[Snyk] Upgrade: , , , cookie-session, express, express-validator, mongoose, typescript #108
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade:
- @types/express from 4.17.13 to 4.17.21.
See this package in npm: https://www.npmjs.com/package/@types/express
- @types/cookie-session from 2.0.44 to 2.0.49.
See this package in npm: https://www.npmjs.com/package/@types/cookie-session
- @types/jsonwebtoken from 8.5.8 to 8.5.9.
See this package in npm: https://www.npmjs.com/package/@types/jsonwebtoken
- cookie-session from 2.0.0 to 2.1.0.
See this package in npm: https://www.npmjs.com/package/cookie-session
- express from 4.17.3 to 4.19.2.
See this package in npm: https://www.npmjs.com/package/express
- express-validator from 6.14.0 to 6.15.0.
See this package in npm: https://www.npmjs.com/package/express-validator
- mongoose from 6.2.9 to 6.13.0.
See this package in npm: https://www.npmjs.com/package/mongoose
- typescript from 4.6.3 to 4.9.5.
See this package in npm: https://www.npmjs.com/package/typescript
See this project in Snyk:
https://app.snyk.io/org/alexandersck/project/7982d568-4e24-4217-8d6a-5d5216ada3f9?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade multiple dependencies.
👯♂ The following dependencies are linked and will therefore be updated together.ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
@types/express
from 4.17.13 to 4.17.21 | 8 versions ahead of your current version | 10 months ago
on 2023-11-07
@types/cookie-session
from 2.0.44 to 2.0.49 | 5 versions ahead of your current version | 5 months ago
on 2024-04-17
@types/jsonwebtoken
from 8.5.8 to 8.5.9 | 1 version ahead of your current version | 2 years ago
on 2022-08-24
cookie-session
from 2.0.0 to 2.1.0 | 1 version ahead of your current version | 8 months ago
on 2024-01-24
express
from 4.17.3 to 4.19.2 | 7 versions ahead of your current version | 6 months ago
on 2024-03-25
express-validator
from 6.14.0 to 6.15.0 | 4 versions ahead of your current version | 2 years ago
on 2023-02-16
mongoose
from 6.2.9 to 6.13.0 | 73 versions ahead of your current version | 3 months ago
on 2024-06-06
typescript
from 4.6.3 to 4.9.5 | 260 versions ahead of your current version | 2 years ago
on 2023-01-30
Issues fixed by the recommended upgrade:
SNYK-JS-MONGOOSE-2961688
SNYK-JS-MONGOOSE-5777721
SNYK-JS-IP-6240864
SNYK-JS-EXPRESS-6474509
SNYK-JS-MONGODB-5871303
SNYK-JS-IP-7148531
Release notes
Package name: @types/express
-
4.17.21 - 2023-11-07
-
4.17.20 - 2023-10-18
-
4.17.19 - 2023-10-10
-
4.17.18 - 2023-09-23
-
4.17.17 - 2023-02-03
-
4.17.16 - 2023-01-23
-
4.17.15 - 2022-12-13
-
4.17.14 - 2022-09-13
-
4.17.13 - 2021-07-06
from @types/express GitHub release notesPackage name: @types/cookie-session
-
2.0.49 - 2024-04-17
-
2.0.48 - 2023-11-20
-
2.0.47 - 2023-11-07
-
2.0.46 - 2023-10-18
-
2.0.45 - 2023-09-04
-
2.0.44 - 2021-12-23
from @types/cookie-session GitHub release notesPackage name: @types/jsonwebtoken
-
8.5.9 - 2022-08-24
-
8.5.8 - 2022-01-17
from @types/jsonwebtoken GitHub release notesPackage name: cookie-session
-
2.1.0 - 2024-01-24
- Fix loading sessions with special keys
- deps: [email protected]
- Add
- Add
- Fix accidental cookie name/value truncation when given invalid chars
- Fix
- Remove quotes from returned quoted cookie value
- Use
- pref: small lookup regexp optimization
-
2.0.0 - 2021-12-16
- Change default cookie name to
- Change
- Create new session for all types of invalid sessions
- Drop support for Node.js 0.8
- Remove private
- Remove the
- Remove undocumented
- Remove undocumented
- Save all enumerable properties on
- Including
- Use
- Use
- deps: [email protected]
- Fix check for default
- Fix
- Support
- deps: depd@~2.0.0
- deps: keygrip@~1.1.0
- perf: remove argument reassignment
- deps: [email protected]
- Add
- Add 256 color mode support
- Enable / disable namespaces dynamically
- Make millisecond timer namespace-specific
- Remove
- Use
- deps: on-headers@~1.0.2
- Fix
- deps: [email protected]
- perf: reduce the scope of try-catch deopt
- perf: remove internal reference to request from session object
from cookie-session GitHub release notespartitionedoption for CHIPS supportpriorityoption for Priority cookie supportmaxAgeoption to reject invalid valuesreq.socketover deprecatedreq.connectionsession.populatedto.isPopulatedreq.session.save()keyoption; usenameinsteadreq.session.lengthto free up key namereq.sessionCookiesandreq.sessionKeyreq.session_-prefixed propertiesObject.definePropertyinstead of deprecated__define*__safe-bufferfor improved Buffer APIsecureoption behaviormaxAgeoption preventing cookie deletion"none"insameSiteoptionDEBUG_HIDE_DATEDEBUG_FDsupportDate#toISOString()when output is not a TTYres.writeHeadpatch missing return valuePackage name: express
-
4.19.2 - 2024-03-25
-
4.19.1 - 2024-03-20
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
-
4.19.0 - 2024-03-20
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
- @ crandmck made their first contribution in #5541
-
4.18.3 - 2024-02-29
- Fix routing requests without method
- deps: [email protected]
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
- deps: [email protected]
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: [email protected] and [email protected] by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add [email protected] by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
-
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: [email protected]
- deps: [email protected]
- perf: remove unnecessary object clone
- deps: [email protected]
-
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
-
4.18.0 - 2022-04-25
- Add "root" option to
- Allow
- Deprecate string and non-integer arguments to
- Fix behavior of
- Fix handling very large stacks of sync middleware
- Ignore
- Invoke
- Support proper 205 responses using
- Use
- deps: [email protected]
- Fix error message for json parse whitespace in
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- Add
- Fix
- deps: [email protected]
- Replace internal
- Use instance methods on
- deps: [email protected]
- Remove set content headers that break response
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- Prevent loss of async hooks context
- deps: [email protected]
- deps: [email protected]
- Fix emitted 416 error missing headers property
- Limit the headers removed for 304 response
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- Remove code 306
- Rename
-
4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
- deps: mime-types@~2.1.34
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- Fix handling of
- pref: remove unnecessary regexp for trust proxy
from express GitHub release notesWhat's Changed
Full Changelog: 4.19.0...4.19.1
What's Changed
New Contributors
Full Changelog: 4.18.3...4.19.0
Main Changes
Other Changes
New Contributors
Full Changelog: 4.18.2...4.18.3
res.downloadoptionswithoutfilenameinres.downloadres.statusnull/undefinedasmaxAgeinres.cookieObject.prototypevalues in settings throughapp.set/app.getdefaultwith same arguments as types inres.formatres.sendhttp-errorsforres.formaterrorstrictpriorityoptionexpiresoption to reject invalid datesevalusage withFunctionconstructorprocessto check for listeners425 Unordered Collectionto standard425 Too Early__proto__keysPackage name: express-validator
-
6.15.0 - 2023-02-16
- chore(deps): bump ua-parser-js from 0.7.32 to 0.7.33 by @ dependabot in #1208
- chore(deps): bump eta from 1.12.3 to 2.0.0 by @ dependabot in #1211
- chore(deps): bump http-cache-semantics from 4.1.0 to 4.1.1 by @ dependabot in #1210
- feat: update to support validator 13.9.0 by @ fedeci in #1212
-
6.14.3 - 2023-01-20
- docs: fixed typo in sanitization chain example by @ ankushknr19 in #1195
- fixed infinite recursion when the request has a field called
- @ ankushknr19 made their first contribution in #1195
-
6.14.2 - 2022-06-19
- correctly run
- @ tonysamperi made their first contribution in #1156
-
6.14.1 - 2022-05-22
- Add
- chore(deps): bump shelljs from 0.8.4 to 0.8.5 by @ dependabot in #1128
- chore(deps): bump ajv from 6.11.0 to 6.12.6 by @ dependabot in #1129
- chore(deps): bump prismjs from 1.25.0 to 1.27.0 by @ dependabot in #1135
- docs: remove dependencies status badge by @ gustavohenke in #1131
- chore(deps): bump minimist from 1.2.5 to 1.2.6 by @ dependabot in #1142
- chore(deps): bump async from 2.6.3 to 2.6.4 by @ dependabot in #1147
- Add missing
- @ daenamkim made their first contribution in #1120
-
6.14.0 - 2021-12-11
- feat: update
- chore(deps): bump tmpl from 1.0.4 to 1.0.5 by @ dependabot in #1116
- chore(deps): bump path-parse from 1.0.6 to 1.0.7 by @ dependabot in #1118
- chore(deps): bump prismjs from 1.24.0 to 1.25.0 by @ dependabot in #1117
from express-validator GitHub release notesWhat's Changed
Full Changelog: v6.14.3...v6.15.0
What's Changed
*(#1205)New Contributors
Full Changelog: v6.14.2...v6.14.3
What's Changed
.matcheswhen passing regex object by @ tonysamperi in #1156New Contributors
Full Changelog: v6.14.1...v6.14.2
What's Changed
validationResult()for schema validation example by @ daenamkim in #1120SKpostal code - #1144New Contributors
Full Changelog: v6.14.0...v6.14.1
What's Changed
validatorto13.7by @ fedeci in #1115Full Changelog: v6.13.0...v6.14.0
Package name: mongoose
-
6.13.0 - 2024-06-06
-
6.12.9 - 2024-05-24
-
6.12.8 - 2024-04-10
-
6.12.7 - 2024-03-01
-
6.12.6 - 2024-01-22
-
6.12.5 - 2024-01-03
-
6.12.4 - 2023-12-27
-
6.12.3 - 2023-11-07
-
6.12.2 - 2023-10-25
-
6.12.1 - 2023-10-12
-
6.12.0 - 2023-08-24
-
6.11.6 - 2023-08-21
-
6.11.5 - 2023-08-01
-
6.11.4 - 2023-07-17
-
6.11.3 - 2023-07-11
-
6.11.2 - 2023-06-08
-
6.11.1 - 2023-05-08
-
6.11.0 - 2023-05-01
-
6.10.5 - 2023-04-06
-
6.10.4 - 2023-03-21
-
6.10.3 - 2023-03-13
-
6.10.2 - 2023-03-07
-
6.10.1 - 2023-03-03
-
6.10.0 - 2023-02-22
-
6.9.3 - 2023-02-22
-
6.9.2 - 2023-02-16
-
6.9.1 - 2023-02-06
-
6.9.0 - 2023-01-25
-
6.8.4 - 2023-01-17
-
6.8.3 - 2023-01-06
-
6.8.2 - 2022-12-28
-
6.8.1 - 2022-12-19
-
6.8.0 - 2022-12-05
-
6.7.5 - 2022-11-30
-
6.7.4 - 2022-11-28
-
6.7.3 - 2022-11-22
-
6.7.2 - 2022-11-07
-
6.7.1 - 2022-11-02
-
6.7.0 - 2022-10-24
-
6.6.7 - 2022-10-21
-
6.6.6 - 2022-10-20
-
6.6.5 - 2022-10-05
-
6.6.4 - 2022-10-03
-
6.6.3 - 2022-09-30
-
6.6.2 - 2022-09-26
-
6.6.1 - 2022-09-14
-
6.6.0 - 2022-09-08
-
6.5.5 - 2022-09-07
-
6.5.4 - 2022-08-30
-
6.5.3 - 2022-08-25
-
6.5.2 - 2022-08-10
-
6.5.1 - 2022-08-03
-
6.5.0 - 2022-07-26
-
6.4.7 - 2022-07-25
-
6.4.6 - 2022-07-20
-
6.4.5 - 2022-07-18
-
6.4.4 - 2022-07-08
-
6.4.3 - 2022-07-05
-
6.4.2 - 2022-07-01
-
6.4.1 - 2022-06-27
-
6.4.0 - 2022-06-17
-
6.3.9 - 2022-06-17
-
6.3.8 - 2022-06-13
-
6.3.7 - 2022-06-13
-
6.3.6 - 2022-06-07
-
6.3.5 - 2022-05-30
-
6.3.4 - 2022-05-19
-
6.3.3 - 2022-05-09
-
6.3.2 - 2022-05-02
-
6.3.1 - 2022-04-21
-
6.3.0 - 2022-04-14
-
6.2.11 - 2022-04-13
-
6.2.10 - 2022-04-04
-
6.2.9 - 2022-03-28
from mongoose GitHub release notesPackage name: typescript