Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk-dev] Fix for 12 vulnerabilities #136

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk-dev] Fix for 12 vulnerabilities #136

wants to merge 1 commit into from
+923 −3,767

Conversation

miri-yehezkel
Copy link
Owner

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • service/package.json
    • service/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-ASYNC-2441827		 No Proof of Concept
high severity 706/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.7		 Remote Memory Exposure
SNYK-JS-BL-608877		 No Proof of Concept
high severity 696/1000
Why? Recently disclosed, Has a fix available, CVSS 8.2		 Asymmetric Resource Consumption (Amplification)
SNYK-JS-BODYPARSER-7926860		 No No Known Exploit
medium severity 541/1000
Why? Recently disclosed, Has a fix available, CVSS 5.1		 Cross-site Scripting
SNYK-JS-EXPRESS-7926867		 No No Known Exploit
medium severity 504/1000
Why? Has a fix available, CVSS 5.8		 Prototype Pollution
SNYK-JS-HIGHLIGHTJS-1045326		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HIGHLIGHTJS-1048676		 No No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 No Proof of Concept
low severity 391/1000
Why? Recently disclosed, Has a fix available, CVSS 2.1		 Cross-site Scripting
SNYK-JS-SEND-7926862		 No No Known Exploit
low severity 391/1000
Why? Recently disclosed, Has a fix available, CVSS 2.1		 Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865		 No No Known Exploit
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-Y18N-1021887		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: body-parser The new version differs by 250 commits.

See the full diff

Package name: express The new version differs by 250 commits.
  • 7e562c6 4.21.0
  • 1bcde96 fix(deps): qs@6.13.0 (#5946)
  • 7d36477 fix(deps): serve-static@1.16.2 (#5951)
  • 40d2d8f fix(deps): finalhandler@1.3.1
  • 77ada90 Deprecate `"back"` magic string in redirects (#5935)
  • 21df421 4.20.0
  • 4c9ddc1 feat: upgrade to serve-static@0.16.0
  • 9ebe5d5 feat: upgrade to send@0.19.0 (#5928)
  • ec4a01b feat: upgrade to body-parser@1.20.3 (#5926)
  • 54271f6 fix: don't render redirect values in anchor href
  • 125bb74 path-to-regexp@0.1.10 (#5902)
  • 2a980ad merge-descriptors@1.0.3 (#5781)
  • a3e7e05 docs: specify new instructions for `question` and `discuss`
  • c5addb9 deps: path-to-regexp@0.1.8 (#5603)
  • e35380a docs: add @ IamLizu to the triage team (#5836)
  • f5b6e67 docs: update scorecard link (#5814)
  • 2177f67 docs: add OSSF Scorecard badge (#5436)
  • f4bd86e Replace Appveyor windows testing with GHA (#5599)
  • 2ec589c Fix Contributor Covenant link definition reference in attribution section (#5762)
  • 4cf7eed remove minor version pinning from ci (#5722)
  • 6d08471 📝 update people, add ctcpip to TC (#5683)
  • 61421a8 skip QUERY tests for Node 21 only, still not supported (#5695)
  • f42b160 [v4] Deprecate `res.clearCookie` accepting `options.maxAge` and `options.expires` (#5672)
  • 689073d ✨ bring back query tests for node 21 (#5690)

See the full diff

Package name: hbs The new version differs by 34 commits.
  • a992f58 v4.0.5
  • aed9d51 deps: handlebars@4.3.3
  • 2f12c5e tests: add tests for handling helper errors
  • c3826ee tests: run express 4.x tests on Node.js 0.10
  • 19b90c4 Fix handling of exceptions from layout
  • 39434ad Fix handling of exceptions when cache enabled
  • e00c762 build: Node.js@12.11
  • 891014a Fix async helpers not working when cache enabled
  • 80fe665 build: supertest@4.0.2
  • c933e32 build: mocha@6.2.0
  • 9e75303 lint: remove multiple empty lines
  • 9d7ebbd lint: add basic eslint configuration
  • 512d1e2 tests: express@~4.17.1
  • 617aa06 tests: run express tests on appropriate Node.js versions
  • 7980b82 tests: fix mocha suite marker locations
  • dc367f3 build: support Node.js 12.x
  • c3f140f build: use nyc for test coverage
  • 4197b80 tests: use spec reporter
  • badaf7b tests: ensure mocha suite separation
  • 1fe9061 build: skip shrinkwrap generation
  • a18e55c build: mocha@2.5.3
  • 6e4ddf2 tests: clean up installed express libraries
  • 3009206 deps: handlebars@4.1.2
  • d5e01bc build: increase test timeout for npm install

See the full diff

Package name: mongodb The new version differs by 236 commits.
  • dfb03ad chore(release): 3.6.6
  • 5a0d706 chore: reintroduce nodejs fermium testing (#2775)
  • af49ba3 test(NODE-3070): Ensure that SDAM should ignore the writeErrors field (#2769)
  • 312ffef fix(NODE-3109): prevent servername from being IP (#2763)
  • 9256242 fix(NODE-2995): Add shared metadata MongoClient (#2760)
  • 91ba19e fix: ensure cursor readPreference is applied to find operations (#2751)
  • f2a4ff8 fix: no infinite loop on windows requiring optional deps
  • 86bddf1 fix(csfle): ensure that monitoring connections are not encrypted (#2749)
  • b94519b fix: ensure monitor has rtt pinger in when calculating rtt (#2757)
  • c976a01 fix: always close gridfs upload stream on finish (#2758)
  • 6887e8d chore(release): 3.6.5
  • 8b370a7 fix: move session support check to operation layer (#2739)
  • 2d76492 chore: boron node version test failures (#2747)
  • 8bd9777 fix: use emitWarning API for internal messages (#2743)
  • d67ffa7 fix: MongoError circular dependency warning (#2734)
  • 9baec71 fix: session support detection spec compliance (#2732)
  • e8ac558 test: restrict destroy test to versions of node that support it (#2728)
  • db1ab0b chore: format readme and add note about 4.0 beta (#2729)
  • a485346 chore(release): 3.6.4
  • 2fffb52 test: Adding test for cursor cloning removing session (#2723)
  • 6314f5a chore(ci): fix aws auth tests (#2720)
  • 617d9de fix: restore auto direct connection behavior (#2719)
  • 8082c89 fix(cursor): don't use other operation's session for cloned cursor operation (#2705)
  • f89e4c1 fix: dont parse tls/ssl file paths in uri (#2718)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Cross-site Scripting

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@miri-yehezkel @snyk-bot