[Snyk] Upgrade: lodash, body-parser, dotenv, express, joi, nanoid, peer, sequelize, sqlite3, ts-node #58

GLOBAL-FINTECH · 2024-09-20T08:40:22Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

lodash
from 4.17.20 to 4.17.21 | 1 version ahead of your current version | 4 years ago
on 2021-02-20
body-parser
from 1.19.0 to 1.20.2 | 5 versions ahead of your current version | 2 years ago
on 2023-02-22
dotenv
from 8.2.0 to 8.6.0 | 5 versions ahead of your current version | 3 years ago
on 2021-05-05
express
from 4.17.1 to 4.19.2 | 9 versions ahead of your current version | 6 months ago
on 2024-03-25
joi
from 17.2.1 to 17.13.3 | 34 versions ahead of your current version | 3 months ago
on 2024-06-19
nanoid
from 3.1.15 to 3.3.7 | 26 versions ahead of your current version | 10 months ago
on 2023-11-06
peer
from 0.5.3 to 0.6.1 | 2 versions ahead of your current version | 4 years ago
on 2020-11-28
sequelize
from 6.3.5 to 6.37.3 | 85 versions ahead of your current version | 5 months ago
on 2024-04-13
sqlite3
from 5.0.0 to 5.1.7 | 20 versions ahead of your current version | 8 months ago
on 2024-01-05
ts-node
from 10.3.0 to 10.9.2 | 11 versions ahead of your current version | 9 months ago
on 2023-12-08

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Arbitrary File Overwrite SNYK-JS-TAR-1536528	646	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	646	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	646	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	646	No Known Exploit
Code Injection SNYK-JS-LODASH-1040724	646	Proof of Concept
Directory Traversal SNYK-JS-MOMENT-2440688	646	No Known Exploit
Prototype Poisoning SNYK-JS-QS-3153490	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	646	Proof of Concept
Prototype Pollution SNYK-JS-DOTTIE-3332763	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	646	Proof of Concept
SQL Injection SNYK-JS-SEQUELIZE-2959225	646	No Known Exploit
Improper Filtering of Special Elements SNYK-JS-SEQUELIZE-3324088	646	No Known Exploit
Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	646	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	646	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	646	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	646	Proof of Concept
Denial of Service (DoS) SNYK-JS-SQLITE3-2388645	646	Proof of Concept
Arbitrary Code Execution SNYK-JS-SQLITE3-3358947	646	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	646	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	646	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	646	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	646	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	646	No Known Exploit
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090599	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090601	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090602	646	Proof of Concept
Open Redirect SNYK-JS-EXPRESS-6474509	646	No Known Exploit
Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	646	Proof of Concept
Information Exposure SNYK-JS-SEQUELIZE-3324089	646	No Known Exploit
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	646	Proof of Concept
Information Exposure SNYK-JS-NANOID-2332193	646	Proof of Concept
Remote Memory Exposure SNYK-JS-NODEADDONAPI-571001	646	No Known Exploit
Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-SEQUELIZE-3324090	646	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	646	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:debug:20170905	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) npm:debug:20170905	646	Proof of Concept
SQL Injection SNYK-JS-SEQUELIZE-2932027	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	646	No Known Exploit

Release notes

Package name: lodash

4.17.21 - 2021-02-20
Bump to v4.17.21
4.17.20 - 2020-08-13
Bump to v4.17.20.

from lodash GitHub release notes

Package name: body-parser

1.20.2 - 2023-02-22
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
  - perf: skip value escaping when unnecessary
- deps: [email protected]
1.20.1 - 2022-10-06
- deps: [email protected]
- perf: remove unnecessary object clone
1.20.0 - 2022-04-03
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: [email protected]
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
1.19.2 - 2022-02-16
- deps: [email protected]
- deps: [email protected]
  - Fix handling of __proto__ keys
- deps: [email protected]
  - deps: [email protected]
1.19.1 - 2021-12-10
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: type-is@~1.6.18
1.19.0 - 2019-04-26
- deps: [email protected]
  - Add petabyte (pb) support
- deps: [email protected]
  - Set constructor name when possible
  - deps: [email protected]
  - deps: statuses@'>= 1.5.0 < 2'
- deps: [email protected]
  - Added encoding MIK
- deps: [email protected]
  - Fix parsing array brackets after index
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: type-is@~1.6.17
  - deps: mime-types@~2.1.24
  - perf: prevent internal throw on invalid type

from body-parser GitHub release notes

Package name: dotenv

8.6.0 - 2021-05-05
Show as 'added' in changelog
8.5.1 - 2021-05-05
Bump version 8.5.1
8.5.0 - 2021-05-05
Bump version 8.5.0
8.4.0 - 2021-05-05
Point to types file for VS Code. Bump 8.4.0
8.3.0 - 2021-05-05
Drop node 8 support
8.2.0 - 2019-10-16
chore(release): 8.2.0

from dotenv GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: [email protected]
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: [email protected]
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: [email protected] and [email protected] by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add [email protected] by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: [email protected]
  - deps: [email protected]
  - perf: remove unnecessary object clone
- deps: [email protected]
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: [email protected]
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: [email protected]
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: [email protected]
  - Remove set content headers that break response
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Prevent loss of async hooks context
- deps: [email protected]
- deps: [email protected]
  - Fix emitted 416 error missing headers property
  - Limit the headers removed for 304 response
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Remove code 306
  - Rename 425 Unordered Collection to standard 425 Too Early
4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
  - deps: mime-types@~2.1.34
  - deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - Fix handling of __proto__ keys
- pref: remove unnecessary regexp for trust proxy
4.17.2 - 2021-12-17
- Fix handling of undefined in res.jsonp
- Fix handling of undefined when "json escape" is enabled
- Fix incorrect middleware execution with unanchored RegExps
- Fix res.jsonp(obj, status) deprecation message
- Fix typo in res.is JSDoc
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.18
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Fix maxAge option to reject invalid values
- deps: proxy-addr@~2.0.7
  - Use req.socket over deprecated req.connection
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - pref: ignore empty http tokens
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
4.17.1 - 2019-05-26

from express GitHub release notes

Package name: joi

from joi GitHub release notes

Package name: nanoid

3.3.7 - 2023-11-06
3.3.7
3.3.6 - 2023-03-26
3.3.5 - 2023-03-26
3.3.4 - 2022-05-03
3.3.3 - 2022-04-18
3.3.2 - 2022-03-28
3.3.1 - 2022-02-16
3.3.0 - 2022-02-14
3.2.0 - 2022-01-16
3.1.32 - 2022-01-12
3.1.31 - 2022-01-11
3.1.30 - 2021-10-13
3.1.29 - 2021-10-05
3.1.28 - 2021-09-26
3.1.27 - 2021-09-26
3.1.26 - 2021-09-26
3.1.25 - 2021-08-12
3.1.24 - 2021-08-11
3.1.23 - 2021-05-10
3.1.22 - 2021-03-15
3.1.21 - 2021-03-11
3.1.20 - 2020-12-01
3.1.19 - 2020-12-01
3.1.18 - 2020-11-20
3.1.17 - 2020-11-20
3.1.16 - 2020-10-26
3.1.15 - 2020-10-23

from nanoid GitHub release notes

Package name: peer

0.6.1 - 2020-11-28
No content.
0.6.0 - 2020-11-24
Bump version to 0.6.0
0.5.3 - 2020-05-11
- PeerServer uses yargs instead of an outdated minimist. #190 Thanks @ hobindar

from peer GitHub release notes

Package name: sequelize

6.37.3 - 2024-04-13
6.37.3 (2024-04-13)

Bug Fixes
- postgres: use schema for foreign key constrains of a table (#17099) (6aba382)
6.37.2 - 2024-03-29
6.37.2 (2024-03-29)

Bug Fixes
- add readOnly to the transaction options types and docs (#17226) (7c8972f)
6.37.1 - 2024-02-18
6.37.1 (2024-02-18)

Bug Fixes
- types: Add definition of returning in SaveOptions. (#16954) (505467b)
6.37.0 - 2024-02-11
6.37.0 (2024-02-11)

Features
- postgres: support connectionTimeoutMillis dialectOption (#14119) (e81200e)
6.36.0 - 2024-02-02
6.35.2 - 2023-12-11
6.35.1 - 2023-11-19
6.35.0 - 2023-11-12
6.34.0 - 2023-11-03
6.33.0 - 2023-09-08
6.32.1 - 2023-06-17
6.32.0 - 2023-06-01
6.31.1 - 2023-05-01
6.31.0 - 2023-04-09
6.30.0 - 2023-03-24
6.29.3 - 2023-03-10
6.29.2 - 2023-03-09
6.29.1 - 2023-03-07
6.29.0 - 2023-02-23
6.28.2 - 2023-02-22
6.28.1 - 2023-02-21
6.28.0 - 2022-12-20
6.27.0 - 2022-12-12
6.26.0 - 2022-11-29
6.25.8 - 2022-11-22
6.25.7 - 2022-11-19
6.25.6 - 2022-11-15
6.25.5 - 2022-11-07
6.25.4 - 2022-11-05
6.25.3 - 2022-10-19
6.25.2 - 2022-10-15
6.25.1 - 2022-10-13
6.25.0 - 2022-10-11
6.24.0 - 2022-10-04
6.23.2 - 2022-09-27
6.23.1 - 2022-09-22
6.23.0 - 2022-09-17
6.22.1 - 2022-09-16
6.22.0 - 2022-09-15
6.21.6 - 2022-09-09
6.21.5 - 2022-09-08
6.21.4 - 2022-08-18
6.21.3 - 2022-07-11
6.21.2 - 2022-06-28
6.21.1 - 2022-06-25
6.21.0 - 2022-06-16
6.20.1 - 2022-05-27
6.20.0 - 2022-05-23
6.19.2 - 2022-05-18
6.19.1 - 2022-05-17
6.19.0 - 2022-04-12
6.18.0 - 2022-04-03
6.17.0 - 2022-02-25
6.16.3 - 2022-02-24
6.16.2 - 2022-02-18
6.16.1 - 2022-02-09
6.16.0 - 2022-02-08
6.15.1 - 2022-02-06
6.15.0 - 2022-01-29
6.14.1 - 2022-01-25
6.14.0 - 2022-01-22
6.13.0 - 2022-01-10
6.12.5 - 2022-01-04
6.12.4 - 2021-12-28
6.12.3 - 2021-12-27
6.12.2 - 2021-12-22
6.12.1 - 2021-12-21
6.12.0 - 2021-12-17
6.12.0-beta.3 - 2021-12-12
6.12.0-beta.2 - 2021-12-10
6.12.0-beta.1 - 2021-12-04
6.12.0-alpha.1 - 2021-11-19
6.11.0 - 2021-11-18
6.10.0 - 2021-11-18
6.9.0 - 2021-11-01
6.8.0 - 2021-10-24
6.7.0 - 2021-10-09
6.6.5 - 2021-07-06
6.6.4 - 2021-06-26
6.6.2 - 2021-03-23
6.6.1 - 2021-03-22
6.6.0 - 2021-03-21
6.5.1 - 2021-03-14
6.5.0 - 2021-01-27
6.4.0 - 2021-01-18
6.3.5 - 2020-09-01

from sequelize GitHub release notes

Package name: sqlite3

5.1.7 - 2024-01-05
What's Changed
- Updated bundled SQLite to v3.44.2 by @ daniellockyer
- Replaced @ mapbox/node-pre-gyp with prebuild + prebuild-install (605c7f9) by @ daniellockyer
  - this should fix a lot of bundling issues reported by the community
- Improved RowToJS performance by removing Napi::String::New instantiation by @ daniellockyer
- Various minor code refactors and improvements (thanks @ zenon8adams!)
New Contributors
- @ zenon8adams made their first contribution in #1701
Full Changelog: v5.1.6...v5.1.7
5.1.7-rc.0 - 2023-12-29
Please install v5.1.7 instead.

