[Snyk] Upgrade: , , body-parser, dotenv, express, express-jwt, formidable, mongodb, mongoose, webpack, webpack-merge, webpack-dev-server #350

rawdaymohamed · 2024-09-20T14:39:19Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@babel/node
from 7.18.10 to 7.25.0 | 22 versions ahead of your current version | 2 months ago
on 2024-07-26
@csstools/normalize.css
from 12.0.0 to 12.1.1 | 2 versions ahead of your current version | 9 months ago
on 2023-12-29
body-parser
from 1.20.0 to 1.20.2 | 2 versions ahead of your current version | 2 years ago
on 2023-02-22
dotenv
from 16.0.2 to 16.4.5 | 18 versions ahead of your current version | 7 months ago
on 2024-02-20
express
from 4.18.1 to 4.19.2 | 5 versions ahead of your current version | 6 months ago
on 2024-03-25
express-jwt
from 7.7.5 to 7.7.8 | 3 versions ahead of your current version | 3 months ago
on 2024-06-24
formidable
from 2.0.1 to 2.1.2 | 3 versions ahead of your current version | 2 years ago
on 2022-12-01
mongodb
from 4.9.0 to 4.17.2 | 12 versions ahead of your current version | 9 months ago
on 2023-12-05
mongoose
from 6.5.4 to 6.13.0 | 48 versions ahead of your current version | 3 months ago
on 2024-06-06
webpack
from 5.85.0 to 5.94.0 | 16 versions ahead of your current version | a month ago
on 2024-08-22
webpack-merge
from 5.8.0 to 5.10.0 | 2 versions ahead of your current version | a year ago
on 2023-10-16
webpack-dev-server
from 4.10.1 to 4.15.2 | 11 versions ahead of your current version | 6 months ago
on 2024-03-20

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	519	Proof of Concept
Prototype Pollution SNYK-JS-MONGOOSE-5777721	519	Proof of Concept
Path Traversal SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555	519	Proof of Concept
Denial of Service (DoS) SNYK-JS-WS-7266574	519	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	519	Proof of Concept
Open Redirect SNYK-JS-EXPRESS-6474509	519	No Known Exploit
Information Exposure SNYK-JS-MONGODB-5871303	519	No Known Exploit
Information Exposure SNYK-JS-MONGODB-5871303	519	No Known Exploit
Cross-site Scripting (XSS) SNYK-JS-WEBPACK-7840298	519	Proof of Concept
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	519	Proof of Concept

Release notes

Package name: @babel/node

7.25.0 - 2024-07-26
v7.25.0 (2024-07-26)

Thanks @ davidtaylorhq and @ slatereax for your first PR!

You can find the release blog post with some highlights at https://babeljs.io/blog/2024/07/26/7.25.0.

👓 Spec Compliance
- babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  - #16537 await using normative updates (@ JLHwung)
- babel-plugin-transform-typescript
  - #16602 Ensure enum members syntactically determinable to be strings do not get reverse mappings (@ liuxingbaoyu)
🚀 New Feature
- babel-helper-create-class-features-plugin, babel-helper-function-name, babel-helper-plugin-utils, babel-helper-wrap-function, babel-plugin-bugfix-safari-class-field-initializer-scope, babel-plugin-bugfix-safari-id-destructuring-collision-in-function-expression, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-preset-env, babel-traverse, babel-types
  - #16658 Move ensureFunctionName to NodePath.prototype (@ nicolo-ribaudo)
- babel-helper-hoist-variables, babel-helper-plugin-utils, babel-plugin-proposal-async-do-expressions, babel-plugin-transform-modules-systemjs, babel-traverse
  - #16644 Move hoistVariables to Scope.prototype (@ nicolo-ribaudo)
- babel-helper-create-class-features-plugin, babel-helper-module-transforms, babel-helper-plugin-utils, babel-helper-split-export-declaration, babel-plugin-transform-classes, babel-traverse, babel-types
  - #16645 Move splitExportDeclaration to NodePath.prototype (@ nicolo-ribaudo)
- babel-helper-create-class-features-plugin, babel-helper-environment-visitor, babel-helper-module-transforms, babel-helper-plugin-utils, babel-helper-remap-async-to-generator, babel-helper-replace-supers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-transform-async-generator-functions, babel-plugin-transform-classes, babel-traverse
  - #16649 Move environment-visitor helper into @ babel/traverse (@ nicolo-ribaudo)
- babel-core, babel-parser
  - #16480 Expose wether a module has TLA or not as .extra.async (@ nicolo-ribaudo)
- babel-compat-data, babel-plugin-bugfix-safari-class-field-initializer-scope, babel-preset-env
  - #16569 Introduce bugfix-safari-class-field-initializer-scope (@ davidtaylorhq)
- babel-plugin-transform-block-scoping, babel-traverse, babel-types
  - #16551 Add NodePath#getAssignmentIdentifiers (@ JLHwung)
- babel-helper-import-to-platform-api, babel-plugin-proposal-json-modules
  - #16579 Add uncheckedRequire option for JSON imports to CJS (@ nicolo-ribaudo)
- babel-helper-transform-fixture-test-runner, babel-node
  - #16642 Allow using custom config in babel-node --eval (@ slatereax)
- babel-compat-data, babel-helper-create-regexp-features-plugin, babel-plugin-proposal-duplicate-named-capturing-groups-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-preset-env, babel-standalone
  - #16445 Add duplicate-named-capturing-groups-regex to preset-env (@ JLHwung)
🐛 Bug Fix
- babel-generator
  - #16678 Print parens around as expressions on the LHS (@ nicolo-ribaudo)
- babel-template, babel-types
  - #15286 fix: Props are lost when the template replaces the node (@ liuxingbaoyu)
🏠 Internal
- Other
  - #16674 bump gulp to 5 (@ JLHwung)
- babel-generator
  - #16651 Simplify the printing logic for ( before ambiguous tokens (@ nicolo-ribaudo)
- babel-helper-function-name, babel-plugin-transform-arrow-functions, babel-plugin-transform-function-name, babel-preset-env, babel-traverse
  - #16652 Simplify helper-function-name logic (@ nicolo-ribaudo)
🏃‍♀️ Performance
- babel-parser, babel-plugin-proposal-pipeline-operator
  - #16461 Some minor parser performance improvements for ts (@ liuxingbaoyu)
🔬 Output optimization
- babel-plugin-transform-classes
  - #16670 Reduce redundant assertThisInitialized (@ liuxingbaoyu)
- babel-helper-create-class-features-plugin, babel-helper-replace-supers, babel-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-object-super, babel-plugin-transform-private-methods, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  - #16374 Improve super.x output (@ liuxingbaoyu)
- babel-plugin-transform-class-properties, babel-plugin-transform-classes
  - #16656 Simplify output for anonymous classes with no methods (@ nicolo-ribaudo)
Committers: 6
- Artem (@ slatereax)
- Babel Bot (@ babel-bot)
- David Taylor (@ davidtaylorhq)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
7.24.8 - 2024-07-11
v7.24.8 (2024-07-11)

Thanks @ H0onnn, @ jkup and @ SreeXD for your first pull requests!

👓 Spec Compliance
- babel-parser
  - #16567 Do not use strict mode in TS declare (@ liuxingbaoyu)
🐛 Bug Fix
- babel-generator
  - #16630 Correctly print parens around in in for heads (@ nicolo-ribaudo)
  - #16626 Fix printing of comments in await using (@ nicolo-ribaudo)
  - #16591 fix typescript code generation for yield expression inside type expre… (@ SreeXD)
- babel-parser
  - #16613 Disallow destructuring assignment in using declarations (@ H0onnn)
  - #16490 fix: do not add .value: undefined to regexp literals (@ liuxingbaoyu)
- babel-types
  - #16615 Remove boolean props from ObjectTypeInternalSlot visitor keys (@ nicolo-ribaudo)
- babel-plugin-transform-typescript
  - #16566 fix: Correctly handle export import x = (@ liuxingbaoyu)
💅 Polish
- babel-generator
  - #16625 Avoid unnecessary parens around async in for await (@ nicolo-ribaudo)
- babel-traverse
  - #16619 Avoid checking Scope.globals multiple times (@ liuxingbaoyu)
Committers: 9
- Amjad Yahia Robeen Hassan (@ amjed-98)
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Jon Kuperman (@ jkup)
- Nagendran N (@ SreeXD)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- Sukka (@ SukkaW)
- @ H0onnn
- @ liuxingbaoyu
7.24.7 - 2024-06-05
v7.24.7 (2024-06-05)

