[Snyk] Upgrade: bcrypt, body-parser, ethers, ethr-did, express, path-to-regexp, module-alias, npm, swagger-ui-express, web-did-resolver, web3, winston, ws #66

rish2497 · 2024-09-15T07:14:19Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

bcrypt
from 5.0.1 to 5.1.1 | 2 versions ahead of your current version | a year ago
on 2023-08-16
body-parser
from 1.19.2 to 1.20.2 | 3 versions ahead of your current version | 2 years ago
on 2023-02-22
ethers
from 5.5.4 to 5.7.2 | 13 versions ahead of your current version | 2 years ago
on 2022-10-19
ethr-did
from 2.2.0 to 2.3.23 | 24 versions ahead of your current version | a year ago
on 2023-09-27
express
from 4.17.3 to 4.19.2 | 7 versions ahead of your current version | 6 months ago
on 2024-03-25
path-to-regexp
from 6.2.0 to 6.2.2 | 2 versions ahead of your current version | 5 months ago
on 2024-04-07
module-alias
from 2.2.2 to 2.2.3 | 1 version ahead of your current version | a year ago
on 2023-06-03
npm
from 8.19.3 to 8.19.4 | 1 version ahead of your current version | 2 years ago
on 2023-02-14
swagger-ui-express
from 4.3.0 to 4.6.3 | 6 versions ahead of your current version | a year ago
on 2023-05-05
web-did-resolver
from 2.0.14 to 2.0.27 | 13 versions ahead of your current version | a year ago
on 2023-07-03
web3
from 1.8.1 to 1.10.4 | 13 versions ahead of your current version | 7 months ago
on 2024-02-05
winston
from 3.6.0 to 3.14.2 | 15 versions ahead of your current version | a month ago
on 2024-08-14
ws
from 7.5.7 to 7.5.10 | 3 versions ahead of your current version | 3 months ago
on 2024-06-16

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Regular Expression Denial of Service (ReDoS) SNYK-JS-ES5EXT-6095076	696	Proof of Concept
Improper Verification of Cryptographic Signature SNYK-JS-BROWSERIFYSIGN-6037026	696	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	696	No Known Exploit

Release notes

Package name: bcrypt

5.1.1 - 2023-08-16
What's Changed
- Refactored example with async await by @ lpizzinidev in #894
- Fixed z/OS build issue by @ laijonathan in #968
- Update dependencies by @ recrsn in #993
New Contributors
- @ lpizzinidev made their first contribution in #894
- @ laijonathan made their first contribution in #968
Full Changelog: v5.1.0...v5.1.1
5.1.0 - 2022-10-06
What's Changed
- Update node-pre-gyp to 1.0.2 by @ feuxfollets1013 in #865
- Update README for inclusion of musl by @ arbourd in #883
- Version bump, security updates to sub dep npmlog by @ adaniels-parabol in #905
- document ESM usage (#892) by @ mariusa in #899
- fix: update travis CI Docker image repository by @ cokia in #930
- Update node versions in appveyor test matrix by @ p-kuen in #936
- chore(appveyor): not use latest npm by @ cokia in #932
- chore: update Appveyor readme badge by @ cokia in #933
- Use Github actions for CI by @ recrsn in #858
- Update dependencies by @ recrsn in #953
- Migrate tests to use Jest by @ recrsn in #958
- Pin NAPI to v3 by @ recrsn in #959
New Contributors
- @ feuxfollets1013 made their first contribution in #865
- @ arbourd made their first contribution in #883
- @ adaniels-parabol made their first contribution in #905
- @ mariusa made their first contribution in #899
- @ cokia made their first contribution in #930
- @ p-kuen made their first contribution in #936
Full Changelog: v5.0.1...v5.1.0
5.0.1 - 2021-02-26
Update node-pre-gyp to 1.0.0

from bcrypt GitHub release notes

Package name: body-parser

1.20.2 - 2023-02-22
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
  - perf: skip value escaping when unnecessary
- deps: raw-body@2.5.2
1.20.1 - 2022-10-06
- deps: qs@6.11.0
- perf: remove unnecessary object clone
1.20.0 - 2022-04-03
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: http-errors@2.0.0
  - deps: depd@2.0.0
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
- deps: qs@6.10.3
- deps: raw-body@2.5.1
  - deps: http-errors@2.0.0
1.19.2 - 2022-02-16
- deps: bytes@3.1.2
- deps: qs@6.9.7
  - Fix handling of __proto__ keys
- deps: raw-body@2.4.3
  - deps: bytes@3.1.2

