[Snyk] Upgrade: body-parser, config, cookie-parser, ejs, express, js-yaml, mongodb, morgan, multiparty, serve-favicon #14

skyairmj · 2024-09-08T08:56:29Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

body-parser
from 1.18.2 to 1.20.2 | 7 versions ahead of your current version | 2 years ago
on 2023-02-22
config
from 1.25.1 to 1.31.0 | 12 versions ahead of your current version | 6 years ago
on 2018-07-23
cookie-parser
from 1.4.3 to 1.4.6 | 3 versions ahead of your current version | 3 years ago
on 2021-11-16
ejs
from 3.1.6 to 3.1.10 | 4 versions ahead of your current version | 5 months ago
on 2024-04-12
express
from 4.16.0 to 4.19.2 | 15 versions ahead of your current version | 5 months ago
on 2024-03-25
js-yaml
from 3.13.1 to 3.14.1 | 2 versions ahead of your current version | 4 years ago
on 2020-12-07
mongodb
from 3.1.13 to 3.7.4 | 51 versions ahead of your current version | a year ago
on 2023-06-21
morgan
from 1.9.1 to 1.10.0 | 1 version ahead of your current version | 4 years ago
on 2020-03-20
multiparty
from 4.1.2 to 4.2.3 | 6 versions ahead of your current version | 3 years ago
on 2022-01-21
serve-favicon
from 2.4.5 to 2.5.0 | 1 version ahead of your current version | 6 years ago
on 2018-03-29

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Remote Code Execution (RCE) SNYK-JS-EJS-2803307	726	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	726	Proof of Concept
Improper Control of Dynamically-Managed Code Resources SNYK-JS-EJS-6689533	726	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	726	No Known Exploit
Prototype Pollution SNYK-JS-JSON5-3182856	726	Proof of Concept

Release notes

Package name: body-parser

from body-parser GitHub release notes

Package name: config

1.31.0 - 2018-07-23
1.30.0 - 2018-02-26
1.29.4 - 2018-02-04
1.29.3 - 2018-02-03
1.29.2 - 2018-01-13
1.29.1 - 2018-01-07
1.29.0 - 2017-12-26
1.28.1 - 2017-11-09
1.28.0 - 2017-11-07
1.27.0 - 2017-10-17
1.26.2 - 2017-08-12
1.26.1 - 2017-05-03
1.25.1 - 2017-02-01

from config GitHub release notes

Package name: cookie-parser

1.4.6 - 2021-11-16
- deps: cookie@0.4.1
1.4.5 - 2020-03-15
- deps: cookie@0.4.0
1.4.4 - 2019-02-13
- perf: normalize secret argument only once
1.4.3 - 2016-05-27
- deps: cookie@0.3.1
  - perf: use for loop in parse

from cookie-parser GitHub release notes

Package name: ejs

3.1.10 - 2024-04-12
Version 3.1.10
3.1.9 - 2023-03-12
Version 3.1.9
3.1.8 - 2022-05-11
Version 3.1.8
3.1.7 - 2022-04-20
Version 3.1.7
3.1.6 - 2021-02-06
Version 3.1.6

from ejs GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: body-parser@1.20.2
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: raw-body@2.5.2
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: Node.js@16.18 and Node.js@18.12 by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add Node.js@19.7 by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: body-parser@1.20.1
  - deps: qs@6.11.0
  - perf: remove unnecessary object clone
- deps: qs@6.11.0
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: body-parser@1.20.0
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: depd@2.0.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: qs@6.10.3
  - deps: raw-body@2.5.1
- deps: cookie@0.5.0
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: finalhandler@1.2.0
  - Remove set content headers that break response
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
  - Prevent loss of async hooks context
- deps: qs@6.10.3
- deps: send@0.18.0
  - Fix emitted 416 error missing headers property
  - Limit the headers removed for 304 response
  - deps: depd@2.0.0
  - deps: destroy@1.2.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: serve-static@1.15.0
  - deps: send@0.18.0
- deps: statuses@2.0.1
  - Remove code 306
  - Rename 425 Unordered Collection to standard 425 Too Early
4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
  - deps: mime-types@~2.1.34
  - deps: negotiator@0.6.3
- deps: body-parser@1.19.2
  - deps: bytes@3.1.2
  - deps: qs@6.9.7
  - deps: raw-body@2.4.3
- deps: cookie@0.4.2
- deps: qs@6.9.7
  - Fix handling of __proto__ keys
- pref: remove unnecessary regexp for trust proxy
4.17.2 - 2021-12-17
- Fix handling of undefined in res.jsonp
- Fix handling of undefined when "json escape" is enabled
- Fix incorrect middleware execution with unanchored RegExps
- Fix res.jsonp(obj, status) deprecation message
- Fix typo in res.is JSDoc
- deps: body-parser@1.19.1
  - deps: bytes@3.1.1
  - deps: http-errors@1.8.1
  - deps: qs@6.9.6
  - deps: raw-body@2.4.2
  - deps: safe-buffer@5.2.1
  - deps: type-is@~1.6.18
- deps: content-disposition@0.5.4
  - deps: safe-buffer@5.2.1
- deps: cookie@0.4.1
  - Fix maxAge option to reject invalid values
- deps: proxy-addr@~2.0.7
  - Use req.socket over deprecated req.connection
  - deps: forwarded@0.2.0
  - deps: ipaddr.js@1.9.1
- deps: qs@6.9.6
- deps: safe-buffer@5.2.1
- deps: send@0.17.2
  - deps: http-errors@1.8.1
  - deps: ms@2.1.3
  - pref: ignore empty http tokens
- deps: serve-static@1.14.2
  - deps: send@0.17.2
- deps: setprototypeof@1.2.0
4.17.1 - 2019-05-26
4.17.0 - 2019-05-17
4.16.4 - 2018-10-11
4.16.3 - 2018-03-12
4.16.2 - 2017-10-10
4.16.1 - 2017-09-29
4.16.0 - 2017-09-28

from express GitHub release notes

Package name: js-yaml

3.14.1 - 2020-12-07
3.14.1 released
3.14.0 - 2020-05-22
3.14.0 released
3.13.1 - 2019-04-05
3.13.1 released

from js-yaml GitHub release notes

Package name: mongodb

3.7.4 - 2023-06-21
The MongoDB Node.js team is pleased to announce version 3.7.4 of the mongodb package!

Release Highlights

This release fixes a bug that throws a type error when SCRAM-SHA-256 is used with saslprep in a webpacked environment.

3.7.4 (2023-06-21)

Bug Fixes
- NODE-3711: retry txn end on retryable write (#3047) (1595140)
- NODE-5355: prevent error when saslprep is not a function (#3733) (152425a)
Documentation
- Reference
- API
- Changelog
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
3.7.3 - 2021-10-20
3.7.2 - 2021-10-05
3.7.1 - 2021-09-14
3.7.0 - 2021-08-31
3.6.12 - 2021-08-30
3.6.11 - 2021-08-05
3.6.10 - 2021-07-06
3.6.9 - 2021-05-26
3.6.8 - 2021-05-21
3.6.7 - 2021-05-18
3.6.6 - 2021-04-06
3.6.5 - 2021-03-16
3.6.4 - 2021-02-02
3.6.3 - 2020-11-06
3.6.2 - 2020-09-10
3.6.1 - 2020-09-02
3.6.0 - 2020-07-30
3.6.0-beta.0 - 2020-04-14
3.5.11 - 2020-09-10
3.5.10 - 2020-07-30
3.5.9 - 2020-06-12
3.5.8 - 2020-05-28
3.5.7 - 2020-04-29
3.5.6 - 2020-04-14
3.5.5 - 2020-03-11
3.5.4 - 2020-02-25
3.5.3 - 2020-02-12
3.5.2 - 2020-01-20
3.5.1 - 2020-01-17
3.5.0 - 2020-01-14
3.4.1 - 2019-12-19
3.4.0 - 2019-12-10
3.3.5 - 2019-11-26
3.3.4 - 2019-11-11
3.3.4-rc0 - 2019-11-06
3.3.3 - 2019-10-16
3.3.2 - 2019-08-28
3.3.1 - 2019-08-23
3.3.0 - 2019-08-13
3.3.0-beta2 - 2019-07-18
3.3.0-beta1 - 2019-06-18
3.2.7 - 2019-06-04
3.2.6 - 2019-05-24
3.2.5 - 2019-05-17
3.2.4 - 2019-05-08
3.2.3 - 2019-04-05
3.2.2 - 2019-03-22
3.2.1 - 2019-03-21
3.2.0-beta2 - 2019-03-10
3.2.0-beta1 - 2019-02-27
3.1.13 - 2019-01-23

from mongodb GitHub release notes

Package name: morgan

1.10.0 - 2020-03-20
- Add :total-time token
- Fix trailing space in colored status code for dev format
- deps: basic-auth@~2.0.1
  - deps: safe-buffer@5.1.2
- deps: depd@~2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: on-headers@~1.0.2
  - Fix res.writeHead patch missing return value
1.9.1 - 2018-09-11
- Fix using special characters in format
- deps: depd@~1.1.2
  - perf: remove argument reassignment

from morgan GitHub release notes

Package name: multiparty

4.2.3 - 2022-01-21
Release 4.2.3
4.2.2 - 2020-07-28
Release 4.2.2
4.2.1 - 2018-08-13
Release 4.2.1
4.2.0 - 2018-07-30
Release 4.2.0
4.1.4 - 2018-05-11
Release 4.1.4
4.1.3 - 2017-01-22
Release 4.1.3
4.1.2 - 2015-05-09
Release 4.1.2

from multiparty GitHub release notes

Package name: serve-favicon

2.5.0 - 2018-03-29
- Ignore requests without url property
- deps: ms@2.1.1
  - Add week
  - Add w
2.4.5 - 2017-09-26
- deps: etag@~1.8.1
  - perf: replace regular expression with substring
- deps: fresh@0.5.2
  - Fix regression matching multiple ETags in If-None-Match
  - perf: improve If-None-Match token parsing

from serve-favicon GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade: - body-parser from 1.18.2 to 1.20.2. See this package in npm: https://www.npmjs.com/package/body-parser - config from 1.25.1 to 1.31.0. See this package in npm: https://www.npmjs.com/package/config - cookie-parser from 1.4.3 to 1.4.6. See this package in npm: https://www.npmjs.com/package/cookie-parser - ejs from 3.1.6 to 3.1.10. See this package in npm: https://www.npmjs.com/package/ejs - express from 4.16.0 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - js-yaml from 3.13.1 to 3.14.1. See this package in npm: https://www.npmjs.com/package/js-yaml - mongodb from 3.1.13 to 3.7.4. See this package in npm: https://www.npmjs.com/package/mongodb - morgan from 1.9.1 to 1.10.0. See this package in npm: https://www.npmjs.com/package/morgan - multiparty from 4.1.2 to 4.2.3. See this package in npm: https://www.npmjs.com/package/multiparty - serve-favicon from 2.4.5 to 2.5.0. See this package in npm: https://www.npmjs.com/package/serve-favicon See this project in Snyk: https://app.snyk.io/org/mingjin/project/ce3e886e-2b0f-4dcf-bdac-2e625c03c5ff?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: body-parser, config, cookie-parser, ejs, express, js-yaml, mongodb, morgan, multiparty, serve-favicon #14

[Snyk] Upgrade: body-parser, config, cookie-parser, ejs, express, js-yaml, mongodb, morgan, multiparty, serve-favicon #14

skyairmj commented Sep 8, 2024

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Release Highlights

3.7.4 (2023-06-21)

Bug Fixes

Documentation

[Snyk] Upgrade: body-parser, config, cookie-parser, ejs, express, js-yaml, mongodb, morgan, multiparty, serve-favicon #14

Are you sure you want to change the base?

[Snyk] Upgrade: body-parser, config, cookie-parser, ejs, express, js-yaml, mongodb, morgan, multiparty, serve-favicon #14

Conversation

skyairmj commented Sep 8, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Release Highlights

3.7.4 (2023-06-21)

Bug Fixes

Documentation