🐛 Bug Fix
- babel-node
  - #16554 Allow extra flags in babel-node (@ nicolo-ribaudo)
- babel-traverse
  - #16522 fix: incorrect constantViolations with destructuring (@ liuxingbaoyu)
- babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
  - #16524 fix: Transform using in switch correctly (@ liuxingbaoyu)
🏠 Internal
- babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  - #16525 Delete unused array helpers (@ blakewilson)
Committers: 7
- Amjad Yahia Robeen Hassan (@ amjed-98)
- Babel Bot (@ babel-bot)
- Blake Wilson (@ blakewilson)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- Sukka (@ SukkaW)
- @ liuxingbaoyu
7.24.6 - 2024-05-24
v7.24.6 (2024-05-24)

Thanks @ amjed-98, @ blakewilson, @ coelhucas, and @ SukkaW for your first PRs!

🐛 Bug Fix
- babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  - #16514 Fix source maps for private member expressions (@ nicolo-ribaudo)
- babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  - #16515 Fix source maps for template literals (@ nicolo-ribaudo)
- babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  - #16485 Support undecorated static accessor in anonymous classes (@ JLHwung)
  - #16484 Fix decorator bare yield await (@ JLHwung)
- babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  - #16483 Fix: throw TypeError if addInitializer is called after finished (@ JLHwung)
- babel-parser, babel-plugin-transform-typescript
  - #16476 fix: Correctly parse cls.fn<C> = x (@ liuxingbaoyu)
🏠 Internal
- babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  - #16501 Generate helper metadata at build time (@ nicolo-ribaudo)
- babel-helpers
  - #16499 Add tsconfig.json for @ babel/helpers/src/helpers (@ nicolo-ribaudo)
- babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  - #16495 Move all runtime helpers to individual files (@ nicolo-ribaudo)
- babel-parser, babel-traverse
  - #16482 Statically generate boilerplate for bitfield accessors (@ nicolo-ribaudo)
- Other
  - #16466 Migrate import assertions syntax (@ JLHwung)
Committers: 9
- Amjad Yahia Robeen Hassan (@ amjed-98)
- Babel Bot (@ babel-bot)
- Blake Wilson (@ blakewilson)
- Huáng Jùnliàng (@ JLHwung)
- Lucas Coelho (@ coelhucas)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- Sukka (@ SukkaW)
- Zzzen (@ Zzzen)
- @ liuxingbaoyu
7.23.9 - 2024-01-25
7.22.19 - 2023-09-14
7.22.15 - 2023-09-04
7.22.10 - 2023-08-07
7.22.6 - 2023-07-04
7.22.5 - 2023-06-08
7.22.1 - 2023-05-26
7.22.0 - 2023-05-26
7.21.4-esm.4 - 2023-04-04
7.21.4-esm.3 - 2023-04-04
7.21.4-esm.2 - 2023-04-04
7.21.4-esm.1 - 2023-04-04
7.21.4-esm - 2023-04-04
7.20.7 - 2022-12-22
7.20.5 - 2022-11-28
7.20.2 - 2022-11-04
7.20.0 - 2022-10-27
7.19.1 - 2022-09-14
7.18.10 - 2022-08-01

from @babel/node GitHub release notes

Package name: @csstools/normalize.css

12.1.1 - 2023-12-29
- Fixed: normalize text-size-adjust in the most backwards compatible way.
12.1.0 - 2023-12-29
- Added: text-size-adjust #25
- Fixed: group pre with code, kbd, samp #24
12.0.0 - 2021-09-15
- Changed: normalize.css no longer contributes specificity.
- Changed: normalize.css fixes now respect writing-mode.
- Removed: Fixes for older browsers, and all fixes for IE.
- Fixed: table uses correct border-color: currentColor normalization.

from @csstools/normalize.css GitHub release notes

Package name: body-parser

1.20.2 - 2023-02-22
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
  - perf: skip value escaping when unnecessary
- deps: raw-body@2.5.2
1.20.1 - 2022-10-06
- deps: qs@6.11.0
- perf: remove unnecessary object clone
1.20.0 - 2022-04-03
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: http-errors@2.0.0
  - deps: depd@2.0.0
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
- deps: qs@6.10.3
- deps: raw-body@2.5.1
  - deps: http-errors@2.0.0

from body-parser GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: body-parser@1.20.2
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: raw-body@2.5.2
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: Node.js@16.18 and Node.js@18.12 by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add Node.js@19.7 by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: body-parser@1.20.1
  - deps: qs@6.11.0
  - perf: remove unnecessary object clone
- deps: qs@6.11.0
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes

from express GitHub release notes

Package name: express-jwt

7.7.8 - 2024-06-24
7.7.8
7.7.7 - 2022-10-24
7.7.7
7.7.6 - 2022-10-24
7.7.6
7.7.5 - 2022-05-31

from express-jwt GitHub release notes

Package name: formidable

2.1.2 - 2022-12-01
2.1.1 - 2022-12-01
2.1.0 - 2022-12-01
2.1.0
2.0.1 - 2021-10-30

from formidable GitHub release notes

Package name: mongodb

4.17.2 - 2023-12-05
4.17.2 (2023-11-16)

The MongoDB Node.js team is pleased to announce version 4.17.2 of the mongodb package!

Release Notes

Fix connection leak when serverApi is enabled

When enabling serverApi the driver's RTT mesurment logic (used to determine the closest node) still sent the legacy hello command "isMaster" causing the server to return an error. Unfortunately, the error handling logic did not correctly destroy the socket which would cause a leak.

Both sending the correct hello command and the error handling connection clean up logic are fixed in this change.

Bug Fixes
- NODE-5751: RTTPinger always sends legacy hello (#3923) (bc3d020)
Documentation
- Reference
- API
- Changelog
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
4.17.1 - 2023-08-23
4.17.1 (2023-08-23)

The MongoDB Node.js team is pleased to announce version 4.17.1 of the mongodb package!

Release Notes

Import of saslprep updated to correct library.

Fixes the import of saslprep to be the correct @ mongodb-js/saslprep library.

Bug Fixes
- NODE-5573: fix saslprep import (#3838) (ff6c293)
Documentation
- Reference
- API
- Changelog
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
4.17.0 - 2023-08-17
4.16.0 - 2023-04-18
4.15.0 - ...

Snyk has created this PR to upgrade: - @babel/node from 7.18.10 to 7.25.0. See this package in npm: https://www.npmjs.com/package/@babel/node - @csstools/normalize.css from 12.0.0 to 12.1.1. See this package in npm: https://www.npmjs.com/package/@csstools/normalize.css - body-parser from 1.20.0 to 1.20.2. See this package in npm: https://www.npmjs.com/package/body-parser - dotenv from 16.0.2 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - express from 4.18.1 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - express-jwt from 7.7.5 to 7.7.8. See this package in npm: https://www.npmjs.com/package/express-jwt - formidable from 2.0.1 to 2.1.2. See this package in npm: https://www.npmjs.com/package/formidable - mongodb from 4.9.0 to 4.17.2. See this package in npm: https://www.npmjs.com/package/mongodb - mongoose from 6.5.4 to 6.13.0. See this package in npm: https://www.npmjs.com/package/mongoose - webpack from 5.85.0 to 5.94.0. See this package in npm: https://www.npmjs.com/package/webpack - webpack-merge from 5.8.0 to 5.10.0. See this package in npm: https://www.npmjs.com/package/webpack-merge - webpack-dev-server from 4.10.1 to 4.15.2. See this package in npm: https://www.npmjs.com/package/webpack-dev-server See this project in Snyk: https://app.snyk.io/org/rawda-developer/project/5278a596-6cdc-4719-8815-3c0c81d84861?utm_source=github&utm_medium=referral&page=upgrade-pr

[Snyk] Upgrade: , , body-parser, dotenv, express, express-jwt, formidable, mongodb, mongoose, webpack, webpack-merge, webpack-dev-server #350

Are you sure you want to change the base?

[Snyk] Upgrade: , , body-parser, dotenv, express, express-jwt, formidable, mongodb, mongoose, webpack, webpack-merge, webpack-dev-server #350

Conversation

rawdaymohamed commented Sep 20, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

v7.25.0 (2024-07-26)

👓 Spec Compliance

🚀 New Feature

🐛 Bug Fix

🏠 Internal

🏃‍♀️ Performance

🔬 Output optimization

Committers: 6

v7.24.8 (2024-07-11)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

Committers: 9

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

Committers: 7

v7.24.6 (2024-05-24)

🐛 Bug Fix

🏠 Internal

Committers: 9

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

4.17.2 (2023-11-16)

Release Notes

Fix connection leak when serverApi is enabled

Bug Fixes

Documentation

4.17.1 (2023-08-23)

Release Notes

Import of saslprep updated to correct library.

Bug Fixes

Documentation

Import of `saslprep` updated to correct library.