[Snyk] Upgrade: , dotenv, express-rescue, joi, sequelize, socket.io #4

Erik-EFL · 2024-09-13T10:27:02Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@types/express
from 4.17.13 to 4.17.21 | 8 versions ahead of your current version | 10 months ago
on 2023-11-07
dotenv
from 16.0.0 to 16.4.5 | 20 versions ahead of your current version | 7 months ago
on 2024-02-20
express-rescue
from 1.1.31 to 1.2.0 | 2 versions ahead of your current version | 2 years ago
on 2022-10-28
joi
from 17.6.0 to 17.13.3 | 27 versions ahead of your current version | 3 months ago
on 2024-06-19
sequelize
from 6.17.0 to 6.37.3 | 52 versions ahead of your current version | 5 months ago
on 2024-04-13
socket.io
from 4.4.1 to 4.7.5 | 15 versions ahead of your current version | 6 months ago
on 2024-03-14

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	375	No Known Exploit
Denial of Service (DoS) SNYK-JS-WS-7266574	375	Proof of Concept
Directory Traversal SNYK-JS-MOMENT-2440688	375	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	375	Proof of Concept
SQL Injection SNYK-JS-SEQUELIZE-2932027	375	Proof of Concept
SQL Injection SNYK-JS-SEQUELIZE-2959225	375	No Known Exploit
Improper Filtering of Special Elements SNYK-JS-SEQUELIZE-3324088	375	No Known Exploit
Prototype Pollution SNYK-JS-DOTTIE-3332763	375	Proof of Concept
Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	375	No Known Exploit
Uncaught Exception SNYK-JS-ENGINEIO-5496331	375	No Known Exploit
Uncaught Exception SNYK-JS-SOCKETIO-7278048	375	No Known Exploit
Information Exposure SNYK-JS-SEQUELIZE-3324089	375	No Known Exploit
Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-SEQUELIZE-3324090	375	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-SIDEWAYFORMULA-3317169	375	No Known Exploit
Improper Input Validation SNYK-JS-SOCKETIOPARSER-3091012	375	No Known Exploit

Release notes

Package name: @types/express

4.17.21 - 2023-11-07
4.17.20 - 2023-10-18
4.17.19 - 2023-10-10
4.17.18 - 2023-09-23
4.17.17 - 2023-02-03
4.17.16 - 2023-01-23
4.17.15 - 2022-12-13
4.17.14 - 2022-09-13
4.17.13 - 2021-07-06

from @types/express GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: express-rescue

1.2.0 - 2022-10-28
- Introduced rescue.all (thanks @ J-Pster)
1.1.32 - 2022-08-04
- Bugfix: fixed a bug where rescue.from would not only call your custom error handler (that only runs when the error is an instance of the given constructor), but also would always call the next error handler in the stack. See #31
1.1.31 - 2021-01-09
Audit-fixed dependencies.

from express-rescue GitHub release notes

Package name: joi

from joi GitHub release notes

Package name: sequelize

6.37.3 - 2024-04-13
6.37.3 (2024-04-13)

Bug Fixes
- postgres: use schema for foreign key constrains of a table (#17099) (6aba382)
6.37.2 - 2024-03-29
6.37.2 (2024-03-29)

Bug Fixes
- add readOnly to the transaction options types and docs (#17226) (7c8972f)
6.37.1 - 2024-02-18
6.37.1 (2024-02-18)

Bug Fixes
- types: Add definition of returning in SaveOptions. (#16954) (505467b)
6.37.0 - 2024-02-11
6.37.0 (2024-02-11)

Features
- postgres: support connectionTimeoutMillis dialectOption (#14119) (e81200e)
6.36.0 - 2024-02-02
6.36.0 (2024-02-02)

Features
- postgres: backport stream dialectOption to v6 (#16868) (a250058)
6.35.2 - 2023-12-11
6.35.1 - 2023-11-19
6.35.0 - 2023-11-12
6.34.0 - 2023-11-03
6.33.0 - 2023-09-08
6.32.1 - 2023-06-17
6.32.0 - 2023-06-01
6.31.1 - 2023-05-01
6.31.0 - 2023-04-09
6.30.0 - 2023-03-24
6.29.3 - 2023-03-10
6.29.2 - 2023-03-09
6.29.1 - 2023-03-07
6.29.0 - 2023-02-23
6.28.2 - 2023-02-22
6.28.1 - 2023-02-21
6.28.0 - 2022-12-20
6.27.0 - 2022-12-12
6.26.0 - 2022-11-29
6.25.8 - 2022-11-22
6.25.7 - 2022-11-19
6.25.6 - 2022-11-15
6.25.5 - 2022-11-07
6.25.4 - 2022-11-05
6.25.3 - 2022-10-19
6.25.2 - 2022-10-15
6.25.1 - 2022-10-13
6.25.0 - 2022-10-11
6.24.0 - 2022-10-04
6.23.2 - 2022-09-27
6.23.1 - 2022-09-22
6.23.0 - 2022-09-17
6.22.1 - 2022-09-16
6.22.0 - 2022-09-15
6.21.6 - 2022-09-09
6.21.5 - 2022-09-08
6.21.4 - 2022-08-18
6.21.3 - 2022-07-11
6.21.2 - 2022-06-28
6.21.1 - 2022-06-25
6.21.0 - 2022-06-16
6.20.1 - 2022-05-27
6.20.0 - 2022-05-23
6.19.2 - 2022-05-18
6.19.1 - 2022-05-17
6.19.0 - 2022-04-12
6.18.0 - 2022-04-03
6.17.0 - 2022-02-25

from sequelize GitHub release notes

Package name: socket.io

4.7.5 - 2024-03-14
Bug Fixes
- close the adapters when the server is closed (bf64870)
- remove duplicate pipeline when serving bundle (e426f3e)
Links
- Diff: 4.7.4...4.7.5
- Client release: 4.7.5
- engine.io@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.4 - 2024-01-12
Bug Fixes
- typings: calling io.emit with no arguments incorrectly errored (cb6d2e0), closes #4914
Links
- Diff: 4.7.3...4.7.4
- Client release: 4.7.4
- engine.io@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.3 - 2024-01-03
Bug Fixes
- return the first response when broadcasting to a single socket (#4878) (df8e70f)
- typings: allow to bind to a non-secure Http2Server (#4853) (8c9ebc3)
Links
- Diff: 4.7.2...4.7.3
- Client release: 4.7.3
- engine.io@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.2 - 2023-08-02
Bug Fixes
- clean up child namespace when client is rejected in middleware (#4773) (0731c0d)
- webtransport: properly handle WebTransport-only connections (3468a19)
- webtransport: add proper framing (a306db0)
Links
- Diff: 4.7.1...4.7.2
- Client release: 4.7.2
- engine.io@~6.5.2 (diff)
- ws@~8.11.0 (no change)
4.7.1 - 2023-06-28
The client bundle contains a few fixes regarding the WebTransport support.

Links
- Diff: 4.7.0...4.7.1
- Client release: 4.7.1
- engine.io@~6.5.0 (no change)
- ws@~8.11.0 (no change)
4.7.0 - 2023-06-22
Bug Fixes
- remove the Partial modifier from the socket.data type (#4740) (e5c62ca)
Features

Support for WebTransport

The Socket.IO server can now use WebTransport as the underlying transport.

WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

References:
Until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:
https://w3c.github.io/webtransport/#custom-certificate-requirements)
const cert = readFileSync("/path/to/my/cert.pem");
const key = readFileSync("/path/to/my/key.pem");

const httpsServer = createServer({
key,
cert
});

httpsServer.listen(3000);

const io = new Server(httpsServer, {
transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
});

const h3Server = new Http3Server({
port: 3000,
host: "0.0.0.0",
secret: "changeit",
cert,
privKey: key,
});

(async () => {
const stream = await h3Server.sessionStream("/socket.io/");
const sessionReader = stream.getReader();

while (true) {
const { done, value } = await sessionReader.read();
if (done) {
break;
}
io.engine.onWebTransportSession(value);
}
})();

h3Server.startServer();">
```
import { readFileSync } from "fs";

import { createServer } from "https";

import { Server } from "socket.io";

import { Http3Server } from "@ fails-components/webtransport";
// WARNING: the total length of the validity period MUST NOT exceed two weeks (https://w3c.github.io/webtransport/#custom-certificate-requirements)

const cert = readFileSync("/path/to/my/cert.pem");

const key = readFileSync("/path/to/my/key.pem");
const httpsServer = createServer({

key,

cert

});
httpsServer.listen(3000);
const io = new Server(httpsServer, {

transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default

});
const h3Server = new Http3Server({

port: 3000,

host: "0.0.0.0",

secret: "changeit",

cert,

privKey: key,

});
(async () => {

const stream = await h3Server.sessionStream("/socket.io/");

const sessionReader = stream.getReader();
while (true) {

const { done, value } = await sessionReader.read();

if (done) {

break;

}

io.engine.onWebTransportSession(value);

}

})();
h3Server.startServer();
```
Added in 123b68c.

