[Snyk] Fix for 11 vulnerabilities #99

snyk-bot · 2023-04-28T21:28:49Z

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-MQUERY-1050858	Yes	Proof of Concept
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-MQUERY-1089718	Yes	Proof of Concept
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	No	Proof of Concept
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090601	No	Proof of Concept
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090602	No	Proof of Concept
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Prototype Pollution SNYK-JS-XML2JS-5414874	No	Proof of Concept
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	No	Proof of Concept
589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:fresh:20170908	No	No Known Exploit
469/1000 Why? Has a fix available, CVSS 5.1	Denial of Service (DoS) npm:mem:20180117	Yes	No Known Exploit
589/1000 Why? Has a fix available, CVSS 7.5	Prototype Override Protection Bypass npm:qs:20170213	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: body-parser

The new version differs by 250 commits.

424dadd 1.19.2
11248a2 deps: raw-body@2.4.3
7a088eb build: Node.js@14.19
ecedf31 build: Node.js@16.14
b6bfabd build: Node.js@17.5
badd6b2 build: fix code coverage aggregate upload
96b448a build: Node.js@17.4
70560b1 build: mocha@9.2.0
548a06f build: supertest@6.2.2
3b00678 deps: bytes@3.1.2
d5acb61 build: mocha@9.1.4
82c8a7c tests: add limit + inflate tests
b356758 deps: qs@6.9.7
c631b58 build: supertest@6.2.1
c81a8e2 build: eslint-plugin-import@2.25.4
3c4dcb8 build: Node.js@17.3
d0a214b 1.19.1
fb172d4 build: eslint-plugin-promise@5.2.0
c5e63cb build: Node.js@17.2
c6d43bd build: eslint-plugin-import@2.25.3
313ed6d build: eslint-plugin-promise@5.1.1
8389b51 deps: bytes@3.1.1
aae94b2 deps: http-errors@1.8.1
7f84d4f deps: raw-body@2.4.2

See the full diff

Package name: express

The new version differs by 250 commits.

3d7fce5 4.17.3
f906371 build: update example dependencies
6381bc6 deps: qs@6.9.7
a007863 deps: body-parser@1.19.2
e98f584 Revert "build: use minimatch@3.0.4 for Node.js < 4"
a659137 tests: use strict mode
a39e409 tests: prevent leaking changes to NODE_ENV
82de4de examples: fix path traversal in downloads example
12310c5 build: use nyc for test coverage
884657d examples: remove bitwise syntax for includes check
7511d08 build: use minimatch@3.0.4 for Node.js < 4
2585f20 tests: fix test missing assertion
9d09762 build: supertest@6.2.2
43cc56e build: clean up gitignore
1c7bbcc build: Node.js@14.19
9cbbc8a deps: cookie@0.4.2
6fbc269 pref: remove unnecessary regexp for trust proxy
2bc734a deps: accepts@~1.3.8
89bb531 docs: fix typo in res.download jsdoc
744564f tests: add test for multiple ips in "trust proxy"
da6cb0e tests: add range tests to res.download
00ad5be tests: add more tests for app.request & app.response
141914e tests: fix tests that did not bubble errors
bd4fdfe tests: remove global dependency on should

See the full diff

Package name: mongoose

The new version differs by 250 commits.

f8d2721 chore: release 5.12.3
58cad73 fix(connection): use queueing instead of event emitter for `createCollection()` and other helpers to avoid event emitter warning
5382408 fix(index.d.ts): add `transform` to PopulateOptions interface
dca1d70 Merge branch 'master' of github.com:Automattic/mongoose
2648088 fix(index.d.ts): add DocumentQuery type for backwards compatibility
966770f Merge pull request #10063 from Automattic/gh-10044
9e4a083 style: fix lint
f3cd3a8 chore: use variable instead of function
f24953c fix(query): add `writeConcern()` method to avoid writeConcern deprecation warning
7d2e9c9 chore: upgrade mquery -> 3.2.5 re: Security Fix for Prototype Pollution - huntr.dev mongoosejs/mquery#121
d1a9a1e made requested changes
cf1b666 Merge pull request #10078 from pezzu/master
2aef528 Merge pull request #10062 from Automattic/gh-10025
452c77c Fixes #10072
c9bfb30 Update model.indexes.test.js
6f0133a removed comments
9e98cd8 Merge pull request #10055 from emrebass/patch-1
1c20044 Merge pull request #10054 from coro101/add-discriminator-type
4e74ea7 TIL that includes() is also not supported in all browsers
f231d7b should work and is designed to handle multiple text fields
c4897f9 TIL Object.values in not supported on all browsers
391ecec collation not added to text indexes
7a93c16 linter fix
6deb668 fix: connection ids are now scoped

See the full diff

Package name: tap

The new version differs by 110 commits.

fa3f6e2 12.6.2
b8be134 new computer, phantom png changes
3833522 update js-yaml and nyc for vuln advisories
1871736 12.6.1
066f159 updates for npm audit --fix
ad3bed4 Passes `-r ts-node/register` argument to node
4645ecf Fix font-family typo
63ff608 12.6.0
040f61f Add --no-esm flag to disable '-r esm' behavior
e2c0c1d update tap-mocha-reporter
a73e95b update esm, and audit fix
2233376 12.5.3
b45105f nyc@13.3.0
611ced8 12.5.2
99a989c update write-file-atomic
e255dd9 update ts-node and typescript
b674382 esm@3.2.3
555ecd4 including esm.js in stack traces is almost never helpful
ccf2b44 Don't emit end while waiting for pipes to clear
d3bf1f7 less impact
7fbf13f try something else
b97f460 fix: allow for pipes to drain
740e695 nyc@13.2
d03f383 12.5.1

See the full diff

Package name: validator

The new version differs by 45 commits.

24b3fd3 13.6.1
b986f3d fix: ReDOS in isEmail and isHSL (#1651)
2a3a1c3 13.6.0
1fa0959 chore: add typeof utility (#1648)
cf403d0 fix(isMobilePhone): add Sierra Leone phone and fix Sri Lanka phone (#1558)
3f70b8e feat(isPassportNumber, isIBAN, isMobilePhone): add Mozambique locale (#1604)
05ceb18 isURL(): Allow URLs to have only a username in the userinfo subcomponent (#1644)
9ee1b6b fix(isMobilePhone): update china zh-CN locale (#1642)
b82f4f2 fix(docs): typo in README.md (#1640)
615547f feat(isMobilePhone): add Latvia lv-LV locale (#1638)
d006e08 fix(isMobilePhone): add support for new networks codes in GH (#1635)
c33fca6 fix(isISIN): optimization (#1633)
2ef84e4 fix(isIP): validator patterns for IPv4 and IPv6 RegExp formats (#1632)
67a200d feat(isPostalCode): add KR locale (#1628)
b65ddc5 fix: fix A-z ranges (#1625)
39830a9 feat: IR passport and identityCard, respect .gitignore files (#1595)
5d6db63 feat(isIPRange): add support for IP version 4 or 6 (#1594)
a31c116 fix: update isMobilePhone validation for en-SG (#1573)
63b6162 chore: add gitter chatroom badge (#1592)
bb0dba6 feat(isPassportNumber): add MY locale (#1574)
7989e5b feat(isLicensePlate): add support for pt-BR locale (#1588)
3c771e8 feat(pt-BR): tax id, passport and license plates (#1613)
418df05 fix(isMobilePhone): prevent allowing landline numbers in es-CO (#1623)
6262f62 chore: improving code coverage to 100% branches (#1624)