New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 5 vulnerabilities #53

Open

SonnyBurnett wants to merge 1 commit into master from snyk-fix-0bc3d2201a01a6f282ebb8285a820db6

Owner

SonnyBurnett commented Jun 21, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
Find out more.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-MQUERY-1089718	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	No	Proof of Concept
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Override Protection Bypass npm:qs:20170213	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: body-parser

The new version differs by 250 commits.

424dadd 1.19.2
11248a2 deps: raw-body@2.4.3
7a088eb build: Node.js@14.19
ecedf31 build: Node.js@16.14
b6bfabd build: Node.js@17.5
badd6b2 build: fix code coverage aggregate upload
96b448a build: Node.js@17.4
70560b1 build: mocha@9.2.0
548a06f build: supertest@6.2.2
3b00678 deps: bytes@3.1.2
d5acb61 build: mocha@9.1.4
82c8a7c tests: add limit + inflate tests
b356758 deps: qs@6.9.7
c631b58 build: supertest@6.2.1
c81a8e2 build: eslint-plugin-import@2.25.4
3c4dcb8 build: Node.js@17.3
d0a214b 1.19.1
fb172d4 build: eslint-plugin-promise@5.2.0
c5e63cb build: Node.js@17.2
c6d43bd build: eslint-plugin-import@2.25.3
313ed6d build: eslint-plugin-promise@5.1.1
8389b51 deps: bytes@3.1.1
aae94b2 deps: http-errors@1.8.1
7f84d4f deps: raw-body@2.4.2

See the full diff

Package name: express

The new version differs by 250 commits.

3d7fce5 4.17.3
f906371 build: update example dependencies
6381bc6 deps: qs@6.9.7
a007863 deps: body-parser@1.19.2
e98f584 Revert "build: use minimatch@3.0.4 for Node.js < 4"
a659137 tests: use strict mode
a39e409 tests: prevent leaking changes to NODE_ENV
82de4de examples: fix path traversal in downloads example
12310c5 build: use nyc for test coverage
884657d examples: remove bitwise syntax for includes check
7511d08 build: use minimatch@3.0.4 for Node.js < 4
2585f20 tests: fix test missing assertion
9d09762 build: supertest@6.2.2
43cc56e build: clean up gitignore
1c7bbcc build: Node.js@14.19
9cbbc8a deps: cookie@0.4.2
6fbc269 pref: remove unnecessary regexp for trust proxy
2bc734a deps: accepts@~1.3.8
89bb531 docs: fix typo in res.download jsdoc
744564f tests: add test for multiple ips in "trust proxy"
da6cb0e tests: add range tests to res.download
00ad5be tests: add more tests for app.request & app.response
141914e tests: fix tests that did not bubble errors
bd4fdfe tests: remove global dependency on should

See the full diff

Package name: mongoose

The new version differs by 250 commits.

f8d2721 chore: release 5.12.3
58cad73 fix(connection): use queueing instead of event emitter for `createCollection()` and other helpers to avoid event emitter warning
5382408 fix(index.d.ts): add `transform` to PopulateOptions interface
dca1d70 Merge branch 'master' of github.com:Automattic/mongoose
2648088 fix(index.d.ts): add DocumentQuery type for backwards compatibility
966770f Merge pull request #10063 from Automattic/gh-10044
9e4a083 style: fix lint
f3cd3a8 chore: use variable instead of function
f24953c fix(query): add `writeConcern()` method to avoid writeConcern deprecation warning
7d2e9c9 chore: upgrade mquery -> 3.2.5 re: Security Fix for Prototype Pollution - huntr.dev mongoosejs/mquery#121
d1a9a1e made requested changes
cf1b666 Merge pull request #10078 from pezzu/master
2aef528 Merge pull request #10062 from Automattic/gh-10025
452c77c Fixes #10072
c9bfb30 Update model.indexes.test.js
6f0133a removed comments
9e98cd8 Merge pull request #10055 from emrebass/patch-1
1c20044 Merge pull request #10054 from coro101/add-discriminator-type
4e74ea7 TIL that includes() is also not supported in all browsers
f231d7b should work and is designed to handle multiple text fields
c4897f9 TIL Object.values in not supported on all browsers
391ecec collation not added to text indexes
7a93c16 linter fix
6deb668 fix: connection ids are now scoped

See the full diff

Package name: tap

The new version differs by 250 commits.

bc49fb7 15.0.0
4378608 remove publishConfig beta tag
2c2e75f provide mkdirRecursive polyfill for old node versions
8f4c855 correctly specify 10.0.x versions
5e61672 update deps
c44c418 Support 10.0 and test in CI
dc5c841 tcompare@5.0.4
385b6d2 Add .taprc.yml/yaml handling to change log
4f87466 just run regular test script as snap script
315a921 delete FORCE_COLOR/NO_COLOR rather than setting to '0'
564e96f Add detection for .yaml and .yml
75bae93 update cli doc
c1289bf 15.0.0-3
d6fe32f Do not CI on node 10
d2e0428 do not use equals() alias in self-test
3f787c4 tell npm to be colorful in CI
1512818 run tests with color on github actions
4626fa1 Docs: update documentation for tap v15
02d536b libtap@1.0.1
f7c7c58 update cli doc
2aa497c 15.0.0-2
8d7f62e Add support for overriding libtap's internal settings
29eed63 new snapshot folder layout
3a28d4d update libtap git ref to isaacs/tap-v15-prep branch

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	469/1000 Why? Has a fix available, CVSS 5.1	Remote Memory Exposure npm:request:20160119	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)


          fix: package.json & .snyk to reduce vulnerabilities

56d6ba4

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-MQUERY-1089718
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/npm:qs:20170213


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/npm:request:20160119

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet