[Snyk] Upgrade: , ws, , , axios, express, fastify, geolib, jsonwebtoken, prisma, socket.io, tsx, zod #72
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade:
- @fastify/cors from 8.2.1 to 8.5.0.
See this package in npm: https://www.npmjs.com/package/@fastify/cors
- ws from 8.13.0 to 8.18.0.
See this package in npm: https://www.npmjs.com/package/ws
- @googlemaps/google-maps-services-js from 3.3.28 to 3.4.0.
See this package in npm: https://www.npmjs.com/package/@googlemaps/google-maps-services-js
- @prisma/client from 4.12.0 to 4.16.2.
See this package in npm: https://www.npmjs.com/package/@prisma/client
- axios from 1.3.4 to 1.7.6.
See this package in npm: https://www.npmjs.com/package/axios
- express from 4.18.2 to 4.19.2.
See this package in npm: https://www.npmjs.com/package/express
- fastify from 4.15.0 to 4.28.1.
See this package in npm: https://www.npmjs.com/package/fastify
- geolib from 3.3.3 to 3.3.4.
See this package in npm: https://www.npmjs.com/package/geolib
- jsonwebtoken from 9.0.0 to 9.0.2.
See this package in npm: https://www.npmjs.com/package/jsonwebtoken
- prisma from 4.12.0 to 4.16.2.
See this package in npm: https://www.npmjs.com/package/prisma
- socket.io from 4.6.1 to 4.7.5.
See this package in npm: https://www.npmjs.com/package/socket.io
- tsx from 3.12.6 to 3.14.0.
See this package in npm: https://www.npmjs.com/package/tsx
- zod from 3.21.4 to 3.23.8.
See this package in npm: https://www.npmjs.com/package/zod
See this project in Snyk:
https://app.snyk.io/org/guilherme-joviniano/project/6861592c-8858-4cff-a938-3713fd0bf06e?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade multiple dependencies.
👯♂ The following dependencies are linked and will therefore be updated together.ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
@fastify/cors
from 8.2.1 to 8.5.0 | 5 versions ahead of your current version | 9 months ago
on 2023-12-18
ws
from 8.13.0 to 8.18.0 | 9 versions ahead of your current version | 3 months ago
on 2024-07-03
@googlemaps/google-maps-services-js
from 3.3.28 to 3.4.0 | 15 versions ahead of your current version | 5 months ago
on 2024-04-09
@prisma/client
from 4.12.0 to 4.16.2 | 651 versions ahead of your current version | a year ago
on 2023-06-30
axios
from 1.3.4 to 1.7.6 | 24 versions ahead of your current version | 22 days ago
on 2024-08-30
express
from 4.18.2 to 4.19.2 | 4 versions ahead of your current version | 6 months ago
on 2024-03-25
fastify
from 4.15.0 to 4.28.1 | 30 versions ahead of your current version | 3 months ago
on 2024-06-29
geolib
from 3.3.3 to 3.3.4 | 1 version ahead of your current version | a year ago
on 2023-06-01
jsonwebtoken
from 9.0.0 to 9.0.2 | 2 versions ahead of your current version | a year ago
on 2023-08-30
prisma
from 4.12.0 to 4.16.2 | 651 versions ahead of your current version | a year ago
on 2023-06-30
socket.io
from 4.6.1 to 4.7.5 | 7 versions ahead of your current version | 6 months ago
on 2024-03-14
tsx
from 3.12.6 to 3.14.0 | 6 versions ahead of your current version | a year ago
on 2023-10-17
zod
from 3.21.4 to 3.23.8 | 93 versions ahead of your current version | 4 months ago
on 2024-05-08
Issues fixed by the recommended upgrade:
SNYK-JS-AXIOS-7361793
SNYK-JS-ENGINEIO-5496331
SNYK-JS-AXIOS-6032459
SNYK-JS-AXIOS-6032459
SNYK-JS-AXIOS-6144788
SNYK-JS-SOCKETIOPARSER-5596892
SNYK-JS-ZOD-5925617
SNYK-JS-FOLLOWREDIRECTS-6141137
SNYK-JS-SEMVER-3247795
SNYK-JS-SOCKETIO-7278048
SNYK-JS-EXPRESS-6474509
SNYK-JS-AXIOS-6124857
SNYK-JS-AXIOS-6124857
SNYK-JS-FINDMYWAY-8055229
SNYK-JS-FOLLOWREDIRECTS-6444610
Release notes
Package name: @fastify/cors
-
8.5.0 - 2023-12-18
- chore(deps): bump mnemonist from 0.39.5 to 0.39.6 by @ dependabot in #283
- Revert "fix: support for embedded cors for route params (#278)" by @ climba03003 in #285
-
8.4.2 - 2023-12-04
- build(dependabot): ignore tap major updates by @ Fdawgs in #276
- fix: support for embedded cors for route params by @ mohammedSlimani in #278
- @ mohammedSlimani made their first contribution in #278
-
8.4.1 - 2023-10-29
- Fix type of OriginCallback by @ ken-browning in #272
- test: add
- chore(package): explicitly declare js module type by @ Fdawgs in #274
- test(index): replace
- @ ken-browning made their first contribution in #272
-
8.4.0 - 2023-09-19
- fix documentation, onRequest is default lifecycle stage by @ Uzlopak in #254
- perf(index): use spread over
- docs(readme): add plugin compatibility table by @ Fdawgs in #258
- test: cors headers sent when payload is stream by @ Uzlopak in #260
- Reduce bundle size by @ timedtext in #266
- chore(deps-dev): bump @ typescript-eslint/eslint-plugin from 5.62.0 to 6.4.1 by @ dependabot in #267
- chore(deps-dev): bump tsd from 0.28.1 to 0.29.0 by @ dependabot in #268
- test: use
- refactor(vary): use word character inside regex character class by @ Fdawgs in #270
- @ timedtext made their first contribution in #266
-
8.3.0 - 2023-05-25
- chore(deps-dev): bump typescript from 4.9.5 to 5.0.2 by @ dependabot in #247
- chore(deps-dev): bump tsd from 0.27.0 to 0.28.0 by @ dependabot in #248
- ci: only trigger on pushes to main branches by @ Fdawgs in #249
- chore(deps-dev): bump @ types/node from 18.16.5 to 20.1.0 by @ dependabot in #250
- Add
- @ brettwillis made their first contribution in #252
-
8.2.1 - 2023-03-14
- chore(deps-dev): bump tsd from 0.24.1 to 0.25.0 by @ dependabot in #235
- fix(types): Origin within OriginFunction can be undefined by @ joshmeads in #237
- chore(.gitignore): add clinic by @ Fdawgs in #239
- chore(.gitignore): add bun lockfile by @ Fdawgs in #241
- chore(deps-dev): bump tsd from 0.25.0 to 0.26.0 by @ dependabot in #242
- chore(deps-dev): bump tsd from 0.26.1 to 0.27.0 by @ dependabot in #245
- add normalizeCorsOptions and handle wildcards in origin parameter by @ Uzlopak in #244
- @ joshmeads made their first contribution in #237
from @fastify/cors GitHub release notesWhat's Changed
Full Changelog: v8.4.2...v8.5.0
What's Changed
New Contributors
Full Changelog: v8.4.1...v8.4.2
What's Changed
uunicode flag to regex by @ Fdawgs in #273typeofundefined check by @ Fdawgs in #275New Contributors
Full Changelog: v8.4.0...v8.4.1
What's Changed
Object.assign()by @ Fdawgs in #257node:prefix to bypass require.cache call for builtins by @ Fdawgs in #269New Contributors
Full Changelog: v8.3.0...v8.4.0
What's Changed
cacheControlto control caching in CDN by @ brettwillis in #252New Contributors
Full Changelog: v8.2.1...v8.3.0
What's Changed
New Contributors
Full Changelog: v8.2.0...v8.2.1
Package name: ws
-
8.18.0 - 2024-07-03
- Added support for
-
8.17.1 - 2024-06-16
- Fixed a DoS vulnerability (#2231).
const http = require('http');
- Reduce the maximum allowed length of the request headers using the
- Set
-
8.17.0 - 2024-04-28
- The
- The default value of the
-
8.16.0 - 2023-12-26
- Added the
-
8.15.1 - 2023-12-12
- The
-
8.15.0 - 2023-12-09
- Added the
-
8.14.2 - 2023-09-19
- Fixed an issue that allowed errors thrown by failed assertions to be
-
8.14.1 - 2023-09-08
-
8.14.0 - 2023-09-06
-
8.13.0 - 2023-03-10
from ws GitHub release notesFeatures
Blob(#2229).Bug fixes
A request with a number of headers exceeding the
server.maxHeadersCountthreshold could be used to crash a ws server.
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in #2230.
In vulnerable versions of ws, the issue can be mitigated in the following ways:
--max-http-header-size=sizeand/or themaxHeaderSizeoptions sothat no more headers than the
server.maxHeadersCountlimit can be sent.server.maxHeadersCountto0so that no limit is applied.Features
WebSocketconstructor now accepts thecreateConnectionoption (#2219).Other notable changes
allowSynchronousEventsoption has been changed totrue(#2221).This is a breaking change in a patch release. The assumption is that the option
is not widely used.
Features
autoPongoption (01ba54e).Notable changes
allowMultipleEventsPerMicrotaskoption has been renamed toallowSynchronousEvents(4ed7fe5).This is a breaking change in a patch release that could have been avoided with
an alias, but the renamed option was added only 3 days ago, so hopefully it
hasn't already been widely used.
Features
allowMultipleEventsPerMicrotaskoption (93e3552).Bug fixes
swallowed when running tests (7f4e1a7).
Package name: @googlemaps/google-maps-services-js
3.4.0 (2024-04-09)
Features
3.3.42 (2023-12-12)
Build System
Miscellaneous Chores
Tests