fix: tough-cookie version
• 03f7030 chore: updated publish-please config
• d831905 Version 4.2.3 (now really)
• 37e8773 fix: updated indirect lodash dependency to fix security vulnerability
• 229225e Version 4.2.3
• 4f27097 chore: fix ci build for node v8+
• c535eb6 Merge pull request #299 from aomdoa/fixToughCookieDep
• 488947b Merge branch 'master' into fixToughCookieDep
• 131abd7 fix: breaking change in tough-cookie v3
• b454ddc chore: added node 8 and 10 to ci build
• 6d11ddc fix: typo
• 3a136ea Merge pull request #303 from lexjacobs/patch-1
• 5e32191 docs: mention of wrapped request errors
• 2ac4f3e Update rp.js
• 1457338 Workaround on the cookie processing test.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution