[Snyk] Upgrade: , , http-status, joi, , bcrypt, dotenv, express, nodemailer, pg, sequelize #340

NelipeFunes · 2024-09-18T12:21:13Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@types/bcryptjs
from 2.4.2 to 2.4.6 | 4 versions ahead of your current version | 10 months ago
on 2023-11-06
@types/cors
from 2.8.13 to 2.8.17 | 4 versions ahead of your current version | 10 months ago
on 2023-11-20
http-status
from 1.6.2 to 1.7.4 | 5 versions ahead of your current version | 7 months ago
on 2024-02-23
joi
from 17.7.0 to 17.13.3 | 22 versions ahead of your current version | 3 months ago
on 2024-06-19
@types/nodemailer
from 6.4.7 to 6.4.15 | 8 versions ahead of your current version | 5 months ago
on 2024-05-02
bcrypt
from 5.1.0 to 5.1.1 | 1 version ahead of your current version | a year ago
on 2023-08-16
dotenv
from 16.0.3 to 16.4.5 | 17 versions ahead of your current version | 7 months ago
on 2024-02-20
express
from 4.18.2 to 4.19.2 | 4 versions ahead of your current version | 6 months ago
on 2024-03-25
nodemailer
from 6.9.3 to 6.9.14 | 11 versions ahead of your current version | 3 months ago
on 2024-06-19
pg
from 8.9.0 to 8.12.0 | 9 versions ahead of your current version | 3 months ago
on 2024-06-04
sequelize
from 6.28.0 to 6.37.3 | 21 versions ahead of your current version | 5 months ago
on 2024-04-13

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Prototype Pollution SNYK-JS-DOTTIE-3332763	696	Proof of Concept
Improper Filtering of Special Elements SNYK-JS-SEQUELIZE-3324088	696	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	696	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-NODEMAILER-6219989	696	Proof of Concept
Information Exposure SNYK-JS-SEQUELIZE-3324089	696	No Known Exploit
Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-SEQUELIZE-3324090	696	No Known Exploit
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	696	Proof of Concept

Release notes

Package name: @types/bcryptjs

2.4.6 - 2023-11-06
2.4.5 - 2023-10-17
2.4.4 - 2023-09-15
2.4.3 - 2023-08-29
2.4.2 - 2018-09-19

from @types/bcryptjs GitHub release notes

Package name: @types/cors

2.8.17 - 2023-11-20
2.8.16 - 2023-11-07
2.8.15 - 2023-10-18
2.8.14 - 2023-09-04
2.8.13 - 2022-12-05

from @types/cors GitHub release notes

Package name: http-status

1.7.4 - 2024-02-23
chore(release): 1.7.4
1.7.3 - 2023-10-17
chore(release): 1.7.3
1.7.2 - 2023-10-17
chore(release): 1.7.2
1.7.1 - 2023-10-17
chore(release): 1.7.1
1.7.0 - 2023-09-04
chore(release): 1.7.0
1.6.2 - 2023-01-10
chore(release): 1.6.2

from http-status GitHub release notes

Package name: joi

from joi GitHub release notes

Package name: @types/nodemailer

6.4.15 - 2024-05-02
6.4.14 - 2023-11-07
6.4.13 - 2023-10-18
6.4.12 - 2023-10-18
6.4.11 - 2023-09-23
6.4.10 - 2023-09-11
6.4.9 - 2023-07-25
6.4.8 - 2023-05-18
6.4.7 - 2022-12-17

