[Snyk] Upgrade solidity-ast from 0.4.28 to 0.4.46

[Woodpile37]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade solidity-ast from 0.4.28 to 0.4.46.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 19 versions ahead of your current version.
• The recommended version was released a month ago, on 2023-02-22.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	375/1000 Why? CVSS 7.5	No Known Exploit
	Prototype Pollution SNYK-JS-Y18N-1021887	375/1000 Why? CVSS 7.5	Proof of Concept
	Prototype Poisoning SNYK-JS-QS-3153490	375/1000 Why? CVSS 7.5	Proof of Concept
	Denial of Service (DoS) npm:mem:20180117	375/1000 Why? CVSS 7.5	No Known Exploit
	Cryptographic Issues SNYK-JS-ELLIPTIC-1064899	375/1000 Why? CVSS 7.5	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	375/1000 Why? CVSS 7.5	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-HIGHLIGHTJS-1048676	375/1000 Why? CVSS 7.5	No Known Exploit
	Authentication Bypass SNYK-JS-HTTPAUTH-471683	375/1000 Why? CVSS 7.5	No Known Exploit
	Prototype Pollution SNYK-JS-JSON5-3182856	375/1000 Why? CVSS 7.5	Proof of Concept
	Prototype Pollution SNYK-JS-JSON5-3182856	375/1000 Why? CVSS 7.5	Proof of Concept
	Prototype Pollution SNYK-JS-JSON5-3182856	375/1000 Why? CVSS 7.5	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	375/1000 Why? CVSS 7.5	No Known Exploit
	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	375/1000 Why? CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: solidity-ast

• 0.4.46 - 2023-02-22
  
  • Added new variant of UsingForDirective for user-defined operators.
  • Added BinaryOperation.function and UnaryOperation.function for user-defined operators.
• 0.4.45 - 2023-02-01
  
  • Added 'paris' as a possible value for InlineAssembly.evmVersion.
  • Added new Mapping fields keyName, keyNameLocation, valueName, valueNameLocation from Solidity 0.8.18.
• 0.4.44 - 2023-01-30
  
  • Added '~' as a possible value for UnaryOperation.operator.
• 0.4.43 - 2023-01-20
  
  • Added FunctionCall.nameLocations and IdentifierPath.nameLocations from Solidity 0.8.16.
  • Added MemberAccess.memberLocation from Solidity 0.8.16.
• 0.4.42 - 2023-01-20
  
  • Revert optimizations to findAll from 0.4.40.
• 0.4.41 - 2023-01-20
  
  • Optimize AST dereferencer.
• 0.4.40 - 2022-12-29
  No content.
• 0.4.39 - 2022-12-16
  No content.
• 0.4.38 - 2022-11-15
  No content.
• 0.4.38-0 - 2022-12-16
  

  0.4.38-0

• 0.4.37 - 2022-11-15
• 0.4.36 - 2022-11-14
• 0.4.35 - 2022-06-23
• 0.4.34 - 2022-06-11
• 0.4.33 - 2022-06-11
• 0.4.32 - 2022-04-24
• 0.4.31 - 2022-03-21
• 0.4.30 - 2022-01-27
• 0.4.29 - 2021-12-24
• 0.4.28 - 2021-10-27

from solidity-ast GitHub release notes

Commit messages

Package name: solidity-ast

• facd1f9 0.4.46
• 2f39c7f add solidity 0.8.19 features
• 079ec23 0.4.45
• db4d59d Update for Solidity 0.8.18
• 49621a7 0.4.44
• 2450642 Add missing bitwise NOT (Bump elliptic from 6.5.3 to 6.5.4 #29)
• 9623e7a add test for 0.8.14 feature
• 92ebea5 0.4.43
• e301951 update solidity submodule
• d7d6c32 add nameLocations and memberLocation
• 01f98e7 format changelog with prettier
• c75e53c 0.4.42
• 3b31846 configure ts-node as transpile only
• ae32690 revert f2753fd0936780f0d2f8657df621b51b3b509d6f
• 1dc965f 0.4.41
• 835dc06 optimize ast dereferencer
• 4496dcc update actions/checkout
• fe5ba42 add changelog to releases
• 9f93da1 0.4.40
• 51915bc add release workflow
• f2753fd persist cache in getNextProps across calls
• 638149c Bump minimatch from 3.0.4 to 3.1.2 ([Snyk] Upgrade prettier-plugin-solidity from 1.0.0-beta.19 to 1.1.3 #27)
• 2c19ecb 0.4.39
• ad7fb53 update changelog

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2e514f2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR