Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade: , , body-parser, dotenv, express, express-jwt, formidable, mongodb, mongoose, webpack, webpack-merge, webpack-dev-server #350

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

rawdaymohamed
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

@babel/node
from 7.18.10 to 7.25.0 | 22 versions ahead of your current version | 2 months ago
on 2024-07-26
@csstools/normalize.css
from 12.0.0 to 12.1.1 | 2 versions ahead of your current version | 9 months ago
on 2023-12-29
body-parser
from 1.20.0 to 1.20.2 | 2 versions ahead of your current version | 2 years ago
on 2023-02-22
dotenv
from 16.0.2 to 16.4.5 | 18 versions ahead of your current version | 7 months ago
on 2024-02-20
express
from 4.18.1 to 4.19.2 | 5 versions ahead of your current version | 6 months ago
on 2024-03-25
express-jwt
from 7.7.5 to 7.7.8 | 3 versions ahead of your current version | 3 months ago
on 2024-06-24
formidable
from 2.0.1 to 2.1.2 | 3 versions ahead of your current version | 2 years ago
on 2022-12-01
mongodb
from 4.9.0 to 4.17.2 | 12 versions ahead of your current version | 9 months ago
on 2023-12-05
mongoose
from 6.5.4 to 6.13.0 | 48 versions ahead of your current version | 3 months ago
on 2024-06-06
webpack
from 5.85.0 to 5.94.0 | 16 versions ahead of your current version | a month ago
on 2024-08-22
webpack-merge
from 5.8.0 to 5.10.0 | 2 versions ahead of your current version | a year ago
on 2023-10-16
webpack-dev-server
from 4.10.1 to 4.15.2 | 11 versions ahead of your current version | 6 months ago
on 2024-03-20

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Server-side Request Forgery (SSRF)
SNYK-JS-IP-6240864
519 Proof of Concept
high severity Prototype Pollution
SNYK-JS-MONGOOSE-5777721
519 Proof of Concept
high severity Path Traversal
SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555
519 Proof of Concept
high severity Denial of Service (DoS)
SNYK-JS-WS-7266574
519 Proof of Concept
high severity Prototype Poisoning
SNYK-JS-QS-3153490
519 Proof of Concept
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509
519 No Known Exploit
medium severity Information Exposure
SNYK-JS-MONGODB-5871303
519 No Known Exploit
medium severity Information Exposure
SNYK-JS-MONGODB-5871303
519 No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-WEBPACK-7840298
519 Proof of Concept
medium severity Server-Side Request Forgery (SSRF)
SNYK-JS-IP-7148531
519 Proof of Concept
Release notes
Package name: @babel/node
  • 7.25.0 - 2024-07-26

    v7.25.0 (2024-07-26)

    Thanks @ davidtaylorhq and @ slatereax for your first PR!

    You can find the release blog post with some highlights at https://babeljs.io/blog/2024/07/26/7.25.0.

    👓 Spec Compliance

    • babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
    • babel-plugin-transform-typescript
      • #16602 Ensure enum members syntactically determinable to be strings do not get reverse mappings (@ liuxingbaoyu)

    🚀 New Feature

    • babel-helper-create-class-features-plugin, babel-helper-function-name, babel-helper-plugin-utils, babel-helper-wrap-function, babel-plugin-bugfix-safari-class-field-initializer-scope, babel-plugin-bugfix-safari-id-destructuring-collision-in-function-expression, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-preset-env, babel-traverse, babel-types
    • babel-helper-hoist-variables, babel-helper-plugin-utils, babel-plugin-proposal-async-do-expressions, babel-plugin-transform-modules-systemjs, babel-traverse
    • babel-helper-create-class-features-plugin, babel-helper-module-transforms, babel-helper-plugin-utils, babel-helper-split-export-declaration, babel-plugin-transform-classes, babel-traverse, babel-types
    • babel-helper-create-class-features-plugin, babel-helper-environment-visitor, babel-helper-module-transforms, babel-helper-plugin-utils, babel-helper-remap-async-to-generator, babel-helper-replace-supers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-transform-async-generator-functions, babel-plugin-transform-classes, babel-traverse
    • babel-core, babel-parser
    • babel-compat-data, babel-plugin-bugfix-safari-class-field-initializer-scope, babel-preset-env
    • babel-plugin-transform-block-scoping, babel-traverse, babel-types
    • babel-helper-import-to-platform-api, babel-plugin-proposal-json-modules
    • babel-helper-transform-fixture-test-runner, babel-node
    • babel-compat-data, babel-helper-create-regexp-features-plugin, babel-plugin-proposal-duplicate-named-capturing-groups-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-preset-env, babel-standalone
      • #16445 Add duplicate-named-capturing-groups-regex to preset-env (@ JLHwung)

    🐛 Bug Fix

    🏠 Internal

    • Other
    • babel-generator
    • babel-helper-function-name, babel-plugin-transform-arrow-functions, babel-plugin-transform-function-name, babel-preset-env, babel-traverse

    🏃‍♀️ Performance

    • babel-parser, babel-plugin-proposal-pipeline-operator

    🔬 Output optimization

    • babel-plugin-transform-classes
    • babel-helper-create-class-features-plugin, babel-helper-replace-supers, babel-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-object-super, babel-plugin-transform-private-methods, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
    • babel-plugin-transform-class-properties, babel-plugin-transform-classes

    Committers: 6

  • 7.24.8 - 2024-07-11

    v7.24.8 (2024-07-11)

    Thanks @ H0onnn, @ jkup and @ SreeXD for your first pull requests!

    👓 Spec Compliance

    🐛 Bug Fix

    💅 Polish

    Committers: 9

  • 7.24.7 - 2024-06-05

    v7.24.7 (2024-06-05)

    🐛 Bug Fix

    • babel-node
    • babel-traverse
    • babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management

    🏠 Internal

    • babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

    Committers: 7

  • 7.24.6 - 2024-05-24

    v7.24.6 (2024-05-24)

    Thanks @ amjed-98, @ blakewilson, @ coelhucas, and @ SukkaW for your first PRs!

    🐛 Bug Fix

    • babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
    • babel-core, babel-generator, babel-plugin-transform-modules-commonjs
    • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
      • #16483 Fix: throw TypeError if addInitializer is called after finished (@ JLHwung)
    • babel-parser, babel-plugin-transform-typescript

    🏠 Internal

    • babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
    • babel-helpers
    • babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
    • babel-parser, babel-traverse
    • Other

    Committers: 9

  • 7.23.9 - 2024-01-25
  • 7.22.19 - 2023-09-14
  • 7.22.15 - 2023-09-04
  • 7.22.10 - 2023-08-07
  • 7.22.6 - 2023-07-04
  • 7.22.5 - 2023-06-08
  • 7.22.1 - 2023-05-26
  • 7.22.0 - 2023-05-26
  • 7.21.4-esm.4 - 2023-04-04
  • 7.21.4-esm.3 - 2023-04-04
  • 7.21.4-esm.2 - 2023-04-04
  • 7.21.4-esm.1 - 2023-04-04
  • 7.21.4-esm - 2023-04-04
  • 7.20.7 - 2022-12-22
  • 7.20.5 - 2022-11-28
  • 7.20.2 - 2022-11-04
  • 7.20.0 - 2022-10-27
  • 7.19.1 - 2022-09-14
  • 7.18.10 - 2022-08-01
from @babel/node GitHub release notes
Package name: @csstools/normalize.css
  • 12.1.1 - 2023-12-29
    • Fixed: normalize text-size-adjust in the most backwards compatible way.
  • 12.1.0 - 2023-12-29
    • Added: text-size-adjust #25
    • Fixed: group pre with code, kbd, samp #24
  • 12.0.0 - 2021-09-15
    • Changed: normalize.css no longer contributes specificity.
    • Changed: normalize.css fixes now respect writing-mode.
    • Removed: Fixes for older browsers, and all fixes for IE.
    • Fixed: table uses correct border-color: currentColor normalization.
from @csstools/normalize.css GitHub release notes
Package name: body-parser
  • 1.20.2 - 2023-02-22
    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
      • perf: skip value escaping when unnecessary
    • deps: raw-body@2.5.2
  • 1.20.1 - 2022-10-06
    • deps: qs@6.11.0
    • perf: remove unnecessary object clone
  • 1.20.0 - 2022-04-03
    • Fix error message for json parse whitespace in strict
    • Fix internal error when inflated body exceeds limit
    • Prevent loss of async hooks context
    • Prevent hanging when request already read
    • deps: depd@2.0.0
      • Replace internal eval usage with Function constructor
      • Use instance methods on process to check for listeners
    • deps: http-errors@2.0.0
      • deps: depd@2.0.0
      • deps: statuses@2.0.1
    • deps: on-finished@2.4.1
    • deps: qs@6.10.3
    • deps: raw-body@2.5.1
      • deps: http-errors@2.0.0
from body-parser GitHub release notes
Package name: dotenv from dotenv GitHub release notes
Package name: express from express GitHub release notes
Package name: express-jwt from express-jwt GitHub release notes
Package name: formidable
  • 2.1.2 - 2022-12-01
  • 2.1.1 - 2022-12-01
  • 2.1.0 - 2022-12-01

