[Snyk] Fix for 5 vulnerabilities #2047

oritpersik · 2022-09-26T09:14:48Z

This PR was automatically created by Snyk using the credentials of a real user.

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
584/1000 Why? Has a fix available, CVSS 7.4	Authorization Bypass SNYK-JS-EXPRESSJWT-575022	Yes	No Known Exploit
484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	No	No Known Exploit
671/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7	Prototype Pollution SNYK-JS-MONGOOSE-2961688	No	Proof of Concept
454/1000 Why? Has a fix available, CVSS 4.8	Session Fixation SNYK-JS-PASSPORT-2840631	No	No Known Exploit
484/1000 Why? Has a fix available, CVSS 5.4	User Interface (UI) Misrepresentation of Critical Information SNYK-JS-SWAGGERUIDIST-2314884	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: express-jwt

The new version differs by 3 commits.

Package name: mongoose

The new version differs by 250 commits.

5449ab9 chore: release 6.4.6
b8c99cf Merge pull request #11892 from Automattic/netlify-functions-example
2751883 fix tests
eced2c7 Merge branch 'master' into netlify-functions-example
92cb6fb Merge branch 'master' into vkarpov15/gh-12085
422f9da test(schema): add coverage for calling `plugin()` with options
2262a77 fix(document): avoid mutating original object passed to $set() when applying defaults to nested properties
2e6b064 made requested changes
b70a0dc Merge pull request #12123 from LokeshKanumoori/patch-1
086bd9f fix(query): apply lean transform option to top-level document
1344214 Update migrating_to_6.md
a45cfb6 fix(schema): disallow setting __proto__ when creating schema with dotted properties
bc302f4 chore: release 6.4.5
44530a6 Merge pull request #12116 from Automattic/revert-12103-upgrade-mongo-driver
80b7d53 Revert "chore: upgrade mongodb driver to 4.8.0"
0156d5e style: fix lint
9524f89 fix(types): make `$addToSet` fields mutable to allow programatically constructing $addToSet
201071b fix(types): allow any value for AddFields
5301deb fix: cleanup and various updates
118c97a Merge branch 'master' into netlify-functions-example
1306d00 Merge pull request #12086 from hasezoey/modelJSDOCTouchup
f95373d Merge pull request #12110 from skrtheboss/fix/is-atlas-check
1445c20 Merge pull request #12112 from pathei-kosmos/master
250b01b fix(types): avoid treating `| undefined` types as `any` in `Require_id` to better support `_id: String` with auto-typed schemas

Package name: nodemon

The new version differs by 18 commits.

27e91c3 fix: update packge-lock
0144e4f fix: bump update-notifier to v6.0.0 (The GitHub About description still says Angular 6 #2029)
c870342 chore: update supporters
5c0b472 chore: add supporter
e26aaa9 fix: support windows by using path.delimiter
9d1afd7 docs: add syntax highlighting to sample-nodemon.md (fix: remove redundant auth prefix that lead to /auth/auth/login #1982) ([Snyk] Security upgrade @angular/core from 11.0.3 to 11.0.5 #2004)
de5d32a docs: Unified Node.js capitalization ([Snyk] Fix for 3 vulnerabilities #1986)
e890927 docs: add note to faq with example showing how to watch any file extension ([Snyk] Fix for 1 vulnerable dependencies #1931)
bc4547b chore: update sponsors
07159c5 chore: add supporters
cd100da chore: update supporters
6a34922 chore: supporters
e5d6067 chore: updating supporters
242f9f7 Merge branch 'main' of github.com:remy/nodemon
141e58c chore: update supporters
53422af ci(release): workflow uses 'npm' cache (Unexpected end of JSON input while parsing near #1933)
581c641 ci(node.js): workflow uses 'npm' cache (@angular/flex-layout issue in new project #1934)
cb1c8b9 docs: Fix typo in faq.md (nodemon error #1950)

Package name: passport

The new version differs by 100 commits.

c33067b 0.6.0
3052bb4 Update changelog.
42630cb Merge pull request add documentation for $viewPathProvider #900 from jaredhanson/fix-fixation
8dd79fe Use utils-merge rather than Object.assign for compatibility.
4f6bd5b Change keepSessionData to keepSessionData.
46756e5 Silence verbose logging.
987b191 Add tests.
f8a175f Add tests.
29a90d6 No need to guard callback existence.
bfba8a1 Add tests.
17111d7 Add option to keep session data on logout.
a349c2b Add option to keep session data.
e69834e Add optional options to login and logout.
8825a9a Add tests.
c1991cf Add tests.
294f22c Better session detection and exceptions.
80cc4e3 Add tests.
3001654 Add tests.
b395106 Clean up tests.
cfa8259 Add tests.
ee0bf81 Add tests.
cc7606c Add tests.
71c54f6 Add test.
88c1f1b Handle logout without session manager.

Package name: swagger-ui-express

The new version differs by 12 commits.

aa3d56a Bumped version of swagger-ui-dist and moved js template usage
ff10df4 Update README.md
fe789d8 Update README.md
d07439b Merge pull request Port configuration for passport in production environment. #270 from jdgarcia/security-update
9011cdf Merge pull request Would there be any integration with sockjs or socket.io soon? Thanx. #269 from artyhedgehog/patch-1
e09c35f update swagger-ui-dist dependency to fix security vulnerabilities
de8e7eb readme: fix broken link to swagger-jsdoc
5824af0 Merge pull request use consolidate to make template engine configurable #236 from H3nSte1n/feature/Add_converage_section_to_readme
da7b5ff feat: Remove Coverage headline from README
b46e892 feat: Add coverage section to README
feb0664 Merge pull request Enhancement routes refactor #235 from tingstad/patch-1
1699685 Update README - two swagger documents (typo)