from body-parser GitHub release notes

Package name: ethers

5.7.2 - 2022-10-19
5.7.1 - 2022-09-14
5.7.0 - 2022-08-19
5.6.9 - 2022-06-18
5.6.8 - 2022-05-24
5.6.7 - 2022-05-21
5.6.6 - 2022-05-14
5.6.5 - 2022-05-03
5.6.4 - 2022-04-14
5.6.3 - 2022-04-13
5.6.2 - 2022-03-26
5.6.1 - 2022-03-16
5.6.0 - 2022-03-10
5.5.4 - 2022-01-31

from ethers GitHub release notes

Package name: ethr-did

2.3.23 - 2023-09-27
2.3.22 - 2023-09-24
2.3.21 - 2023-09-18
2.3.20 - 2023-09-04
2.3.19 - 2023-08-24
2.3.18 - 2023-08-04
2.3.17 - 2023-07-13
2.3.16 - 2023-07-12
2.3.15 - 2023-06-27
2.3.14 - 2023-06-08
2.3.13 - 2023-06-04
2.3.12 - 2023-05-18
2.3.10 - 2023-04-20
2.3.9 - 2023-03-29
2.3.6 - 2022-11-03
2.3.4 - 2022-10-19
2.3.3 - 2022-10-17
2.3.2 - 2022-10-13
2.3.0 - 2022-09-08
2.2.5 - 2022-09-06
2.2.4 - 2022-08-11
2.2.3 - 2022-06-06
2.2.2 - 2022-04-09
2.2.1 - 2022-04-06
2.2.0 - 2022-01-13

from ethr-did GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: body-parser@1.20.2
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: raw-body@2.5.2
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: Node.js@16.18 and Node.js@18.12 by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add Node.js@19.7 by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: body-parser@1.20.1
  - deps: qs@6.11.0
  - perf: remove unnecessary object clone
- deps: qs@6.11.0
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: body-parser@1.20.0
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: depd@2.0.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: qs@6.10.3
  - deps: raw-body@2.5.1
- deps: cookie@0.5.0
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: finalhandler@1.2.0
  - Remove set content headers that break response
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
  - Prevent loss of async hooks context
- deps: qs@6.10.3
- deps: send@0.18.0
  - Fix emitted 416 error missing headers property
  - Limit the headers removed for 304 response
  - deps: depd@2.0.0
  - deps: destroy@1.2.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: serve-static@1.15.0
  - deps: send@0.18.0
- deps: statuses@2.0.1
  - Remove code 306
  - Rename 425 Unordered Collection to standard 425 Too Early
4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
  - deps: mime-types@~2.1.34
  - deps: negotiator@0.6.3
- deps: body-parser@1.19.2
  - deps: bytes@3.1.2
  - deps: qs@6.9.7
  - deps: raw-body@2.4.3
- deps: cookie@0.4.2
- deps: qs@6.9.7
  - Fix handling of __proto__ keys
- pref: remove unnecessary regexp for trust proxy

from express GitHub release notes

Package name: path-to-regexp

6.2.2 - 2024-04-07
No API changes. Documentation only release.

Changed
- Fix readme example c7ec332
- Update shield URL e828000
v6.2.1...v6.2.2
6.2.1 - 2022-05-06
Fixed
- Fix invalid matching of :name* parameter (#261) 762bc6b
- Compare delimiter string over regexp 86baef8
Added
- New example in documentation (#256) ae9e576
- Update demo link (#250) 77df638
- Update README encode example b39edd4
v6.2.0...v6.2.1
6.2.0 - 2020-09-29
Added
- Support named capturing groups for RegExps (#225)
Fixed
- Update strict flag documentation (#227)
- Ignore test files when bundling (#220)

from path-to-regexp GitHub release notes

Package name: module-alias

2.2.3 - 2023-06-03
2.2.2 - 2019-10-01
Make module-alias work in cli mode #76

from module-alias GitHub release notes

Package name: npm

8.19.4 - 2023-02-14
8.19.4 (2023-02-14)

Documentation
- dd51f34 #6155 don't redirect "npm config' to itself (#6155) (@ ivanosevitch)
Dependencies
- cfab523 #6166 http-cache-semantics@4.1.1 (#6166)
8.19.3 - 2022-11-03

from npm GitHub release notes

Package name: swagger-ui-express

4.6.3 - 2023-05-05
Support for Express 5
4.6.2 - 2023-02-27
4.6.2
4.6.1 - 2023-02-18
No content.
4.6.0 - 2022-11-07
Accept array of external JS/CSS assets
4.5.0 - 2022-07-13
No content.
4.4.0 - 2022-05-13
4.4.0
4.3.0 - 2021-12-16
No content.

from swagger-ui-express GitHub release notes

Package name: web-did-resolver

2.0.27 - 2023-07-03
2.0.27 (2023-07-03)

Bug Fixes
- deps: update dependency cross-fetch to v4 (f8adfca)
2.0.26 - 2023-07-03
2.0.26 (2023-07-03)

Bug Fixes
- deps: update dependency cross-fetch to v3.1.8 (00834e6)
2.0.25 - 2023-07-02
2.0.25 (2023-07-02)

Bug Fixes
- deps: update dependency cross-fetch to v3.1.7 (92f7428)
2.0.24 - 2023-05-14
2.0.24 (2023-05-14)

Bug Fixes
- deps: update dependency cross-fetch to v3.1.6 (deb19d7)
2.0.23 - 2023-04-03
2.0.23 (2023-04-03)

Bug Fixes
- build: publish types in package.json (174afe8)
2.0.22 - 2023-03-23
2.0.22 (2023-03-23)

Bug Fixes
- deps: Update dependency did-resolver to v4.1.0 (81fa649)
2.0.21 - 2022-10-17
2.0.21 (2022-10-17)

Bug Fixes
- deps: Update dependency did-resolver to v4.0.1 (63d7fc2)
2.0.20 - 2022-08-03
2.0.20 (2022-08-03)

Bug Fixes
- deps: Update dependency did-resolver to v4 (74b825f)
2.0.19 -

Snyk has created this PR to upgrade: - bcrypt from 5.0.1 to 5.1.1. See this package in npm: https://www.npmjs.com/package/bcrypt - body-parser from 1.19.2 to 1.20.2. See this package in npm: https://www.npmjs.com/package/body-parser - ethers from 5.5.4 to 5.7.2. See this package in npm: https://www.npmjs.com/package/ethers - ethr-did from 2.2.0 to 2.3.23. See this package in npm: https://www.npmjs.com/package/ethr-did - express from 4.17.3 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - path-to-regexp from 6.2.0 to 6.2.2. See this package in npm: https://www.npmjs.com/package/path-to-regexp - module-alias from 2.2.2 to 2.2.3. See this package in npm: https://www.npmjs.com/package/module-alias - npm from 8.19.3 to 8.19.4. See this package in npm: https://www.npmjs.com/package/npm - swagger-ui-express from 4.3.0 to 4.6.3. See this package in npm: https://www.npmjs.com/package/swagger-ui-express - web-did-resolver from 2.0.14 to 2.0.27. See this package in npm: https://www.npmjs.com/package/web-did-resolver - web3 from 1.8.1 to 1.10.4. See this package in npm: https://www.npmjs.com/package/web3 - winston from 3.6.0 to 3.14.2. See this package in npm: https://www.npmjs.com/package/winston - ws from 7.5.7 to 7.5.10. See this package in npm: https://www.npmjs.com/package/ws See this project in Snyk: https://app.snyk.io/org/rish2497/project/eec3d01e-57f2-43e7-bf30-7929fd977ead?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: bcrypt, body-parser, ethers, ethr-did, express, path-to-regexp, module-alias, npm, swagger-ui-express, web-did-resolver, web3, winston, ws #66

[Snyk] Upgrade: bcrypt, body-parser, ethers, ethr-did, express, path-to-regexp, module-alias, npm, swagger-ui-express, web-did-resolver, web3, winston, ws #66

rish2497 commented Sep 15, 2024

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

8.19.4 (2023-02-14)

Documentation

Dependencies

2.0.27 (2023-07-03)

Bug Fixes

2.0.26 (2023-07-03)

Bug Fixes

2.0.25 (2023-07-02)

Bug Fixes

2.0.24 (2023-05-14)

Bug Fixes

2.0.23 (2023-04-03)

Bug Fixes

2.0.22 (2023-03-23)

Bug Fixes

2.0.21 (2022-10-17)

Bug Fixes

2.0.20 (2022-08-03)

Bug Fixes

[Snyk] Upgrade: bcrypt, body-parser, ethers, ethr-did, express, path-to-regexp, module-alias, npm, swagger-ui-express, web-did-resolver, web3, winston, ws #66

Are you sure you want to change the base?

[Snyk] Upgrade: bcrypt, body-parser, ethers, ethr-did, express, path-to-regexp, module-alias, npm, swagger-ui-express, web-did-resolver, web3, winston, ws #66

Conversation

rish2497 commented Sep 15, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

8.19.4 (2023-02-14)

Documentation

Dependencies

2.0.27 (2023-07-03)

Bug Fixes

2.0.26 (2023-07-03)

Bug Fixes

2.0.25 (2023-07-02)

Bug Fixes

2.0.24 (2023-05-14)

Bug Fixes

2.0.23 (2023-04-03)

Bug Fixes

2.0.22 (2023-03-23)

Bug Fixes

2.0.21 (2022-10-17)

Bug Fixes

2.0.20 (2022-08-03)

Bug Fixes