    2.1.0

  • 2.0.1 - 2021-10-30
from formidable GitHub release notes
Package name: mongodb
  • 4.17.2 - 2023-12-05

    4.17.2 (2023-11-16)

    The MongoDB Node.js team is pleased to announce version 4.17.2 of the mongodb package!

    Release Notes

    Fix connection leak when serverApi is enabled

    When enabling serverApi the driver's RTT mesurment logic (used to determine the closest node) still sent the legacy hello command "isMaster" causing the server to return an error. Unfortunately, the error handling logic did not correctly destroy the socket which would cause a leak.

    Both sending the correct hello command and the error handling connection clean up logic are fixed in this change.

    Bug Fixes

    Documentation

    We invite you to try the mongodb library immediately, and report any issues to the NODE project.

  • 4.17.1 - 2023-08-23

    4.17.1 (2023-08-23)

    The MongoDB Node.js team is pleased to announce version 4.17.1 of the mongodb package!

    Release Notes

    Import of saslprep updated to correct library.

    Fixes the import of saslprep to be the correct @ mongodb-js/saslprep library.

    Bug Fixes

    Documentation

    We invite you to try the mongodb library immediately, and report any issues to the NODE project.

  • 4.17.0 - 2023-08-17
  • 4.16.0 - 2023-04-18
  • 4.15.0 - ...

Snyk has created this PR to upgrade:
  - @babel/node from 7.18.10 to 7.25.0.
    See this package in npm: https://www.npmjs.com/package/@babel/node
  - @csstools/normalize.css from 12.0.0 to 12.1.1.
    See this package in npm: https://www.npmjs.com/package/@csstools/normalize.css
  - body-parser from 1.20.0 to 1.20.2.
    See this package in npm: https://www.npmjs.com/package/body-parser
  - dotenv from 16.0.2 to 16.4.5.
    See this package in npm: https://www.npmjs.com/package/dotenv
  - express from 4.18.1 to 4.19.2.
    See this package in npm: https://www.npmjs.com/package/express
  - express-jwt from 7.7.5 to 7.7.8.
    See this package in npm: https://www.npmjs.com/package/express-jwt
  - formidable from 2.0.1 to 2.1.2.
    See this package in npm: https://www.npmjs.com/package/formidable
  - mongodb from 4.9.0 to 4.17.2.
    See this package in npm: https://www.npmjs.com/package/mongodb
  - mongoose from 6.5.4 to 6.13.0.
    See this package in npm: https://www.npmjs.com/package/mongoose
  - webpack from 5.85.0 to 5.94.0.
    See this package in npm: https://www.npmjs.com/package/webpack
  - webpack-merge from 5.8.0 to 5.10.0.
    See this package in npm: https://www.npmjs.com/package/webpack-merge
  - webpack-dev-server from 4.10.1 to 4.15.2.
    See this package in npm: https://www.npmjs.com/package/webpack-dev-server

See this project in Snyk:
https://app.snyk.io/org/rawda-developer/project/5278a596-6cdc-4719-8815-3c0c81d84861?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants