[Snyk] Fix for 10 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

  • package.json
  • package-lock.json

• Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
  Find out more.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-JQUERY-174006	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Cross-site Scripting (XSS) SNYK-JS-JQUERY-565129	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-MONGODB-473855	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-MQUERY-1050858	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:marked:20170907	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:marked:20180225	No	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:negotiator:20160616	Yes	No Known Exploit
	756/1000 Why? Mature exploit, Has a fix available, CVSS 7.4	Uninitialized Memory Exposure npm:npmconf:20180512	Yes	Mature

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: errorhandler

The new version differs by 85 commits.

• c41e9aa 1.4.3
• ffce329 build: istanbul@0.4.2
• 90a8777 build: Node.js@4.2
• 38b745b deps: accepts@~1.3.0
• 80aea51 deps: escape-html@~1.0.3
• b0be93a docs: fix typo in readme
• 2f688d0 build: support Node.js 5.x
• 1238ed4 build: istanbul@0.4.1
• fdeb13c build: mocha@2.3.4
• cc6fd1f build: support Node.js 4.x
• 3a2117a build: support io.js 3.x
• 75b9ee1 build: reduce runtime versions to one per major
• 6797752 tests: add test for util.inspect in HTML response
• b6e53d7 docs: add more documentation regarding util.inspect
• 88b9a58 deps: accepts@~1.2.13
• ac75d3f build: istanbul@0.3.19
• 5ee62b7 deps: escape-html@1.0.3
• 1e89ae7 build: istanbul@0.3.18
• ef1e8f1 build: supertest@1.1.0
• a7a6dce 1.4.2
• 692e2e7 deps: accepts@~1.2.12
• 6f2e8d2 build: io.js@2.5
• 564c117 build: fix running Node.js 0.8 tests on Travis CI
• 2dfd872 1.4.1

See the full diff

Package name: express

The new version differs by 151 commits.

• 9375a9a 4.14.0
• 14cf9c5 deps: update example dependencies
• 605983f build: should@9.0.2
• e06766c deps: finalhandler@0.5.0
• 76eaa32 Encode URL in res.location/res.redirect if not already encoded
• c12cc88 build: support Node.js 6.x
• 23c22ce build: support Node.js 5.x
• 791cabf deps: serve-static@~1.11.1
• fc40702 deps: send@0.14.1
• c762b16 Improve error with invalid arguments to req.get()
• 5d642af Add "options" argument to req.range
• 7fcf1d7 docs: update the req.range jsdoc comment
• 7ee41cc deps: range-parser@~1.2.0
• 8ddab69 build: supertest@1.2.0
• d038689 build: should@9.0.0
• c9531ac build: mocha@2.5.3
• 98224d2 build: ejs@2.4.2
• 2e1284b Fix Windows absolute path check using forward slashes
• 999546d deps: qs@6.2.0
• cc25a04 deps: type-is@~1.6.13
• f90f9dd Improve performance for res.json/res.jsonp in most cases
• b69b760 perf: use strict equality when possible
• c6039af deps: proxy-addr@~1.1.2
• bdf604a deps: cookie@0.3.1

See the full diff

Package name: marked

The new version differs by 250 commits.

• 98c9d14 Update home page
• 5d5fa04 0.3.18
• f886f40 Merge pull request fix: package.json, package-lock.json & .snyk to reduce vulnerabilities snyk-labs/nodejs-goof#1147 from 8fold/update-badges
• 044683b Remove Authors ~Head
• cceac77 Merge remote-tracking branch 'upstream/master' into update-badges
• 265d6c1 pre-commit
• 341d128 Merge branch 'master' into update-badges
• eef9de4 Add /docs directory for GitHub Pages (fix: package.json & package-lock.json to reduce vulnerabilities snyk-labs/nodejs-goof#1138)
• 682b9c6 grammar
• e3489ca Add marked mark maker badge
• 03d0ed0 [editorconfig]: All md files except in test use tab (Iactest snyk-labs/nodejs-goof#1111)
• c22be25 Create CNAME for marked.js.org
• 35214c5 Add initial docs with logo
• 3e681a6 Move most of README.md to /docs/README.md
• 94b8b3e Move existing docs to /docs dir
• 2509660 Rename doc to docs
• d4e7bb4 Code of conduct ([Snyk] Security upgrade node from 14.1.0 to 14.18.0 snyk-labs/nodejs-goof#1094)
• 214468b Merge pull request [Snyk-dev] Security upgrade node from 14.1.0 to 14.17.6 snyk-labs/nodejs-goof#1121 from UziTech/jasmine
• ad0585d Merge pull request Deployment file creation snyk-labs/nodejs-goof#1122 from alextrastero/patch-1
• e3a988c Fix usage links in README
• ecbf4b0 Minor docs update for easier maintenance (Update the CodeQL Workflow snyk-labs/nodejs-goof#1116)
• 5768180 travis build stages ([Snyk-dev] Security upgrade node from 14.1.0 to 14.18.1 snyk-labs/nodejs-goof#1113)
• 9c6c13f fix tests
• 79325aa add tests

See the full diff

Package name: mongoose

The new version differs by 250 commits.

• d7fc59c chore: release 5.11.7
• d318339 fix(index.d.ts): make `Document#id` optional so types that use `id` can use `Model<IMyType & Document>`
• a9b317a chore: upgrade mquery -> 3.2.3
• 43f88db fix(document): ensure calling `get()` with empty string returns undefined for mongoose-plugin-autoinc
• 369efe1 Merge pull request #9692 from sahasayan/patch-4
• f879c4d chore: update opencollective sponsors
• 1be4d87 fix(model): set `isNew` to false for documents that were successfully inserted by `insertMany` with `ordered = false` when an error occurred
• b2da840 test(model): repro #9677
• 15d6660 fix(index.d.ts): add missing Aggregate#skip() & Aggregate#limit()
• dd348b1 chore: release 5.11.6
• 3ec01fa fix(index.d.ts): allow calling `mongoose.model()` and `Connection#model()` with model as generic param
• ccfa041 Merge pull request #9686 from cjroebuck/patch-1
• 7a52e45 Merge pull request #9685 from sahasayan/patch-3
• a5c98c2 Allow array of validators in SchemaTypeOptions
• 48907ea fix(index.d.ts): allow 2 generic types in mongoose.model function
• a17a2c3 Merge pull request #9683 from isengartz/master
• 61595f0 fix(index.d.ts): allow passing ObjectId properties as strings to `create()` and `findOneAndReplace()`
• 8e20ee6 optional next() parameter for post middleware
• 8a52485 Merge pull request #9680 from orgads/aggregate
• 1ef8274 fix(middleware): ensure sync errors in pre hooks always bubble up to the calling code
• 067e3a2 fix(index.d.ts): Fix return type of Model#aggregate()
• 0e2058d chore: release 5.11.5
• 6d9fb4d fix(index.d.ts): add missing `SchemaTypeOpts` and `ConnectionOptions` aliases for backwards compat
• a85adb9 test: fix tests re: #9669

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	539/1000 Why? Has a fix available, CVSS 6.5	Timing Attack npm:http-signature:20150122	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic