[Snyk] Upgrade chalk from 2.1.0 to 2.4.2

[karencapiiro]

Snyk has created this PR to upgrade chalk from 2.1.0 to 2.4.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 8 versions ahead of your current version.

• The recommended version was released 7 years ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[karencapiiro]

This is a minor version upgrade for chalk from 2.1.0 to 2.4.2. The changes within this range consist of bug fixes and minor, backward-compatible feature additions. No breaking changes or deprecations have been documented for this version span, and no developer action is required for this upgrade.

Source: Package documentation

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[martinSaad]

⛔ Snyk checks have failed. 402 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (402)
⛔	Open Source Security	27	239	115	21	402 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[karencapiiro]

Checkmarx One – Scan Summary & Details – fa88ff68-7d09-4350-9349-6d876ac93440

---

New Issues (395)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2026-0905	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Insufficient policy enforcement in the Network in Google Chrome prior to 144.0.7559.59 allowed an attacker who obtained a network log file to poten... Attack Vector: NETWORK Attack Complexity: LOW ID: xdBIIJTSFOk0hBrfhOHtOT5rLfbl9ysgbxaou0OPmCY%3D Vulnerable Package
2		CVE-2026-0906	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) ... Attack Vector: NETWORK Attack Complexity: LOW ID: w2iuwEKd4RdG81EFBLZPhr68PLicCdRAakWn%2B11dWo8%3D Vulnerable Package
3		CVE-2026-0907	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Attack Vector: NETWORK Attack Complexity: LOW ID: Rfi9%2FKEsrWzKLBp91GAwHKUVY0IOHZaVABR85njh9PA%3D Vulnerable Package
4		CVE-2026-11671	Npm-electron-23.1.2	details Recommended version: 40.10.5 Description: Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a craft... Attack Vector: NETWORK Attack Complexity: LOW ID: 809TNko1EJLBvzRKmTiG%2BUhLl0cysxPYxxtt%2Bx6%2Fk1g%3D Vulnerable Package
5		CVE-2026-1525	Npm-undici-5.22.1	details Recommended version: 6.24.0 Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v... Attack Vector: NETWORK Attack Complexity: LOW ID: ap9N0cZwfXoDD20aKRGSeYeunDg6ZTXeXQWVcU0o1xs%3D Vulnerable Package
6		CVE-2026-1525	Npm-undici-5.20.0	details Recommended version: 6.24.0 Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v... Attack Vector: NETWORK Attack Complexity: LOW ID: TpflYBIk8490OGA5rSuEskezmSO0ERVFBzAD70JYqQ4%3D Vulnerable Package
7		CVE-2026-3061	Npm-electron-23.1.2	details Recommended version: 41.0.0 Description: Out-of-bounds Read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafte... Attack Vector: NETWORK Attack Complexity: LOW ID: o56T7mPrvTG2MpJ61F%2FxFBOL%2BVU2LZhlPFqFx%2Fk8Bl0%3D Vulnerable Package
8		CVE-2026-3062	Npm-electron-23.1.2	details Recommended version: 41.0.0 Description: Out-of-bounds Read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory acce... Attack Vector: NETWORK Attack Complexity: LOW ID: VYDXWYSruEk467ryMio4PwRtCyS4I9GeJiV1DYKzWGU%3D Vulnerable Package
9		CVE-2026-33896	Npm-node-forge-1.3.1	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW ID: HLwxnjtOdkKq1OrabRHdJhrVjAyfCyrKFD593rJK4jE%3D Vulnerable Package
10		CVE-2026-33896	Npm-node-forge-0.7.6	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW ID: MiFqY2YBEgzOAK3Uhb%2FE%2F1d9gLCaB1%2FLTQXjVmGIZdc%3D Vulnerable Package
11		CVE-2026-33896	Npm-node-forge-0.6.33	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW ID: nO2W8QzFSHn5Z6u9uIDdmTC7oIGnsxX8KNNb6R0RBIg%3D Vulnerable Package
12		CVE-2026-33896	Npm-node-forge-0.10.0	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW ID: zA6%2FleD8HqlGm0ZM50jl04NLbMqmb1%2BnkXC5rOyHO2E%3D Vulnerable Package
13		CVE-2026-33937	Npm-handlebars-4.5.3	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW ID: gjQw8sPWBbc0NPFOXhn7GFkbOEnCpPn98wG6Nq8J5lA%3D Vulnerable Package
14		CVE-2026-33937	Npm-handlebars-4.7.6	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW ID: lSRwz2%2BXy4NbFUTojZw7vmmrClCizlywTJNVTf5euwM%3D Vulnerable Package
15		CVE-2026-33937	Npm-handlebars-4.7.7	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW ID: SzxbxexCAty0UMTOe5v0UZO3aUFiz%2Btp0A2Eop5T59Q%3D Vulnerable Package
16		CVE-2026-34775	Npm-electron-23.1.2	details Recommended version: 38.8.6 Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.x prior to 39.... Attack Vector: NETWORK Attack Complexity: LOW ID: 5b9mdNbCI0Tu1GcTDrb5kIKmiHHSGhggDlIrqMUAtJU%3D Vulnerable Package
17		CVE-2026-3545	Npm-electron-23.1.2	details Recommended version: 40.10.6 Description: Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox esca... Attack Vector: NETWORK Attack Complexity: LOW ID: ijf%2BwuQSj6LRUcwmLCUtW7n%2FOuqiVJY0NXF03PCv6Uo%3D Vulnerable Package
18		CVE-2026-3916	Npm-electron-23.1.2	details Recommended version: 41.0.1 Description: Out-of-bounds Read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a cr... Attack Vector: NETWORK Attack Complexity: LOW ID: SZZaK9HceOBOnavwfT1GLcNVLHvGu4hXYNi4c0tVZjw%3D Vulnerable Package
19		CVE-2026-4800	Npm-lodash-4.17.20	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW ID: h0qcESzV3JBKgrjzDLlHZINwES0rZMfJ5c%2Ft%2Fit16IA%3D Vulnerable Package
20		CVE-2026-4800	Npm-lodash-4.17.21	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW ID: Jmm9KhWyDHSAA3VWfc6TXq9MtWSbUi0apRquT6Up4Q8%3D Vulnerable Package
21		CVE-2026-4800	Npm-lodash-4.17.4	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW ID: kGUuzhq1%2FTkXIt8TUFzWBp5lesLlRtnbmJvnU7pnFhU%3D Vulnerable Package
22		CVE-2026-4800	Npm-lodash-4.17.15	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW ID: sEuBjmernEmRxc6zPZEC6T36Y3YUYLTcJ6rarNo0ebw%3D Vulnerable Package
23		CVE-2026-4800	Npm-lodash-4.17.11	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW ID: ta0NLNESfHfgOOBK1MHYaxTesrZXlfqjUAcqkbT%2FMVw%3D Vulnerable Package
24		CVE-2026-5288	Npm-electron-23.1.2	details Recommended version: 41.2.0 Description: Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to... Attack Vector: NETWORK Attack Complexity: LOW ID: ARIJGqa4GR2YNvyEFz64MP9gnCAuYEyhafmGsmKZDnE%3D Vulnerable Package
25		CVE-2026-9277	Npm-shell-quote-1.6.1	details Recommended version: 1.8.4 Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc... Attack Vector: NETWORK Attack Complexity: LOW ID: 7Bc3B7U4x28KSu1Z3Nf4v8xkE09PKw4P3jgvkxVTKFQ%3D Vulnerable Package
26		CVE-2026-9277	Npm-shell-quote-1.7.1	details Recommended version: 1.8.4 Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc... Attack Vector: NETWORK Attack Complexity: LOW ID: gRWPc6Ut4E7cy68%2B7nvp5gitkg86x%2FTDojOkSMkM%2B%2FU%3D Vulnerable Package
27		CVE-2026-9277	Npm-shell-quote-1.8.1	details Recommended version: 1.8.4 Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc... Attack Vector: NETWORK Attack Complexity: LOW ID: TyFDp8CtoFJHuAhZMZQgfqJwqBbmFn%2FTho3s89Ygp9s%3D Vulnerable Package
28		CVE-2026-9277	Npm-shell-quote-1.7.3	details Recommended version: 1.8.4 Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc... Attack Vector: NETWORK Attack Complexity: LOW ID: XONal%2F4V1%2FVAumRm%2Bvu1RvngEjiLa1KwAfq5s7Ve5Sg%3D Vulnerable Package
29		Cx0a53ef16-dcb9	Npm-react-devtools-shared-0.0.1	details Description: This package was manually inspected by a security researcher and flagged as malicious ### About Classifying malicious packages is an internal proc... ID: bkVQcS3BfbGqVMPm7rCIJLHEoWERm8sJ35U%2FHpppsN4%3D Vulnerable Package
30		CVE-2023-1220	Npm-electron-23.1.2	details Recommended version: 24.0.0 Description: Heap-based Buffer Overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to pot... Attack Vector: NETWORK Attack Complexity: LOW ID: qw5Rv1Ypcf%2Br%2B54Ucw6De7sckskbFAMfMIzlAsAtqZ4%3D Vulnerable Package
31		CVE-2023-1530	Npm-electron-23.1.2	details Recommended version: 24.0.0 Description: Use after free in PDF in Google Chrome versions prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a craf... Attack Vector: NETWORK Attack Complexity: LOW ID: hzQidkR0IatBAUWx1iimsxfm%2BW4qwPtv7dXmdc6sRpk%3D Vulnerable Package
32		CVE-2023-1811	Npm-electron-23.1.2	details Recommended version: 24.0.0 Description: Use after free in Frames in Google Chrome in versions prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific U... Attack Vector: NETWORK Attack Complexity: LOW ID: 8fDH11hq65vBoEy8UCugj6lp37IpMF1aDdor2JyeRnw%3D Vulnerable Package
33		CVE-2023-2135	Npm-electron-23.1.2	details Recommended version: 24.1.3 Description: Use After Free in DevTools in Google Chrome in versions prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific p... Attack Vector: NETWORK Attack Complexity: HIGH ID: uYBGa6dNoCqUVa4%2FieWELBORs34WUxPKnOfX2kza8Rw%3D Vulnerable Package
34		CVE-2024-52011	Npm-launch-editor-2.6.0	details Recommended version: 2.9.0 Description: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of ... Attack Vector: NETWORK Attack Complexity: LOW ID: Ok4KIo8hsjFSWqKWrFH%2FHzjCGrhsy8xjeZeZzBr3Y4w%3D Vulnerable Package
35		CVE-2025-13630	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Attack Vector: NETWORK Attack Complexity: LOW ID: eFPoafRrHWvBi0Yk%2F1nGhtuV%2BAbjHrDdpUDTeJUYVXI%3D Vulnerable Package
36		CVE-2025-13631	Npm-electron-23.1.2	details Recommended version: 38.8.0 Description: Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform Privilege Escala... Attack Vector: NETWORK Attack Complexity: LOW ID: Bnd58W4ZZWVaEaQcRIGfoWy%2BWtkvLJ6tUH3z%2BBafQjs%3D Vulnerable Package
37		CVE-2025-13633	Npm-electron-23.1.2	details Recommended version: 38.8.0 Description: Use After Free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to... Attack Vector: NETWORK Attack Complexity: LOW ID: i6125W7ZLzcjFvm14MV3I%2BZubDQ54sWPxzLi5KJBulg%3D Vulnerable Package
38		CVE-2025-13638	Npm-electron-23.1.2	details Recommended version: 38.8.0 Description: Use After Free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a craft... Attack Vector: NETWORK Attack Complexity: LOW ID: HBlF9%2BHL1wTv3I%2B5tYlsjk8sCFZ7ZtTSyaL%2BhyPk%2F2A%3D Vulnerable Package
39		CVE-2025-13639	Npm-electron-23.1.2	details Recommended version: 38.8.0 Description: Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a craf... Attack Vector: NETWORK Attack Complexity: LOW ID: ER97xh4QXHXMCrphzMb%2FAohTSTSDHJof7csBByLkyDE%3D Vulnerable Package
40		CVE-2025-13720	Npm-electron-23.1.2	details Recommended version: 38.8.0 Description: Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploi... Attack Vector: NETWORK Attack Complexity: LOW ID: WvjgyAhI8pdu2lPhmvnvd72PEUfTD%2ByMlPoQBu3romU%3D Vulnerable Package
41		CVE-2025-13721	Npm-electron-23.1.2	details Recommended version: 38.8.0 Description: Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Attack Vector: NETWORK Attack Complexity: HIGH ID: KzS1CXJkvEuMfQvPRbammKzOOyWW%2B2ZNBNKTylJK1NM%3D Vulnerable Package

More results are available on the CxOne platform

---

Fixed Issues (5)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2025-13466	Npm-body-parser-1.19.2
	CVE-2025-13466	Npm-body-parser-1.19.0
	CVE-2025-13466	Npm-body-parser-1.18.2
	CVE-2025-13466	Npm-body-parser-1.20.1
	CVE-2025-13466	Npm-body-parser-1.20.2

---

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.