[Snyk] Security upgrade aegir from 14.0.0 to 36.2.3

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • examples/circuit-relaying/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	Yes	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-SIMPLEGIT-3177391	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: aegir

The new version differs by 250 commits.

• 585b004 chore(release): 36.2.3 [skip ci]
• a4123d5 chore(deps): bump simple-git from 2.37.0 to 3.3.0 (#944)
• 045ee8a chore(release): 36.2.2 [skip ci]
• cdd0ad1 chore: fix linting
• 677efd7 chore: slow ci is slow
• 2f88c95 fix: restore typesversions for ts config file
• 512e594 chore(release): 36.2.1 [skip ci]
• d03bb03 fix: types for test utils
• 539f597 fix: update config
• a849765 fix: publish utils dir
• 9b45b4b chore(release): 36.2.0 [skip ci]
• 3defb4f chore: add auto-release
• 3fec2e3 chore: remove unused dep
• dcb5be6 chore: add path dep
• feeeb54 fix: tsc receives forward args (#939)
• d3dc7cd fix: cache types dir
• 6136719 chore: add install browser deps action
• d8111a2 fix: remove playwright
• 7f83b6c fix: run playwright install-deps
• 40a49f6 fix: cache playwright browsers
• ad2f33b chore: change if clause
• f261653 chore: update clause
• 55f77f3 chore: print os runner
• fb41e56 chore: skip cache on windows

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Remote Code Execution (RCE)

[socket-security]

New dependency changes detected. Learn more about Socket for GitHub ↗︎

🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] bar@* or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore [email protected]
• @SocketSecurity ignore [email protected]
• @SocketSecurity ignore [email protected]

📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package	Script field	Source
[email protected] (added)	postinstall	examples/circuit-relaying/package.json via [email protected]
[email protected] (added)	postinstall	examples/circuit-relaying/package.json via [email protected]

🍣 Git dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

Publish the git dependency to npm or a private package repository and consume it from there.

Package	Dependency	Location	Source
[email protected] (upgraded)	karma-mocha-own-reporter@git+https://github.com/dryajov/karma-mocha-own-reporter.git#d562a92a12d5c76469a05d67cee19bcb8db22b23	package.json	package.json via [email protected]

Pull request alert summary

Issue	Status
Install scripts	⚠️ 2 issues
Native code	✅ 0 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	⚠️ 1 issue
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

📊 Modified Dependency Overview:

⬆️ Updated Package	Version Diff	Capability Access	+/- Transitive Count	Publisher
[email protected]	14.0.0...36.2.3	filesystem, environment	+532/-45	achingbrain