This repository has been archived by the owner on Jan 26, 2023. It is now read-only.
Update dependency express to v4 [SECURITY] #5
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/npm-express-vulnerability
branch
from
733647b
to
cad2e97
Compare
delete-merged-branch
bot
deleted the
renovate/npm-express-vulnerability
branch
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
~2.5.9->~4.17.0GitHub Vulnerability Alerts
CVE-2014-6393
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.
Release Notes
expressjs/express
v4.17.1Compare Source
===================
null/undefinedtores.status"v4.17.0Compare Source
===================
express.rawto parse bodies intoBufferexpress.textto parse bodies into stringres.sendFilenull/undefinedtores.statusX-Forwarded-Hostpb) supportSameSite=NonesupportContent-Security-Policyheaderpath.normalizecall103 Early Hintsthrowon invalid typev4.16.4Compare Source
===================
"Request aborted"may be logged inres.sendfileRouterconstructorv4.16.3Compare Source
===================
%as last characterv4.16.2Compare Source
===================
TypeErrorinres.sendwhen givenBufferandETagheader setX-Forwarded-Protoheaderv4.16.1Compare Source
===================
rootis incorrectly set to a filev4.16.0Compare Source
===================
"json escape"setting forres.jsonandres.jsonpexpress.jsonandexpress.urlencodedto parse bodiesoptionsargument tores.downloadBufferencoding when not generating ETag for small responsesafe-bufferfor improved Buffer APIres.headersSentwhen availableRegExpX-Forwarded-ForX-Forwarded-Forheaderimmutableoption</html>in default error & redirectsimmutableoption.charsetset inres.jsonpv4.15.5Compare Source
===================
If-None-Matchtoken parsingIf-Matchtoken parsingv4.15.4Compare Source
===================
Bufferloadingv4.15.3Compare Source
===================
res.setcannot add charset toContent-TypeDEBUG_MAX_ARRAY_LENGTH</html>in HTML documentv4.15.2Compare Source
===================
[v4.15.1Compare Source
===================
Date.parsedoes not returnNaNon invalid dateDate.parsedoes not returnNaNon invalid datev4.15.0Compare Source
===================
next("router")to exit from routerrouter.useskipped requests routes did notres._headersprivate fieldreq.urlis not set%oin path debug to tell types apartObject.createto setup request & response prototypessetprototypeofmodule to replace__proto__settingstatusesinstead ofhttpmodule for status messagesDEBUG_FDenvironment variable set to3or highererrcannot be converted to a stringContent-Security-Policy: default-src 'self'headerno-cacherequest directiveIf-None-Matchhas both*and ETagsETagmatching to match specIf-None-Matchwhen noETagheaderDate.parseinstead ofnew Dateno-cacherequest directiveIf-None-Matchhas both*and ETagsETagmatching to match specres._headersprivate fieldIf-MatchandIf-Unmodified-Sinceheadersres.getHeaderNames()when availableres.headersSentwhen availableno-cacherequest directiveIf-None-Matchhas both*and ETagsETagmatching to match specres._headersprivate fieldIf-MatchandIf-Unmodified-Sinceheadersres.getHeaderNames()when availableres.headersSentwhen available*routereq.ipsperformancev4.14.1Compare Source
===================
err.headersis not an objectv4.14.0Compare Source
===================
acceptRangesoption tores.sendFile/res.sendfilecacheControloption tores.sendFile/res.sendfileoptionsargument toreq.rangecombineoptionres.location/res.redirectif not already encodedres.sendFile/res.sendfilereq.get()res.json/res.jsonpin most casesRangeheader handling inres.sendFile/res.sendfileAcceptparsingAcceptparameters with quoted equalsAcceptparameters with quoted semicolonssameSiteoptionMax-Ageto never be a floating point numberencodeis not a functionexpiresis not aDateserializeerr.statusCodeiferr.statusis invaliderr.headersobjectstatusesinstead ofhttpmodule for status messagesdecoderoption inparsefunctioncombineoption to combine overlapping rangesacceptRangesoptioncacheControloptionStreamclassContent-Rangeheader in 416 responses when usingstart/endoptionsContent-Rangeheader missing from default 416 responsespathcontains raw non-URL characterspathstarts with multiple forward slashesRangeheadersacceptRangesoptioncacheControloptionreq.urlcontains raw non-URL charactersRangeheadersfieldargumentv4.13.4Compare Source
===================
serializev4.13.3Compare Source
===================
mergeParams: truereq.paramsv4.13.2Compare Source
===================
v4.13.1Compare Source
===================
hasOwnPropertyv4.13.0Compare Source
===================
res.formaterror when onlydefaultprovidednext('route')inapp.paramwould incorrectly skip valuesdecodeURIComponentURIErrors are a 400*before params in routesres.cookieto callres.appendarray-flattenmodule for flattening arraysstatusCodeproperty onErrorobjectsunpipemodule for unpiping requestsETagmatching supportCONNECTrequestsUpgraderequestsDateresponse headerContent-Locationon 304 responsehttp-errorsfor standard emitted errorsstatusesinstead ofhttpmodule for status messagesfallthroughoptionnext()instead of 400app.rendertry blockViewhttp.STATUS_CODESv4.12.4Compare Source
===================
deps: accepts@~1.2.7
deps: debug@~2.2.0
deps: depd@~1.0.1
deps: etag@~1.6.0
fsdeps: finalhandler@0.3.6
deps: on-finished@~2.2.1
isFinished(req)when data buffereddeps: proxy-addr@~1.0.8
deps: qs@2.4.2
Fix allowing parameters like
constructordeps: send@0.12.3
deps: serve-static@~1.9.3
deps: type-is@~1.6.2
v4.12.3Compare Source
===================
hasOwnPropertyis presentextensionsorindexoptionsv4.12.2Compare Source
===================
"Request aborted"is logged usingres.sendFilev4.12.1Compare Source
===================
ECONNRESETerrors fromres.sendFileusagereq.hostwhen using "trust proxy" hops countreq.protocol/req.securewhen using "trust proxy" hops countcodeon aborted connections fromres.sendFilev4.12.0Compare Source
===================
"trust proxy"setting to inherit when app is mountedETags for all request responsesGETandHEADrequestscontent-typeto parseContent-TypeheadersoptionshasBodyTransfer-Encodingcheck*/*)v4.11.2Compare Source
===================
res.redirectdouble-callingres.endforHEADrequestsv4.11.1Compare Source
===================
v4.11.0Compare Source
===================
res.append(field, val)to append headers:innameforapp.param(name, fn)req.param()-- usereq.params,req.body, orreq.queryinsteadapp.param(fn)OPTIONSresponses to include theHEADmethod properlyres.sendFilenot always detecting aborted connectionv4.10.8Compare Source
===================
OPTIONSresponse handlerv4.10.7Compare Source
===================
Allowheader forOPTIONSto not contain duplicate methodsres.sendFilewhenHEADor 304v4.10.6Compare Source
===================
req.fresh/req.stalewithout response headersv4.10.5Compare Source
===================
res.senddouble-callingres.endforHEADrequestsv4.10.4Compare Source
===================
res.sendfilelogging standard write errorsv4.10.3Compare Source
===================
res.sendFilelogging standard write errorsarrayLimitbehaviorv4.10.2Compare Source
===================
v4.10.1Compare Source
===================
://in the pathv4.10.0Compare Source
===================
app.set('views', array)res.send(status)to mentionres.sendStatus(status)content-dispositionmodule forres.attachment/res.downloadContent-Dispositionheaderpath.resolvein view lookupDEBUG_FDenv variable supporton-finishedto determine request statusv4.9.8Compare Source
==================
res.redirectbody when redirect status specifiedv4.9.7Compare Source
==================
v4.9.6Compare Source
==================
v4.9.5Compare Source
==================
forwardednpm modulev4.9.4Compare Source
==================
v4.9.3Compare Source
==================
v4.9.2Compare Source
==================
pathinapp.userouter.useto accept array of middleware without pathapp.useargumentsv4.9.1Compare Source
==================
app.useto accept array of middleware without pathv4.9.0Compare Source
==================
res.sendStatusres.sendFile,res.sendfile, andres.downloaderrwill be populated with request aborted errorreq.subdomainsetagto generateETagheadersmime-typesX-Content-Type-Options: nosniffheaderlastModifiedoptionetagto generateETagheaderlastModifiedoptionhasbodyto be true forcontent-length: 0Varyheader string asfieldv4.8.8Compare Source
==================
rootv4.8.7Compare Source
==================
v4.8.6Compare Source
==================
v4.8.5Compare Source
==================
v4.8.4Compare Source
==================
fdleak in Node.js 0.10 forfs.ReadStreamv4.8.3Compare Source
==================
req.originalUrlvaluesv4.8.2Compare Source
==================
v4.8.1Compare Source
==================
res.downloadv4.8.0Compare Source
==================
res.sendFilerootoption specifiedres.sendfile-- useres.sendFileinsteadapp.use()extensionsoptionextensionsoptionv4.7.4Compare Source
==================
res.sendfileregression for serving directory index filesv4.7.3Compare Source
==================
v4.7.2Compare Source
==================
v4.7.1Compare Source
==================
Error.stackTraceLimitis too lowv4.7.0Compare Source
==================
req.protocolfor proxy-direct connectionsapp.set('query parser', parser)app.set('query parser', 'extended')parse with "qs" moduleapp.set('query parser', 'simple')parse with "querystring" core moduleapp.set('query parser', false)disable query string parsingapp.set('query parser', true)enable simple parsingres.json(status, obj)-- useres.status(status).json(obj)insteadres.jsonp(status, obj)-- useres.status(status).jsonp(obj)insteadres.send(status, body)-- useres.status(status).send(body)insteadTRACE_DEPRECATIONenvironment variable--no-deprecationargument--trace-deprecationargumentRegExpdotfilesoptionmaxAgevalue to 1 yearBuffercreation inres.sendv4.6.1Compare Source
==================
subapp.mountpathregression forapp.use(subapp)v4.6.0Compare Source
==================
app.use()req.param(name, fn)handlersres.redirect(url, status)-- useres.redirect(status, url)insteadres.send(status, num)to sendnumas json (not error)res.jsonpreturns JSON responsepathinapp.use(path, fn)RegExptryblocksapp.use(fn)CONNECTresmethodsv4.5.1Compare Source
==================
req.methodv4.5.0Compare Source
==================
req.accepts*res.send(body, status)res.vary()headersoption tores.sendfilemergeParamsoption toRouterreq.paramsfrom parent routesreq.hostname-- correct name for whatreq.hostreturnsdepdmodulereq.host-- usereq.hostnameinsteadroute.allis only routerouter.param()only when route matchesreq.paramsafter invoking routerfinalhandlerfor final response handlingmedia-typerto alter content-type charsetmaxage(converted byms)maxAge(converted byms)setHeadersoptionv4.4.5Compare Source
==================
v4.4.4Compare Source
==================
res.attachmentUnicode filenames in Safariexpress:routerv4.4.3Compare Source
==================
req.params[name]fromapp.param()escape-htmlfor HTML escapingv4.4.2Compare Source
==================
varymodule forres.varyv4.4.1Compare Source
==================
max-ageinCache-Controlin correct formatescape-htmlfor escapingv4.4.0Compare Source
==================
app.set('etag', val)app.set('etag', function(body, encoding){ return '"etag"' })custom etag generationapp.set('etag', 'weak')weak tagapp.set('etag', 'strong')strong etagapp.set('etag', false)turn offapp.set('etag', true)standard etagres.sendETag as weak and reduce collisionsv4.3.2Compare Source
==================
router.param()callbacksv4.3.1Compare Source
==================
app.VERBfor the same path"v4.3.0Compare Source
==================
req.baseUrlto access the path stripped fromreq.urlin routesapp.VERBfor the same pathrouter.param()only when necessary instead of every matchapp.set('trust proxy', trust)app.set('trust proxy', 1)trust first hopapp.set('trust proxy', 'loopback')trust loopback addressesapp.set('trust proxy', '10.0.0.1')trust single IPapp.set('trust proxy', '10.0.0.1/16')trust subnetapp.set('trust proxy', '10.0.0.1, 10.0.0.2')trust listapp.set('trust proxy', false)turn offapp.set('trust proxy', true)trust everythingcharsetinContent-Typeforres.sendv4.2.0Compare Source
==================
app.del()-- useapp.delete()insteadres.json(obj, status)-- useres.json(status, obj)insteadres.json(status, num)requiresres.status(status).json(num)res.jsonp(obj, status)-- useres.jsonp(status, obj)insteadres.jsonp(status, num)requiresres.status(status).jsonp(num)req.nextwhen inside router instanceETagheader inHEADrequestsContent-Typeforres.jsonpapp.purgerouter.purgeapp.allenable()methodv4.1.2Compare Source
==================
req.hostfor IPv6 literalsres.jsonperror if callback param is objectv4.1.1Compare Source
==================
v4.1.0Compare Source
==================
res.sendfiletosendres.headerandres.setres.attachmentandres.downloadsendmodulemultipartas a shorthandv4.0.0Compare Source
==================
express.createServer()- it has been deprecated for a long time. Useexpress()app.configure- use logic in your own app codeapp.router- is removedreq.auth- usebasic-authinsteadreq.accepted*- usereq.accepts*()insteadres.location- relative URL resolution is removedres.charset- include the charset in the content type when usingres.set()staticapp.route->app.mountpathwhen mounting an express app in another express appjson spacesno longer enabled by default in developmentreq.accepts*->req.accepts*s- i.e.req.acceptsEncoding->req.acceptsEncodingsreq.paramsis now an object instead of an arrayres.localsis no longer a function. It is a plain js object. Treat it as such.res.headerSent->res.headersSentto match node.js ServerResponse objectreq.accepts*with acceptsreq.iswith type-isapp.router()- returns the app Router instanceapp.route()- Proxy to the app'sRouter#route()method to create a new routev3.21.2Compare Source
===================
fieldv3.21.1Compare Source
===================
v3.21.0[Compare Source](https://togithub.com/expressjs/expres
Renovate configuration
📅 Schedule: "" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻️ Rebasing: Whenever PR becomes conflicted, or if you modify the PR title to begin with "
rebase!".🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot. View repository job log here.