Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: Upgrade path-to-regexp from 6.2.2 to 8.2.0 #9424

Conversation

parseplatformorg
Copy link
Contributor

snyk-top-banner

Snyk has created this PR to upgrade path-to-regexp from 6.2.2 to 8.2.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

  • The recommended version is 7 versions ahead of your current version.

  • The recommended version was released on a month ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-7925106
666 Proof of Concept
Release notes
Package name: path-to-regexp
  • 8.2.0 - 2024-09-26

    Fixed

    • Allowing path-to-regexp to run on older browsers by targeting ES2015
      • Target ES2015 5969033
        • Also saved 0.22kb (10%!) by removing the private class field down level
      • Remove s flag from regexp 51dbd45

    v8.1.0...v8.2.0

  • 8.1.0 - 2024-09-10

    Added

    • Adds pathToRegexp method back for generating a regex
    • Adds stringify method for converting TokenData into a path string

    v8.0.0...v8.1.0

  • 8.0.0 - 2024-09-01

    Heads up! This is a fairly large change (again) and I need to apologize in advance. If I foresaw what this version would have ended up being I would not have released version 7. A longer blog post and explanation will be incoming this week, but the pivot has been due to work on Express.js v5 and this will the finalized syntax used in Express moving forward.

    Edit: The post is out - https://blakeembrey.com/posts/2024-09-web-redos/

    Added

    • Adds key names to wildcards using *name syntax, aligns with : behavior but using an asterisk instead

    Changed

    • Removes group suffixes of ?, +, and * - only optional exists moving forward (use wildcards for +, {*foo} for *)
    • Parameter names follow JS identifier rules and allow unicode characters

    Added

    • Parameter names can now be quoted, e.g. :"foo-bar"
    • Match accepts an array of values, so the signature is now string | TokenData | Array<string | TokenData>

    Removed

    • Removes loose mode
    • Removes regular expression overrides of parameters

    v7.1.0...v8.0.0

  • 7.2.0 - 2024-09-10

    Added

    • Support array inputs for match and pathToRegexp 3fdd88f

    v7.1.0...v7.2.0

  • 7.1.0 - 2024-07-13
  • 7.0.0 - 2024-06-20
  • 6.3.0 - 2024-09-12

    Fixed

    v6.2.2...v6.3.0

  • 6.2.2 - 2024-04-07
from path-to-regexp GitHub release notes

Important

  • Warning: This PR contains a major version upgrade, and may be a breaking change.
  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Snyk has created this PR to upgrade path-to-regexp from 6.2.2 to 8.2.0.

See this package in npm:
path-to-regexp

See this project in Snyk:
https://app.snyk.io/org/acinader/project/c354db4d-ec51-46b5-8574-3238dc19f365?utm_source=github&utm_medium=referral&page=upgrade-pr
Copy link

I will reformat the title to use the proper commit message syntax.

@parse-github-assistant parse-github-assistant bot changed the title [Snyk] Upgrade path-to-regexp from 6.2.2 to 8.2.0 refactor: Upgrade path-to-regexp from 6.2.2 to 8.2.0 Nov 9, 2024
Copy link

Thanks for opening this pull request!

  • ❌ Please link an issue that describes the reason for this pull request, otherwise your pull request will be closed. Make sure to write it as Closes: #123 in the PR description, so I can recognize it.

@mtrezza mtrezza closed this Nov 9, 2024
@mtrezza mtrezza deleted the snyk-upgrade-fe9369196169146526e4034a3cb7905a branch November 9, 2024 17:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants