Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade: body-parser, express, fabric-ca-client, fabric-network, morgan, nodemon #9

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

BitcoinOutput
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

body-parser
from 1.19.0 to 1.20.2 | 5 versions ahead of your current version | 2 years ago
on 2023-02-22
express
from 4.17.1 to 4.19.2 | 9 versions ahead of your current version | 6 months ago
on 2024-03-25
fabric-ca-client
from 1.4.5 to 1.4.20 | 67 versions ahead of your current version | 2 years ago
on 2022-05-12
fabric-network
from 1.4.5 to 1.4.20 | 67 versions ahead of your current version | 2 years ago
on 2022-05-12
morgan
from 1.9.1 to 1.10.0 | 1 version ahead of your current version | 4 years ago
on 2020-03-20
nodemon
from 2.0.2 to 2.0.22 | 30 versions ahead of your current version | a year ago
on 2023-03-22

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536531
292 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579147
292 No Known Exploit
high severity Prototype Pollution
SNYK-JS-NCONF-2395478
292 Proof of Concept
high severity Prototype Poisoning
SNYK-JS-QS-3153490
292 Proof of Concept
high severity Prototype Poisoning
SNYK-JS-QS-3153490
292 Proof of Concept
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536528
292 No Known Exploit
high severity Cryptographic Issues
SNYK-JS-ELLIPTIC-571484
292 Proof of Concept
high severity Prototype Pollution
SNYK-JS-GRPC-598671
292 Proof of Concept
high severity Arbitrary File Write
SNYK-JS-TAR-1579152
292 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579155
292 No Known Exploit
high severity Prototype Pollution
SNYK-JS-Y18N-1021887
292 Proof of Concept
high severity Prototype Pollution
SNYK-JS-INI-1048974
292 Proof of Concept
high severity Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922
292 No Known Exploit
high severity Improper Verification of Cryptographic Signature
SNYK-JS-JSRSASIGN-2869122
292 Proof of Concept
high severity Prototype Pollution
SNYK-JS-AJV-584908
292 No Known Exploit
high severity Prototype Pollution
SNYK-JS-AJV-584908
292 No Known Exploit
high severity Remote Memory Exposure
SNYK-JS-BL-608877
292 Proof of Concept
high severity Asymmetric Resource Consumption (Amplification)
SNYK-JS-BODYPARSER-7926860
292 No Known Exploit
high severity Uncontrolled resource consumption
SNYK-JS-BRACES-6838727
292 Proof of Concept
high severity Code Injection
SNYK-JS-LODASH-1040724
292 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-567746
292 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-608086
292 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-6139239
292 Proof of Concept
medium severity Cryptographic Issues
SNYK-JS-ELLIPTIC-1064899
292 No Known Exploit
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509
292 No Known Exploit
medium severity Cross-site Scripting
SNYK-JS-EXPRESS-7926867
292 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905
292 Proof of Concept
medium severity Open Redirect
SNYK-JS-GOT-2932019
292 No Known Exploit
medium severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JS-TAR-6476909
292 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-UNDEFSAFE-548940
292 Proof of Concept
medium severity Cryptographic Weakness
SNYK-JS-JSRSASIGN-1244072
292 No Known Exploit
medium severity Timing Attack
SNYK-JS-JSRSASIGN-561755
292 No Known Exploit
medium severity Memory Corruption
SNYK-JS-JSRSASIGN-572937
292 No Known Exploit
medium severity Remote Code Execution (RCE)
SNYK-JS-JSRSASIGN-572938
292 No Known Exploit
medium severity Prototype Pollution
SNYK-JS-DOTPROP-543489
292 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905
292 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764
292 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764
292 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905
292 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758
292 No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905
292 Proof of Concept
low severity Cross-site Scripting
SNYK-JS-SEND-7926862
292 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865
292 No Known Exploit
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577916
292 Proof of Concept
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577917
292 Proof of Concept
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577918
292 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818
292 No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-WORDWRAP-3149973
292 Proof of Concept
low severity Signature Bypass
SNYK-JS-JSRSASIGN-572936
292 No Known Exploit
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795
292 Proof of Concept
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795
292 Proof of Concept
Release notes
Package name: body-parser from body-parser GitHub release notes
Package name: express from express GitHub release notes
Package name: fabric-ca-client
  • 1.4.20 - 2022-05-12

    Changes

    This is a maintenance release containing the following enhancements:

    • Support for Node 14 and 16.
    • Loosened Node engines requirements to versions >=10.13.0.
    • Add configurable eventHandlerOptions.endorseTimeout property to the Gateway connect options.

    Security fixes

    The following security vulnerability is addressed:

    New Contributors

  • 1.4.20-snapshot.2 - 2022-05-03
  • 1.4.20-snapshot.1 - 2022-01-19
  • 1.4.19 - 2022-01-19
  • 1.4.19-snapshot.5 - 2022-01-18
  • 1.4.19-snapshot.4 - 2022-01-18
  • 1.4.19-snapshot.3 - 2022-01-17
  • 1.4.19-snapshot.2 - 2021-09-28
  • 1.4.19-snapshot.1 - 2021-04-22
  • 1.4.18 - 2021-04-21
  • 1.4.18-snapshot.6 - 2021-03-23
  • 1.4.18-snapshot.5 - 2021-03-17
  • 1.4.18-snapshot.4 - 2021-02-26
  • 1.4.18-snapshot.3 - 2021-02-25
  • 1.4.18-snapshot.2 - 2021-01-16
  • 1.4.18-snapshot.1 - 2021-01-15
  • 1.4.17 - 2021-01-15
  • 1.4.17-snapshot.5 - 2021-01-13
  • 1.4.17-snapshot.4 - 2021-01-13
  • 1.4.17-snapshot.3 - 2021-01-09
  • 1.4.17-snapshot.2 - 2021-01-08
  • 1.4.17-snapshot.1 - 2020-12-18
  • 1.4.16 - 2020-12-17
  • 1.4.15 - 2020-12-04
  • 1.4.14 - 2020-11-11
  • 1.4.14-snapshot.2 - 2020-10-16
  • 1.4.14-snapshot.1 - 2020-10-13
  • 1.4.13 - 2020-09-14
  • 1.4.12 - 2020-09-09
  • 1.4.12-snapshot.5 - 2020-08-28
  • 1.4.12-snapshot.4 - 2020-08-27
  • 1.4.12-snapshot.3 - 2020-08-27
  • 1.4.12-snapshot.2 - 2020-08-07
  • 1.4.12-snapshot.1 - 2020-07-17
  • 1.4.11 - 2020-07-16
  • 1.4.11-snapshot.104 - 2020-07-16
  • 1.4.10 - 2020-07-03
  • 1.4.10-snapshot.103 - 2020-07-02
  • 1.4.10-snapshot.102 - 2020-07-02
  • 1.4.10-snapshot.101 - 2020-06-17
  • 1.4.9 - 2020-06-17
  • 1.4.9-snapshot.100 - 2020-06-16
  • 1.4.9-snapshot.99 - 2020-06-09
  • 1.4.9-snapshot.98 - 2020-05-20
  • 1.4.9-snapshot.97 - 2020-04-20
  • 1.4.9-snapshot.96 - 2020-04-07
  • 1.4.9-snapshot.95 - 2020-03-18
  • 1.4.9-snapshot.94 - 2020-03-17
  • 1.4.9-snapshot.93 - 2020-03-16
  • 1.4.8 - 2020-03-16
  • 1.4.7 - 2020-02-25
  • 1.4.7-snapshot.92 - 2020-03-13
  • 1.4.7-snapshot.91 - 2020-03-12
  • 1.4.7-snapshot.90 - 2020-03-11
  • 1.4.7-snapshot.89 - 2020-03-10
  • 1.4.7-snapshot.88 - 2020-02-26
  • 1.4.6 - 2020-02-21
  • 1.4.6-snapshot.87 - 2020-02-21
  • 1.4.6-snapshot.86 - 2020-02-21
  • 1.4.6-snapshot.85 - 2020-02-12
  • 1.4.6-snapshot.84 - 2020-02-05
  • 1.4.6-snapshot.83 - 2020-02-04
  • 1.4.6-snapshot.82 - 2020-02-04
  • 1.4.6-snapshot.81 - 2020-02-03
  • 1.4.6-snapshot.80 - 2020-01-30
  • 1.4.6-snapshot.79 - 2020-01-24
  • 1.4.6-snapshot.78 - 2020-01-24
  • 1.4.5 - 2020-01-16
from fabric-ca-client GitHub release notes
Package name: fabric-network
  • 1.4.20 - 2022-05-12

    Changes

    This is a maintenance release containing the following enhancements:

    • Support for Node 14 and 16.
    • Loosened Node engines requirements to versions >=10.13.0.
    • Add configurable eventHandlerOptions.endorseTimeout property to the Gateway connect options.

    Security fixes

    The following security vulnerability is addressed:

    New Contributors

  • 1.4.20-snapshot.2 - 2022-05-03
  • 1.4.20-snapshot.1 - 2022-01-19
  • 1.4.19 - 2022-01-19
  • 1.4.19-snapshot.5 - 2022-01-18
  • 1.4.19-snapshot.4 - 2022-01-18
  • 1.4.19-snapshot.3 - 2022-01-17
  • 1.4.19-snapshot.2 - 2021-09-28
  • 1.4.19-snapshot.1 - 2021-04-22
  • 1.4.18 - 2021-04-21
  • 1.4.18-snapshot.6 - 2021-03-23
  • 1.4.18-snapshot.5 - 2021-03-17
  • 1.4.18-snapshot.4 - 2021-02-26
  • 1.4.18-snapshot.3 - 2021-02-25
  • 1.4.18-snapshot.2 - 2021-01-16
  • 1.4.18-snapshot.1 - 2021-01-15
  • 1.4.17 - 2021-01-15
  • 1.4.17-snapshot.5 - 2021-01-13
  • 1.4.17-snapshot.4 - 2021-01-13
  • 1.4.17-snapshot.3 - 2021-01-09
  • 1.4.17-snapshot.2 - 2021-01-08
  • 1.4.17-snapshot.1 - 2020-12-18
  • 1.4.16 - 2020-12-17
  • 1.4.15 - 2020-12-04
  • 1.4.14 - 2020-11-11
  • 1.4.14-snapshot.2 - 2020-10-16
  • 1.4.14-snapshot.1 - 2020-10-13
  • 1.4.13 - 2020-09-14
  • 1.4.12 - 2020-09-09
  • 1.4.12-snapshot.5 - 2020-08-28
  • 1.4.12-snapshot.4 - 2020-08-27
  • 1.4.12-snapshot.3 - 2020-08-27
  • 1.4.12-snapshot.2 - 2020-08-07
  • 1.4.12-snapshot.1 - 2020-07-17
  • 1.4.11 - 2020-07-16
  • 1.4.11-snapshot.107 - 2020-07-16
  • 1.4.10 - 2020-07-03
  • 1.4.10-snapshot.106 - 2020-07-02
  • 1.4.10-snapshot.105 - 2020-07-02
  • 1.4.10-snapshot.104 - 2020-06-17
  • 1.4.9 - 2020-06-17
  • 1.4.9-snapshot.103 - 2020-06-16
  • 1.4.9-snapshot.102 - 2020-06-09
  • 1.4.9-snapshot.101 - 2020-05-20
  • 1.4.9-snapshot.100 - 2020-04-20
  • 1.4.9-snapshot.99 - 2020-04-07
  • 1.4.9-snapshot.98 - 2020-03-18
  • 1.4.9-snapshot.97 - 2020-03-17
  • 1.4.9-snapshot.96 - 2020-03-16
  • 1.4.8 - 2020-03-16
  • 1.4.7 - 2020-02-25
  • 1.4.7-snapshot.95 - 2020-03-13
  • 1.4.7-snapshot.94 - 2020-03-12
  • 1.4.7-snapshot.93 - 2020-03-11
  • 1.4.7-snapshot.92 - 2020-03-10
  • 1.4.7-snapshot.91 - 2020-02-26
  • 1.4.6 - 2020-02-21
  • 1.4.6-snapshot.90 - 2020-02-21
  • 1.4.6-snapshot.89 - 2020-02-21
  • 1.4.6-snapshot.88 - 2020-02-12
  • 1.4.6-snapshot.87 - 2020-02-05
  • 1.4.6-snapshot.86 - 2020-02-04
  • 1.4.6-snapshot.85 - 2020-02-04
  • 1.4.6-snapshot.84 - 2020-02-03
  • 1.4.6-snapshot.83 - 2020-01-30
  • 1.4.6-snapshot.82 - 2020-01-24
  • 1.4.6-snapshot.81 - 2020-01-24
  • 1.4.5 - 2020-01-16
from fabric-network GitHub release notes
Package name: morgan
  • 1.10.0 - 2020-03-20
    • Add :total-time token
    • Fix trailing space in colored status code for dev format
    • deps: basic-auth@~2.0.1
    • deps: depd@~2.0.0
      • Replace internal eval usage with Function constructor
      • Use instance methods on process to check for listeners
    • deps: on-headers@~1.0.2
      • Fix res.writeHead patch missing return value
  • 1.9.1 - 2018-09-11
    • Fix using special characters in format
    • deps: depd@~1.1.2
      • perf: remove argument reassignment
from morgan GitHub release notes
Package name: nodemon

Snyk has created this PR to upgrade:
  - body-parser from 1.19.0 to 1.20.2.
    See this package in npm: https://www.npmjs.com/package/body-parser
  - express from 4.17.1 to 4.19.2.
    See this package in npm: https://www.npmjs.com/package/express
  - fabric-ca-client from 1.4.5 to 1.4.20.
    See this package in npm: https://www.npmjs.com/package/fabric-ca-client
  - fabric-network from 1.4.5 to 1.4.20.
    See this package in npm: https://www.npmjs.com/package/fabric-network
  - morgan from 1.9.1 to 1.10.0.
    See this package in npm: https://www.npmjs.com/package/morgan
  - nodemon from 2.0.2 to 2.0.22.
    See this package in npm: https://www.npmjs.com/package/nodemon

See this project in Snyk:
https://app.snyk.io/org/debuggineffect/project/ab53af29-ca26-4d50-8c0c-23ffefe78e3e?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants