[Snyk] Security upgrade web3-provider-engine from 14.1.0 to 17.0.0

[baophucct]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • web-extension/package.json
  • web-extension/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	828/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.7	Improper Validation of Integrity Check Value SNYK-JS-SECP256K1-8237220	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: web3-provider-engine

The new version differs by 166 commits.

• c980e52 Release 17.0.0 (#474)
• 0e45c90 devDeps: ganache-core@2.13.2->ganache@^7.9.2 (#473)
• 5400086 devDeps: ethjs@^0.3.6 -> @ metamask/ethjs@^0.6.0 (#470)
• c8335a1 Bump express from 4.18.2 to 4.19.2 (#472)
• e9849a7 chore: bump runtime deps (#471)
• 7dc8cc1 chore: Add deprecation notice (#469)
• 2b354fd Update security code scanner file (#468)
• 5b15643 Bump es5-ext from 0.10.62 to 0.10.64 (#466)
• f67b49e Enabling MetaMask security code scanner (#467)
• f131161 Bump browserify-sign from 4.2.1 to 4.2.2 (#464)
• 01c8dc8 sync v16.x changes (#463)
• f68b6e4 devDeps: tape@^4.4.0->^5.7.1 (#460)
• d5da4c8 devDeps(test): replace ethereumjs-util with @ ethereumjs/util,ethereum-cryptography (#457)
• a3d4dd6 fix(etherscan,rpc): fix require of @ cypress/request (#458)
• 5a95dc6 devDeps: browserify@^16.5.0->^17.0.0 (#456)
• 4edf2ba ci: run bundle as part of build-lint-test workflow (#455)
• fb5c25e babelify dependencies (#454)
• 02afa4c deps: readable-stream@^2.2.9->^3.6.2 (#452)
• 7e28f6d deps: Bump ethereumjs and metamask packages (#453)
• f92ca6f BREAKING: Increase minimum Node.js version to 16 (#447)
• 730bd5c deps: lockbump minimist (#445)
• 06ac733 Release 16.0.6 (#449)
• d0d93b9 devDeps: bump babel packages (#450)
• e131674 ci: run on ubuntu-latest(22.04) instead of ubuntu-20.04 (#448)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.