[Snyk] Fix for 12 vulnerabilities #467

snyk-bot · 2023-04-08T16:03:23Z

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- MERN/merncommentbox/package.json
- MERN/merncommentbox/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-MQUERY-1050858	No	Proof of Concept
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-MQUERY-1089718	No	Proof of Concept
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	Yes	Proof of Concept
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	No	Proof of Concept
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Command Injection SNYK-JS-REACTDEVUTILS-1083268	Yes	Proof of Concept
619/1000 Why? Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	Yes	No Known Exploit
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Denial of Service (DoS) SNYK-JS-SOCKJS-575261	Yes	Proof of Concept
589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Information Exposure SNYK-JS-WEBPACKDEVSERVER-72405	Yes	Proof of Concept
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:eslint:20180222	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: body-parser

The new version differs by 145 commits.

424dadd 1.19.2
11248a2 deps: raw-body@2.4.3
7a088eb build: Node.js@14.19
ecedf31 build: Node.js@16.14
b6bfabd build: Node.js@17.5
badd6b2 build: fix code coverage aggregate upload
96b448a build: Node.js@17.4
70560b1 build: mocha@9.2.0
548a06f build: supertest@6.2.2
3b00678 deps: bytes@3.1.2
d5acb61 build: mocha@9.1.4
82c8a7c tests: add limit + inflate tests
b356758 deps: qs@6.9.7
c631b58 build: supertest@6.2.1
c81a8e2 build: eslint-plugin-import@2.25.4
3c4dcb8 build: Node.js@17.3
d0a214b 1.19.1
fb172d4 build: eslint-plugin-promise@5.2.0
c5e63cb build: Node.js@17.2
c6d43bd build: eslint-plugin-import@2.25.3
313ed6d build: eslint-plugin-promise@5.1.1
8389b51 deps: bytes@3.1.1
aae94b2 deps: http-errors@1.8.1
7f84d4f deps: raw-body@2.4.2

See the full diff

Package name: express

The new version differs by 193 commits.

3d7fce5 4.17.3
f906371 build: update example dependencies
6381bc6 deps: qs@6.9.7
a007863 deps: body-parser@1.19.2
e98f584 Revert "build: use minimatch@3.0.4 for Node.js < 4"
a659137 tests: use strict mode
a39e409 tests: prevent leaking changes to NODE_ENV
82de4de examples: fix path traversal in downloads example
12310c5 build: use nyc for test coverage
884657d examples: remove bitwise syntax for includes check
7511d08 build: use minimatch@3.0.4 for Node.js < 4
2585f20 tests: fix test missing assertion
9d09762 build: supertest@6.2.2
43cc56e build: clean up gitignore
1c7bbcc build: Node.js@14.19
9cbbc8a deps: cookie@0.4.2
6fbc269 pref: remove unnecessary regexp for trust proxy
2bc734a deps: accepts@~1.3.8
89bb531 docs: fix typo in res.download jsdoc
744564f tests: add test for multiple ips in "trust proxy"
da6cb0e tests: add range tests to res.download
00ad5be tests: add more tests for app.request & app.response
141914e tests: fix tests that did not bubble errors
bd4fdfe tests: remove global dependency on should

See the full diff

Package name: mongoose

The new version differs by 250 commits.

f8d2721 chore: release 5.12.3
58cad73 fix(connection): use queueing instead of event emitter for `createCollection()` and other helpers to avoid event emitter warning
5382408 fix(index.d.ts): add `transform` to PopulateOptions interface
dca1d70 Merge branch 'master' of github.com:Automattic/mongoose
2648088 fix(index.d.ts): add DocumentQuery type for backwards compatibility
966770f Merge pull request #10063 from Automattic/gh-10044
9e4a083 style: fix lint
f3cd3a8 chore: use variable instead of function
f24953c fix(query): add `writeConcern()` method to avoid writeConcern deprecation warning
7d2e9c9 chore: upgrade mquery -> 3.2.5 re: Security Fix for Prototype Pollution - huntr.dev mongoosejs/mquery#121
d1a9a1e made requested changes
cf1b666 Merge pull request #10078 from pezzu/master
2aef528 Merge pull request #10062 from Automattic/gh-10025
452c77c Fixes #10072
c9bfb30 Update model.indexes.test.js
6f0133a removed comments
9e98cd8 Merge pull request #10055 from emrebass/patch-1
1c20044 Merge pull request #10054 from coro101/add-discriminator-type
4e74ea7 TIL that includes() is also not supported in all browsers
f231d7b should work and is designed to handle multiple text fields
c4897f9 TIL Object.values in not supported on all browsers
391ecec collation not added to text indexes
7a93c16 linter fix
6deb668 fix: connection ids are now scoped