from @types/nodemailer GitHub release notes

Package name: bcrypt

5.1.1 - 2023-08-16
What's Changed
- Refactored example with async await by @ lpizzinidev in #894
- Fixed z/OS build issue by @ laijonathan in #968
- Update dependencies by @ recrsn in #993
New Contributors
- @ lpizzinidev made their first contribution in #894
- @ laijonathan made their first contribution in #968
Full Changelog: v5.1.0...v5.1.1
5.1.0 - 2022-10-06
What's Changed
- Update node-pre-gyp to 1.0.2 by @ feuxfollets1013 in #865
- Update README for inclusion of musl by @ arbourd in #883
- Version bump, security updates to sub dep npmlog by @ adaniels-parabol in #905
- document ESM usage (#892) by @ mariusa in #899
- fix: update travis CI Docker image repository by @ cokia in #930
- Update node versions in appveyor test matrix by @ p-kuen in #936
- chore(appveyor): not use latest npm by @ cokia in #932
- chore: update Appveyor readme badge by @ cokia in #933
- Use Github actions for CI by @ recrsn in #858
- Update dependencies by @ recrsn in #953
- Migrate tests to use Jest by @ recrsn in #958
- Pin NAPI to v3 by @ recrsn in #959
New Contributors
- @ feuxfollets1013 made their first contribution in #865
- @ arbourd made their first contribution in #883
- @ adaniels-parabol made their first contribution in #905
- @ mariusa made their first contribution in #899
- @ cokia made their first contribution in #930
- @ p-kuen made their first contribution in #936
Full Changelog: v5.0.1...v5.1.0

from bcrypt GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: body-parser@1.20.2
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: raw-body@2.5.2
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: Node.js@16.18 and Node.js@18.12 by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add Node.js@19.7 by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: body-parser@1.20.1
  - deps: qs@6.11.0
  - perf: remove unnecessary object clone
- deps: qs@6.11.0

from express GitHub release notes

Package name: nodemailer

6.9.14 - 2024-06-19
6.9.14 (2024-06-19)

Bug Fixes
- api: Added support for Ethereal authentication (56b2205)
- services.json: Add Email Services Provider Feishu Mail (CN) (#1648) (e9e9ecc)
- services.json: update Mailtrap host and port in well known (#1652) (fc2c9ea)
- well-known-services: Add Loopia in well known services (#1655) (21a28a1)
6.9.13 - 2024-03-20
6.9.13 (2024-03-20)

Bug Fixes
- tls: Ensure servername for SMTP (d66fdd3)
6.9.12 - 2024-03-08
6.9.12 (2024-03-08)

Bug Fixes
- message-generation: Escape single quote in address names (4ae5fad)
6.9.11 - 2024-02-29
6.9.11 (2024-02-29)

Bug Fixes
- headers: Ensure that Content-type is the bottom header (c7cf97e)
6.9.10 - 2024-02-22
6.9.10 (2024-02-22)

Bug Fixes
- data-uri: Do not use regular expressions for parsing data URI schemes (12e65e9)
- data-uri: Moved all data-uri regexes to use the non-regex parseDataUri method (edd5dfe)
6.9.9 - 2024-02-01
6.9.9 (2024-02-01)

Bug Fixes
- security: Fix issues described in GHSA-9h6g-pr28-7cqp. Do not use eternal matching pattern if only a few occurences are expected (dd8f5e8)
- tests: Use native node test runner, added code coverage support, removed grunt (#1604) (be45c1b)
6.9.8 - 2023-12-30
6.9.8 (2023-12-30)

Bug Fixes
- punycode: do not use native punycode module (b4d0e0c)
6.9.7 - 2023-10-22
6.9.7 (2023-10-22)

Bug Fixes
- customAuth: Do not require user and pass to be set for custom authentication schemes (fixes #1584) (41d482c)
6.9.6 - 2023-10-09
6.9.6 (2023-10-09)

Bug Fixes
- inline: Use 'inline' as the default Content Dispostion value for embedded images (db32c93)
- tests: Removed Node v12 from test matrix as it is not compatible with the test framework anymore (7fe0a60)
6.9.5 - 2023-09-06
6.9.5 (2023-09-06)

Bug Fixes
- license: Updated license year (da4744e)
6.9.4 - 2023-07-19
6.9.3 - 2023-05-29

from nodemailer GitHub release notes

Package name: pg

8.12.0 - 2024-06-04
8.11.6 - 2024-06-04
8.11.5 - 2024-04-02
8.11.4 - 2024-03-30
8.11.3 - 2023-08-16
8.11.2 - 2023-08-01
8.11.1 - 2023-06-26
8.11.0 - 2023-05-15
8.10.0 - 2023-03-06
8.9.0 - 2023-01-27

from pg GitHub release notes

Package name: sequelize

6.37.3 - 2024-04-13
6.37.3 (2024-04-13)

Bug Fixes
- postgres: use schema for foreign key constrains of a table (#17099) (6aba382)
6.37.2 - 2024-03-29
6.37.2 (2024-03-29)

Bug Fixes
- add readOnly to the transaction options types and docs (#17226) (7c8972f)
6.37.1 - 2024-02-18
6.37.1 (2024-02-18)

Bug Fixes
- types: Add definition of returning in SaveOptions. (#16954) (505467b)
6.37.0 - 2024-02-11
6.37.0 (2024-02-11)

Features
- postgres: support connectionTimeoutMillis dialectOption (#14119) (e81200e)
6.36.0 - 2024-02-02
6.35.2 - 2023-12-11
6.35.1 - 2023-11-19
6.35.0 - 2023-11-12
6.34.0 - 2023-11-03
6.33.0 - 2023-09-08
6.32.1 - 2023-06-17
6.32.0 - 2023-06-01
6.31.1 - 2023-05-01
6.31.0 - 2023-04-09
6.30.0 - 2023-03-24
6.29.3 - 2023-03-10
6.29.2 - 2023-03-09
6.29.1 - 2023-03-07
6.29.0 - 2023-02-23
6.28.2 - 2023-02-22
6.28.1 - 2023-02-21
6.28.0 - 2022-12-20

from sequelize GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"","from":"types/bcryptjs","to":"types/bcryptjs"},{"name":"","from":"types/cors","to":"types/cors"},{"name":"http-status","from":"1.6.2","to":"1.7.4"},{"name":"joi","from":"17.7.0","to":"17.13.3"},{"name":"","from":"types/nodemailer...

Snyk has created this PR to upgrade: - @types/bcryptjs from 2.4.2 to 2.4.6. See this package in npm: https://www.npmjs.com/package/@types/bcryptjs - @types/cors from 2.8.13 to 2.8.17. See this package in npm: https://www.npmjs.com/package/@types/cors - http-status from 1.6.2 to 1.7.4. See this package in npm: https://www.npmjs.com/package/http-status - joi from 17.7.0 to 17.13.3. See this package in npm: https://www.npmjs.com/package/joi - @types/nodemailer from 6.4.7 to 6.4.15. See this package in npm: https://www.npmjs.com/package/@types/nodemailer - bcrypt from 5.1.0 to 5.1.1. See this package in npm: https://www.npmjs.com/package/bcrypt - dotenv from 16.0.3 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - express from 4.18.2 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - nodemailer from 6.9.3 to 6.9.14. See this package in npm: https://www.npmjs.com/package/nodemailer - pg from 8.9.0 to 8.12.0. See this package in npm: https://www.npmjs.com/package/pg - sequelize from 6.28.0 to 6.37.3. See this package in npm: https://www.npmjs.com/package/sequelize See this project in Snyk: https://app.snyk.io/org/nelipefunes/project/f6a6b355-4d86-4dab-895b-3e598d1df40c?utm_source=github&utm_medium=referral&page=upgrade-pr

[Snyk] Upgrade: , , http-status, joi, , bcrypt, dotenv, express, nodemailer, pg, sequelize #340

Are you sure you want to change the base?

[Snyk] Upgrade: , , http-status, joi, , bcrypt, dotenv, express, nodemailer, pg, sequelize #340

Conversation

NelipeFunes commented Sep 18, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

6.9.14 (2024-06-19)

Bug Fixes

6.9.13 (2024-03-20)

Bug Fixes

6.9.12 (2024-03-08)

Bug Fixes

6.9.11 (2024-02-29)

Bug Fixes

6.9.10 (2024-02-22)

Bug Fixes

6.9.9 (2024-02-01)

Bug Fixes

6.9.8 (2023-12-30)

Bug Fixes

6.9.7 (2023-10-22)

Bug Fixes

6.9.6 (2023-10-09)

Bug Fixes

6.9.5 (2023-09-06)

Bug Fixes

6.37.3 (2024-04-13)

Bug Fixes

6.37.2 (2024-03-29)

Bug Fixes

6.37.1 (2024-02-18)

Bug Fixes

6.37.0 (2024-02-11)

Features