Client bundles with CORS headers

The bundles will now have the right Access-Control-Allow-xxx headers.

Added in 63f181c.

Links
- Diff: 4.6.2...4.7.0
- Client release: 4.7.0
- engine.io@~6.5.0 (diff)
- ws@~8.11.0 (no change)
4.6.2 - 2023-05-31
Bug Fixes
- exports: move types condition to the top (#4698) (3d44aae)
Links
- Diff: 4.6.1...4.6.2
- Client release: 4.6.2
- engine.io@~6.4.2 (diff)
- ws@~8.11.0 (no change)
4.6.1 - 2023-02-20
4.6.0 - 2023-02-07
4.6.0-alpha1 - 2023-01-25
4.5.4 - 2022-11-22
4.5.3 - 2022-10-15
4.5.2 - 2022-09-02
4.5.1 - 2022-05-17
4.5.0 - 2022-04-23
4.4.1 - 2022-01-06

from socket.io GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"","from":"types/express","to":"types/express"},{"name":"dotenv","from":"16.0.0","to":"16.4.5"},{"name":"express-rescue","from":"1.1.31","to":"1.2.0"},{"name":"joi","from":"17.6.0","to":"17.13.3"},{"name":"sequelize","from":"6.17.0","to":"6.37.3"},{"name":"socket.io","from":"4.4.1","to":"4.7.5"}],"env":"prod","hasFixes":true,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SOCKETIOPARSER-5596892","issue_id":"SNYK-JS-SOCKETIOPARSER-5596892","priority_score":375,"priority_score_factors":[{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-WS-7266574","issue_id":"SNYK-JS-WS-7266574","priority_score":482,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-MOMENT-2440688","issue_id":"SNYK-JS-MOMENT-2440688","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Directory Traversal"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-MOMENT-2944238","issue_id":"SNYK-JS-MOMENT-2944238","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-SEQUELIZE-2932027","issue_id":"SNYK-JS-SEQUELIZE-2932027","priority_score":791,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"9.4","score":470},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"SQL Injection"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-2959225","issue_id":"SNYK-JS-SEQUELIZE-2959225","priority_score":564,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7","score":350},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"SQL Injection"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-3324088","issue_id":"SNYK-JS-SEQUELIZE-3324088","priority_score":629,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.3","score":415},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Filtering of Special Elements"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-DOTTIE-3332763","issue_id":"SNYK-JS-DOTTIE-3332763","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-ENGINEIO-3136336","issue_id":"SNYK-JS-ENGINEIO-3136336","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-ENGINEIO-5496331","issue_id":"SNYK-JS-ENGINEIO-5496331","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Uncaught Exception"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SOCKETIO-7278048","issue_id":"SNYK-JS-SOCKETIO-7278048","priority_score":649,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.7","score":435},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Uncaught Exception"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-3324089","issue_id":"SNYK-JS-SEQUELIZE-3324089","priority_score":479,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Information Exposure"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-3324090","issue_id":"SNYK-JS-SEQUELIZE-3324090","priority_score":529,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.3","score":315},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Access of Resource Using Incompatible Type ('Type Confusion')"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SIDEWAYFORMULA-3317169","issue_id":"SNYK-JS-SIDEWAYFORMULA-3317169","priority_score":489,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.5","score":275},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SOCKETIOPARSER-3091012","issue_id":"SNYK-JS-SOCKETIOPARSER-3091012","priority_score":490,"priority_score_factors":[{"type":"cvssScore","label":"9.8","score":490},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Improper Input Validation"}],"prId":"232c95ea-c385-4763-858e-ad9eaa5cbb1d","prPublicId":"232c95ea-c385-4763-858e-ad9eaa5cbb1d","packageManager":"npm","priorityScoreList":[375,482,589,696,791,564,629,696,589,589,649,479,529,489,490],"projectPublicId":"8c23de68-c9f9-42a7-bdbb-d69ed5fa8ce6","projectUrl":"https://app.snyk.io/org/erik-efl/project/8c23de68-c9f9-42a7-bdbb-d69ed5fa8ce6?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["priorityScore"],"type":"auto","upgrade":["SNYK-JS-SOCKETIOPARSER-5596892","SNYK-JS-WS-7266574","SNYK-JS-MOMENT-2440688","SNYK-JS-MOMENT-2944238","SNYK-JS-SEQUELIZE-2932027","SNYK-JS-SEQUELIZE-2959225","SNYK-JS-SEQUELIZE-3324088","SNYK-JS-DOTTIE-3332763","SNYK-JS-ENGINEIO-3136336","SNYK-JS-ENGINEIO-5496331","SNYK-JS-SOCKETIO-7278048","SNYK-JS-SEQUELIZE-3324089","SNYK-JS-SEQUELIZE-3324090","SNYK-JS-SIDEWAYFORMULA-3317169","SNYK-JS-SOCKETIOPARSER-3091012"],"upgradeInfo":{"versionsDiff":8,"publishedDate":"2023-11-07T03:10:10.569Z"},"vulns":["SNYK-JS-SOCKETIOPARSER-5596892","SNYK-JS-WS-7266574","SNYK-JS-MOMENT-2440688","SNYK-JS-MOMENT-2944238","SNYK-JS-SEQUELIZE-2932027","SNYK-JS-SEQUELIZE-2959225","SNYK-JS-SEQUELIZE-3324088","SNYK-JS-DOTTIE-3332763","SNYK-JS-ENGINEIO-3136336","SNYK-JS-ENGINEIO-5496331","SNYK-JS-SOCKETIO-7278048","SNYK-JS-SEQUELIZE-3324089","SNYK-JS-SEQUELIZE-3324090","SNYK-JS-SIDEWAYFORMULA-3317169","SNYK-JS-SOCKETIOPARSER-3091012"]}'

Snyk has created this PR to upgrade: - @types/express from 4.17.13 to 4.17.21. See this package in npm: https://www.npmjs.com/package/@types/express - dotenv from 16.0.0 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - express-rescue from 1.1.31 to 1.2.0. See this package in npm: https://www.npmjs.com/package/express-rescue - joi from 17.6.0 to 17.13.3. See this package in npm: https://www.npmjs.com/package/joi - sequelize from 6.17.0 to 6.37.3. See this package in npm: https://www.npmjs.com/package/sequelize - socket.io from 4.4.1 to 4.7.5. See this package in npm: https://www.npmjs.com/package/socket.io See this project in Snyk: https://app.snyk.io/org/erik-efl/project/8c23de68-c9f9-42a7-bdbb-d69ed5fa8ce6?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: , dotenv, express-rescue, joi, sequelize, socket.io #4

[Snyk] Upgrade: , dotenv, express-rescue, joi, sequelize, socket.io #4

Erik-EFL commented Sep 13, 2024

6.37.3 (2024-04-13)

Bug Fixes

6.37.2 (2024-03-29)

Bug Fixes

6.37.1 (2024-02-18)

Bug Fixes

6.37.0 (2024-02-11)

Features

6.36.0 (2024-02-02)

Features

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Links

Links

Bug Fixes

Features

Support for WebTransport

Client bundles with CORS headers

Links

Bug Fixes

Links

[Snyk] Upgrade: , dotenv, express-rescue, joi, sequelize, socket.io #4

Are you sure you want to change the base?

[Snyk] Upgrade: , dotenv, express-rescue, joi, sequelize, socket.io #4

Conversation

Erik-EFL commented Sep 13, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

6.37.3 (2024-04-13)

Bug Fixes

6.37.2 (2024-03-29)

Bug Fixes

6.37.1 (2024-02-18)

Bug Fixes

6.37.0 (2024-02-11)

Features

6.36.0 (2024-02-02)

Features

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Links

Links

Bug Fixes

Features

Support for WebTransport

Client bundles with CORS headers

Links

Bug Fixes

Links