Full Changelog: v5.1.6...v5.1.7-rc.0
5.1.6 - 2023-03-14
What's Changed
- Fixed glibc compatibility by hardcoding lower version for log2 by @ daniellockyer
- Add generic type annotations for Statement and Database get/all/each methods callback rows by @ stevescruz in #1686
New Contributors
- @ stevescruz made their first contribution in #1686
Full Changelog: v5.1.5...v5.1.6
5.1.5 - 2023-03-13
What's Changed
- 🔒 Fixed code execution vulnerability due to O...

Snyk has created this PR to upgrade: - lodash from 4.17.20 to 4.17.21. See this package in npm: https://www.npmjs.com/package/lodash - body-parser from 1.19.0 to 1.20.2. See this package in npm: https://www.npmjs.com/package/body-parser - dotenv from 8.2.0 to 8.6.0. See this package in npm: https://www.npmjs.com/package/dotenv - express from 4.17.1 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - joi from 17.2.1 to 17.13.3. See this package in npm: https://www.npmjs.com/package/joi - nanoid from 3.1.15 to 3.3.7. See this package in npm: https://www.npmjs.com/package/nanoid - peer from 0.5.3 to 0.6.1. See this package in npm: https://www.npmjs.com/package/peer - sequelize from 6.3.5 to 6.37.3. See this package in npm: https://www.npmjs.com/package/sequelize - sqlite3 from 5.0.0 to 5.1.7. See this package in npm: https://www.npmjs.com/package/sqlite3 - ts-node from 10.3.0 to 10.9.2. See this package in npm: https://www.npmjs.com/package/ts-node See this project in Snyk: https://app.snyk.io/org/tizukanji/project/208dc152-1bbe-46e7-9626-6868f959be29?utm_source=github&utm_medium=referral&page=upgrade-pr

openzeppelin-code · 2024-09-20T08:41:50Z

[Snyk] Upgrade: lodash, body-parser, dotenv, express, joi, nanoid, peer, sequelize, sqlite3, ts-node

Generated at commit: 60cf597449b296e3d94ca72bc2cc2493952d51c8

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	0 0 0 0 0 0
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

For more details view the full report in OpenZeppelin Code Inspector

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: lodash, body-parser, dotenv, express, joi, nanoid, peer, sequelize, sqlite3, ts-node #58

[Snyk] Upgrade: lodash, body-parser, dotenv, express, joi, nanoid, peer, sequelize, sqlite3, ts-node #58

GLOBAL-FINTECH commented Sep 20, 2024

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

6.37.3 (2024-04-13)

Bug Fixes

6.37.2 (2024-03-29)

Bug Fixes

6.37.1 (2024-02-18)

Bug Fixes

6.37.0 (2024-02-11)

Features

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

openzeppelin-code bot commented Sep 20, 2024

[Snyk] Upgrade: lodash, body-parser, dotenv, express, joi, nanoid, peer, sequelize, sqlite3, ts-node #58

Are you sure you want to change the base?

[Snyk] Upgrade: lodash, body-parser, dotenv, express, joi, nanoid, peer, sequelize, sqlite3, ts-node #58

Conversation

GLOBAL-FINTECH commented Sep 20, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

6.37.3 (2024-04-13)

Bug Fixes

6.37.2 (2024-03-29)

Bug Fixes

6.37.1 (2024-02-18)

Bug Fixes

6.37.0 (2024-02-11)

Features

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

openzeppelin-code bot commented Sep 20, 2024

[Snyk] Upgrade: lodash, body-parser, dotenv, express, joi, nanoid, peer, sequelize, sqlite3, ts-node

🚨 Report Summary