[Snyk] Upgrade: bcrypt, cloudinary, dotenv, moment, mongoose, nodemon, socket.io, socket.io-client, stripe, validator #3

KOTTAGENVH · 2024-09-19T12:12:58Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

bcrypt
from 5.0.1 to 5.1.1 | 2 versions ahead of your current version | a year ago
on 2023-08-16
cloudinary
from 1.31.0 to 1.41.3 | 20 versions ahead of your current version | 8 months ago
on 2024-01-18
dotenv
from 16.0.2 to 16.4.5 | 18 versions ahead of your current version | 7 months ago
on 2024-02-20
moment
from 2.29.4 to 2.30.1 | 2 versions ahead of your current version | 9 months ago
on 2023-12-27
mongoose
from 6.5.4 to 6.13.0 | 48 versions ahead of your current version | 3 months ago
on 2024-06-06
nodemon
from 2.0.19 to 2.0.22 | 3 versions ahead of your current version | a year ago
on 2023-03-22
socket.io
from 4.5.1 to 4.7.5 | 13 versions ahead of your current version | 6 months ago
on 2024-03-14
socket.io-client
from 4.5.3 to 4.7.5 | 12 versions ahead of your current version | 6 months ago
on 2024-03-14
stripe
from 10.7.0 to 10.17.0 | 14 versions ahead of your current version | 2 years ago
on 2022-11-08
validator
from 13.7.0 to 13.12.0 | 3 versions ahead of your current version | 4 months ago
on 2024-05-09

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	589	No Known Exploit
Uncaught Exception SNYK-JS-ENGINEIO-5496331	589	No Known Exploit
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	589	Proof of Concept
Denial of Service (DoS) SNYK-JS-WS-7266574	589	Proof of Concept
Prototype Pollution SNYK-JS-MONGOOSE-5777721	589	Proof of Concept
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	589	Proof of Concept
Uncaught Exception SNYK-JS-SOCKETIO-7278048	589	No Known Exploit
Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	589	No Known Exploit
Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	589	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	589	Proof of Concept
Information Exposure SNYK-JS-MONGODB-5871303	589	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	589	Proof of Concept
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	589	Proof of Concept
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') SNYK-JS-VM2-5537079	589	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-WORDWRAP-3149973	589	Proof of Concept
Sandbox Escape SNYK-JS-VM2-5415299	589	Proof of Concept
Sandbox Escape SNYK-JS-VM2-5422057	589	Proof of Concept
Improper Handling of Exceptional Conditions SNYK-JS-VM2-5426093	589	No Known Exploit
Sandbox Bypass SNYK-JS-VM2-5537100	589	Proof of Concept
Remote Code Execution (RCE) SNYK-JS-VM2-5772823	589	Proof of Concept
Remote Code Execution (RCE) SNYK-JS-VM2-5772825	589	Mature

Release notes

Package name: bcrypt

5.1.1 - 2023-08-16
What's Changed
- Refactored example with async await by @ lpizzinidev in #894
- Fixed z/OS build issue by @ laijonathan in #968
- Update dependencies by @ recrsn in #993
New Contributors
- @ lpizzinidev made their first contribution in #894
- @ laijonathan made their first contribution in #968
Full Changelog: v5.1.0...v5.1.1
5.1.0 - 2022-10-06
What's Changed
- Update node-pre-gyp to 1.0.2 by @ feuxfollets1013 in #865
- Update README for inclusion of musl by @ arbourd in #883
- Version bump, security updates to sub dep npmlog by @ adaniels-parabol in #905
- document ESM usage (#892) by @ mariusa in #899
- fix: update travis CI Docker image repository by @ cokia in #930
- Update node versions in appveyor test matrix by @ p-kuen in #936
- chore(appveyor): not use latest npm by @ cokia in #932
- chore: update Appveyor readme badge by @ cokia in #933
- Use Github actions for CI by @ recrsn in #858
- Update dependencies by @ recrsn in #953
- Migrate tests to use Jest by @ recrsn in #958
- Pin NAPI to v3 by @ recrsn in #959
New Contributors
- @ feuxfollets1013 made their first contribution in #865
- @ arbourd made their first contribution in #883
- @ adaniels-parabol made their first contribution in #905
- @ mariusa made their first contribution in #899
- @ cokia made their first contribution in #930
- @ p-kuen made their first contribution in #936
Full Changelog: v5.0.1...v5.1.0
5.0.1 - 2021-02-26
Update node-pre-gyp to 1.0.0

from bcrypt GitHub release notes

Package name: cloudinary

1.41.3 - 2024-01-18
1.41.2 - 2024-01-08
1.41.1 - 2023-12-18
1.41.0 - 2023-09-26
1.40.0 - 2023-07-31
1.39.0 - 2023-07-24
1.38.0 - 2023-07-20
1.37.3 - 2023-06-26
1.37.2 - 2023-06-19
1.37.1 - 2023-06-09
1.37.0 - 2023-05-16
1.36.4 - 2023-05-02
1.36.3 - 2023-05-02
1.36.2 - 2023-04-24
1.36.1 - 2023-04-13
1.36.0 - 2023-04-13
1.35.0 - 2023-03-03
1.34.0 - 2023-02-13
1.33.0 - 2022-12-15
1.32.0 - 2022-09-14
1.31.0 - 2022-08-28

from cloudinary GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: moment

2.30.1 - 2023-12-27
2.30.1
2.30.0 - 2023-12-26
2.30.0
2.29.4 - 2022-07-06
2.29.4

from moment GitHub release notes

Package name: mongoose

6.13.0 - 2024-06-06
6.12.9 - 2024-05-24
6.12.8 - 2024-04-10
6.12.7 - 2024-03-01
6.12.6 - 2024-01-22
6.12.5 - 2024-01-03
6.12.4 - 2023-12-27
6.12.3 - 2023-11-07
6.12.2 - 2023-10-25
6.12.1 - 2023-10-12
6.12.0 - 2023-08-24
6.11.6 - 2023-08-21
6.11.5 - 2023-08-01
6.11.4 - 2023-07-17
6.11.3 - 2023-07-11
6.11.2 - 2023-06-08
6.11.1 - 2023-05-08
6.11.0 - 2023-05-01
6.10.5 - 2023-04-06
6.10.4 - 2023-03-21
6.10.3 - 2023-03-13
6.10.2 - 2023-03-07
6.10.1 - 2023-03-03
6.10.0 - 2023-02-22
6.9.3 - 2023-02-22
6.9.2 - 2023-02-16
6.9.1 - 2023-02-06
6.9.0 - 2023-01-25
6.8.4 - 2023-01-17
6.8.3 - 2023-01-06
6.8.2 - 2022-12-28
6.8.1 - 2022-12-19
6.8.0 - 2022-12-05
6.7.5 - 2022-11-30
6.7.4 - 2022-11-28
6.7.3 - 2022-11-22
6.7.2 - 2022-11-07
6.7.1 - 2022-11-02
6.7.0 - 2022-10-24
6.6.7 - 2022-10-21
6.6.6 - 2022-10-20
6.6.5 - 2022-10-05
6.6.4 - 2022-10-03
6.6.3 - 2022-09-30
6.6.2 - 2022-09-26
6.6.1 - 2022-09-14
6.6.0 - 2022-09-08
6.5.5 - 2022-09-07
6.5.4 - 2022-08-30

from mongoose GitHub release notes

Package name: nodemon

2.0.22 - 2023-03-22
2.0.22 (2023-03-22)

Bug Fixes
- remove ts mapping if loader present (f7816e4), closes #2083
2.0.21 - 2023-03-02
2.0.21 (2023-03-02)

Bug Fixes
- remove ts mapping if loader present (1468397), closes #2083
2.0.20 - 2022-09-16
2.0.20 (2022-09-16)

Bug Fixes
- remove postinstall script (e099e91)
2.0.19 - 2022-07-05
2.0.19 (2022-07-05)

Bug Fixes
- Replace update notifier with simplified deps (#2033) (176c4a6), closes #1961 #2028

from nodemon GitHub release notes

Package name: socket.io

4.7.5 - 2024-03-14
Bug Fixes
- close the adapters when the server is closed (bf64870)
- remove duplicate pipeline when serving bundle (e426f3e)
Links
- Diff: 4.7.4...4.7.5
- Client release: 4.7.5
- engine.io@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.4 - 2024-01-12
4.7.3 - 2024-01-03
4.7.2 - 2023-08-02
4.7.1 - 2023-06-28
4.7.0 - 2023-06-22
4.6.2 - 2023-05-31
4.6.1 - 2023-02-20
4.6.0 - 2023-02-07
4.6.0-alpha1 - 2023-01-25
4.5.4 - 2022-11-22
4.5.3 - 2022-10-15
4.5.2 - 2022-09-02
4.5.1 - 2022-05-17

from socket.io GitHub release notes

Package name: socket.io-client

4.7.5 - 2024-03-14
Bug Fixes
- discard acknowledgements upon disconnection (34cbfbb)
Links
- Diff: 4.7.4...4.7.5
- Server release: 4.7.5
- engine.io-client@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.4 - 2024-01-12
There were some minor bug fixes on the server side, which mandate a client bump.

Links
- Diff: 4.7.3...4.7.4
- Server release: 4.7.4
- engine.io-client@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.3 - 2024-01-03
Bug Fixes
- improve compatibility with node16 module resolution (#1595) (605de78)
- typings: accept string | undefined as init argument (5a3eafe)
- typings: fix the type of the socket#id attribute (f9c16f2)
Links
- Diff: 4.7.2...4.7.3
- Server release: 4.7.3
- engine.io-client@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.2 - 2023-08-02
Some bug fixes are included from the engine.io-client package:
- webtransport: add proper framing (d55c39e)
- webtransport: honor the binaryType attribute (8270e00)
Links
- Diff: 4.7.1...4.7.2
- Server release: 4.7.2
- engine.io-client@~6.5.2 (diff)
- ws@~8.11.0 (no change)
4.7.1 - 2023-06-28
Some bug fixes are included from the engine.io-client package:
- make closeOnBeforeunload default to false (a63066b)
- webtransport: properly handle abruptly closed connections (cf6aa1f)
Links
- Diff: 4.7.0...4.7.1
- Server release: 4.7.1
- engine.io-client@~6.5.1 (diff)
- ws@~8.11.0 (no change)
4.7.0 - 2023-06-22
Bug Fixes
- properly report timeout error when connecting (5bc94b5)
- use same scope for setTimeout and clearTimeout calls (#1568) (f2892ab)
Features

Support for WebTransport

The Engine.IO client can now use WebTransport as the underlying transport.

WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

References:
For Node.js clients: until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:

import { WebTransport } from "@ fails-components/webtransport";

global.WebTransport = WebTransport;

Added in 7195c0f.

Cookie management for the Node.js client

When setting the withCredentials option to true, the Node.js client will now include the cookies in the HTTP requests, making it easier to use it with cookie-based sticky sessions.
https://example.com", {
withCredentials: true
});">
```
import { io } from "socket.io-client";
const socket = io("https://example.com", {

withCredentials: true

});
```
Added in 5fc88a6.

Conditional import of the ESM build with debug logs

By default, the ESM build does not include the debug package in the browser environments, because it increases the bundle size (see 16b6569).

Which means that, unfortunately, debug logs are not available in the devtools console, even when setting the localStorage.debug = ... attribute.

You can now import the build which includes the debug packages with a conditional import. Example with vite:

import { defineConfig } from 'vite'
import react from '@ vitejs/plugin-react'

export default defineConfig({
plugins: [react()],
server: {
port: 4000
},
resolve: {
conditions: ["development"]
}
})

Reference: https://v2.vitejs.dev/config/#resolve-conditions

Added in 781d753.

Links
- Diff: 4.6.2...4.7.0
- Server release: 4.7.0
- engine.io-client version: ~6.5.0 (diff)
- ws version: ~8.11.0 (no change)
4.6.2 - 2023-05-31
Bug Fixes
- exports: move types condition to the top (#1580) (7ead241)
Links
- Diff: 4.6.1...4.6.2
- Server release: 4.6.2
- engine.io-client version: ~6.4.0 (no change)
- ws version: ~8.11.0 (no change)
4.6.1 - 2023-02-20
Bug Fixes
- do not drain the queue while the socket is offline (4996f9e)
- prevent duplicate connections when multiplexing (46213a6)
Links
- Diff: 4.6.0...4.6.1
- Server release: 4.6.1
- engine.io-client version: ~6.4.0 (no change)
- ws version: ~8.11.0 (no change)

4.6.0 - 2023-02-06

Bug Fixes

typings: do not expose browser-specific types (4d6d95e)
ensure manager.socket() returns an active socket (b7dd891)
typings: properly type emits with timeout (#1570) (33e4172)

Features

A new "addTrailingSlash" option

The trailing slash which was added by default can now be disabled:

https://example.com", {
addTrailingSlash: false
});">

import { io } from "socket.io-client";
const socket = io("https://example.com", {

addTrailingSlash: false

});

In the example above, the request URL will be https://example.com/socket.io instead of https://example.com/socket.io/.

Added in 21a6e12.

Promise-based acknowledgements

This commit adds some syntactic sugar around acknowledgements:

// without timeout
const response = await socket.emitWithAck("hello", "world");

// with a specific timeout
try {
const response = await socket.timeout(1000).emitWithAck("hello", "world");
} catch (err) {
// the server did not acknowledge the event in the given delay
}

Note: environments that do not support Promises will need to add a polyfill in order to use this feature.

Added in 47b979d.

Connection state recovery

This feature allows a client to reconnect after a temporary disconnection and restore its ID and receive any packets that was missed during the disconnection gap. It must be enabled on the server side.

A new boolean attribute named recovered is added on the socket object:

socket.on("connect", () => {
  console.log(socket.recovered); // whether the recovery was successful
});

Added in 54d5ee0 (server) and b4e20c5 (client).

Retry mechanism

Two new options are available:

retries: the maximum number of retries. Above the limit, the packet will be discarded.
ackTimeout: the default timeout in milliseconds used when waiting for an acknowledgement (not to be mixed up with the already existing timeout option, which is used by the Manager during the connection)

const socket = io({
retries: 3,
ackTimeout: 10000
});

// implicit ack
socket.emit("my-event");

// explicit ack
socket.emit("my-event", (err, val) => { /* ... */ });

// custom timeout (in that case the ackTimeout is optional)
socket.timeout(5000).emit("my-event", (err, val) => { /* ... */ });

In all examples above, "my-event" will be sent up to 4 times (1 + 3), until the server sends an acknowledgement.

Assigning a unique ID to each packet is the duty of the user, in order to allow deduplication on the server side.

Added in 655dce9.

Links

Diff: 4.5.4...4.6.0
Server release: 4.6.0
engine.io-client version: ~6.4.0 (diff)
ws version: ~8.11.0 (diff)

Size of the bundles:

	min	min+gzip
socket.io.min.js	45.8 KB (+ 3.2 KB ⬆️)	14.5 KB (+ 0.9 KB ⬆️)
socket.io.msgpack.min.js	50.7 KB (+ 3.0 KB ⬆️)	15.5 KB (+ 0.9 KB ⬆️)
socket.io.esm.min.js	37.0 KB (+ 2.5 KB ⬆️)	12.3 KB (+ 0.8 KB ⬆️)

4.6.0-alpha2 - 2023-02-04
Related:
4.6.0-alpha1 - 2023-02-03
4.5.4 - 2022-11-22
4.5.3 - 2022-10-15

from socket.io-client GitHub release notes

Package name: stripe

10.17.0 - 2022-11-08
- #1610 API Updates
  - Add support for new values eg_tin, ph_tin, and tr_tin on enums Checkout.Session.customer_details.tax_ids[].type, Invoice.customer_tax_ids[].type, Order.tax_details.tax_ids[].type, and TaxId.type
  - Add support for new values eg_tin, ph_tin, and tr_tin on enums CustomerCreateParams.tax_id_data[].type, InvoiceUpcomingLinesParams.customer_details.tax_ids[].type, InvoiceUpcomingParams.customer_details.tax_ids[].type, OrderCreateParams.tax_details.tax_ids[].type, OrderUpdateParams.tax_details.tax_ids[].type, and TaxIdCreateParams.type
  - Add support for reason_message on Issuing.Authorization.request_history[]
  - Add support for new value webhook_error on enum Issuing.Authorization.request_history[].reason
See the changelog for more details.
10.16.0 - 2022-11-03
- #1596 API Updates
  - Add support for on_behalf_of on CheckoutSessionCreateParams.subscription_data, SubscriptionCreateParams, SubscriptionSchedule.default_settings, SubscriptionSchedule.phases[], SubscriptionScheduleCreateParams.default_settings, SubscriptionScheduleCreateParams.phases[], SubscriptionScheduleUpdateParams.default_settings, SubscriptionScheduleUpdateParams.phases[], SubscriptionUpdateParams, and Subscription
  - Add support for tax_behavior and tax_code on InvoiceItemCreateParams, InvoiceItemUpdateParams, InvoiceUpcomingLinesParams.invoice_items[], and InvoiceUpcomingParams.invoice_items[]
See the changelog for more details.
10.16.0-beta.2 - 2022-11-02
- #1598 API Updates for beta branch
  - Updated beta APIs to the latest stable version
  - Add support for cashappPayments and zipPayments on Account.
  - Add support for cashapp and zip on Charge, PaymentMethod.
  - Add support for trialSettings on SubscriptionSchedule.
See the cha...

Snyk has created this PR to upgrade: - bcrypt from 5.0.1 to 5.1.1. See this package in npm: https://www.npmjs.com/package/bcrypt - cloudinary from 1.31.0 to 1.41.3. See this package in npm: https://www.npmjs.com/package/cloudinary - dotenv from 16.0.2 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - moment from 2.29.4 to 2.30.1. See this package in npm: https://www.npmjs.com/package/moment - mongoose from 6.5.4 to 6.13.0. See this package in npm: https://www.npmjs.com/package/mongoose - nodemon from 2.0.19 to 2.0.22. See this package in npm: https://www.npmjs.com/package/nodemon - socket.io from 4.5.1 to 4.7.5. See this package in npm: https://www.npmjs.com/package/socket.io - socket.io-client from 4.5.3 to 4.7.5. See this package in npm: https://www.npmjs.com/package/socket.io-client - stripe from 10.7.0 to 10.17.0. See this package in npm: https://www.npmjs.com/package/stripe - validator from 13.7.0 to 13.12.0. See this package in npm: https://www.npmjs.com/package/validator See this project in Snyk: https://app.snyk.io/org/kottagenvh/project/1f6e4185-c6f7-40c8-9c37-6f6ec2310bdc?utm_source=github&utm_medium=referral&page=upgrade-pr

netlify · 2024-09-19T12:13:20Z

❌ Deploy Preview for polite-dragon-8754d9 failed.

Name	Link
🔨 Latest commit	`fc6f970`
🔍 Latest deploy log	https://app.netlify.com/sites/polite-dragon-8754d9/deploys/66ec154ea6a9690008165a3c

netlify · 2024-09-19T12:14:58Z

❌ Deploy Preview for lustrous-crepe-2ddaec failed.

Name	Link
🔨 Latest commit	`fc6f970`
🔍 Latest deploy log	https://app.netlify.com/sites/lustrous-crepe-2ddaec/deploys/66ec154ea1a03e0008be4952

[Snyk] Upgrade: bcrypt, cloudinary, dotenv, moment, mongoose, nodemon, socket.io, socket.io-client, stripe, validator #3

Are you sure you want to change the base?

[Snyk] Upgrade: bcrypt, cloudinary, dotenv, moment, mongoose, nodemon, socket.io, socket.io-client, stripe, validator #3

Conversation

KOTTAGENVH commented Sep 19, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

New Contributors

What's Changed

New Contributors

2.0.22 (2023-03-22)

Bug Fixes

2.0.21 (2023-03-02)

Bug Fixes

2.0.20 (2022-09-16)

Bug Fixes

2.0.19 (2022-07-05)

Bug Fixes

Bug Fixes

Links

Bug Fixes

Links

Links

Bug Fixes

Links

Links

Links

Bug Fixes

Features

Support for WebTransport

Cookie management for the Node.js client

Conditional import of the ESM build with debug logs

Links

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Features

A new "addTrailingSlash" option

Promise-based acknowledgements

Connection state recovery

Retry mechanism

Links

netlify bot commented Sep 19, 2024 • edited Loading

❌ Deploy Preview for polite-dragon-8754d9 failed.

netlify bot commented Sep 19, 2024 • edited Loading

❌ Deploy Preview for lustrous-crepe-2ddaec failed.

netlify bot commented Sep 19, 2024 •

edited

Loading

netlify bot commented Sep 19, 2024 •

edited

Loading