Update dependency express to v4.17.3 [SECURITY] #18
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.15.5
->4.17.3
GitHub Vulnerability Alerts
CVE-2022-24999
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
Release Notes
expressjs/express
v4.17.3
Compare Source
===================
__proto__
keysv4.17.2
Compare Source
===================
undefined
inres.jsonp
undefined
when"json escape"
is enabledRegExp
sres.jsonp(obj, status)
deprecation messageres.is
JSDocmaxAge
option to reject invalid valuesreq.socket
over deprecatedreq.connection
v4.17.1
Compare Source
===================
null
/undefined
tores.status
"v4.17.0
Compare Source
===================
express.raw
to parse bodies intoBuffer
express.text
to parse bodies into stringres.sendFile
null
/undefined
tores.status
X-Forwarded-Host
pb
) supportSameSite=None
supportContent-Security-Policy
headerpath.normalize
call103 Early Hints
throw
on invalid typev4.16.4
Compare Source
===================
"Request aborted"
may be logged inres.sendfile
Router
constructorv4.16.3
Compare Source
===================
%
as last characterv4.16.2
Compare Source
===================
TypeError
inres.send
when givenBuffer
andETag
header setX-Forwarded-Proto
headerv4.16.1
Compare Source
===================
root
is incorrectly set to a filev4.16.0
Compare Source
===================
"json escape"
setting forres.json
andres.jsonp
express.json
andexpress.urlencoded
to parse bodiesoptions
argument tores.download
Buffer
encoding when not generating ETag for small responsesafe-buffer
for improved Buffer APIres.headersSent
when availableRegExp
X-Forwarded-For
X-Forwarded-For
headerimmutable
option</html>
in default error & redirectsimmutable
option.charset
set inres.jsonp
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.