[Snyk] Security upgrade puppeteer from 20.7.3 to 20.8.2

[Jerk400]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	811/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.8	Remote Code Execution (RCE) SNYK-JS-VM2-5772823	No	Proof of Concept
	811/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.8	Remote Code Execution (RCE) SNYK-JS-VM2-5772825	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: puppeteer

The new version differs by 64 commits.

• 52ef962 chore: release main (#10550)
• 4070cd6 fix: stop relying on vm2 (via proxy agent) (#10548)
• d49dda0 chore: fix the browsers template (#10544)
• 61b52a3 chore: add a bug template for browsers (#10543)
• 5e50bf2 chore(deps): Bump glob from 10.3.1 to 10.3.3 (#10539)
• bda7d83 ci: fix for Firefox Profile Preferences changes (#10542)
• 956324f chore(deps): Bump semver from 5.7.1 to 5.7.2 in /website (#10541)
• 36ebd1c chore: release main (#10521)
• c0dc8ad fix: remove Chromium channels (#10536)
• c308266 fix: correctly parse the default buildId (#10535)
• 19111be ci: Firefox Profile Pref should trigger Puppeteer CI (#10531)
• 408d926 chore: update `ng-schematics` deps at once (#10530)
• 4a401f9 chore(deps): Bump peter-evans/create-pull-request from 5.0.1 to 5.0.2 (#10529)
• 3f2679e chore(deps): Bump github/codeql-action from 2.20.0 to 2.20.3 (#10528)
• cbf4f2a fix: remove test metadata files (#10520)
• 62886f2 chore: release main (#10497)
• a1c7211 chore(deps): Bump tar-fs from 3.0.3 to 3.0.4 (#10502)
• f793a28 test: bump Firefox test version (#10514)
• 56a97dd fix: add an internal page.locatorRace (#10512)
• fa41229 chore(deps): Bump cross-fetch from 3.1.6 to 4.0.0 (#10501)
• 0d2c42a ci: fix Actions not running sometimes (#10503)
• 15cf3a5 chore: add type test for CommonEventEmitter (#10500)
• 0caf124 chore: move unit tests (#10498)
• d0d738d chore: readd browser setup hook (#10478)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Remote Code Execution (RCE)

[stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[guardrails]

⚠️ We detected 1 security issue in this pull request:

Vulnerable Libraries (1)

Severity	Details
Medium	pkg:npm/[email protected] (t) upgrade to: > 2.7.14

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[socket-security]

Updated dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
puppeteer	20.7.3...20.8.2	None	+11/-27	8.41 MB	google-wombot

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Issue	Package	Version	Note	Source
Network access	@puppeteer/browsers	1.4.5	Module: http-proxy-agent Location: lib/cjs/httpUtil.js +3 more instances...	[email protected] via package.json

Next steps

What is network access?

This module accesses the network.

Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] bar@* or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore @puppeteer/[email protected]