Update Mend: high confidence minor and patch dependency updates #4

mend-for-github-com · 2024-02-07T14:11:07Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
async (source)	`2.6.3` -> `2.6.4`
body-parser	`1.19.0` -> `1.20.2`
express (source)	`4.17.1` -> `4.19.2`
express-session	`1.17.0` -> `1.18.0`
grunt (source)	`1.1.0` -> `1.6.1`
grunt-cli	`1.3.2` -> `1.4.3`
underscore (source)	`1.9.2` -> `1.13.6`

Release Notes

caolan/async (async)

`v2.6.4`

Compare Source

expressjs/body-parser (body-parser)

`v1.20.2`

Compare Source

===================

Fix strict json error message on Node.js 19+
deps: content-type@~1.0.5
- perf: skip value escaping when unnecessary
deps: raw-body@2.5.2

`v1.20.1`

Compare Source

===================

deps: qs@6.11.0
perf: remove unnecessary object clone

`v1.20.0`

Compare Source

===================

Fix error message for json parse whitespace in strict
Fix internal error when inflated body exceeds limit
Prevent loss of async hooks context
Prevent hanging when request already read
deps: depd@2.0.0
- Replace internal eval usage with Function constructor
- Use instance methods on process to check for listeners
deps: http-errors@2.0.0
- deps: depd@2.0.0
- deps: statuses@2.0.1
deps: on-finished@2.4.1
deps: qs@6.10.3
deps: raw-body@2.5.1
- deps: http-errors@2.0.0

`v1.19.2`

Compare Source

===================

deps: bytes@3.1.2
deps: qs@6.9.7
- Fix handling of __proto__ keys
deps: raw-body@2.4.3
- deps: bytes@3.1.2

`v1.19.1`

Compare Source

===================

deps: bytes@3.1.1
deps: http-errors@1.8.1
- deps: inherits@2.0.4
- deps: toidentifier@1.0.1
- deps: setprototypeof@1.2.0
deps: qs@6.9.6
deps: raw-body@2.4.2
- deps: bytes@3.1.1
- deps: http-errors@1.8.1
deps: safe-buffer@5.2.1
deps: type-is@~1.6.18

expressjs/express (express)

`v4.19.2`

Compare Source

==========

Improved fix for open redirect allow list bypass

`v4.19.1`

Compare Source

==========

Allow passing non-strings to res.location with new encoding handling checks

`v4.19.0`

Compare Source

==========

Prevent open redirect allow list bypass due to encodeurl
deps: cookie@0.6.0

`v4.18.3`

Compare Source

==========

Fix routing requests without method
deps: body-parser@1.20.2
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
- deps: raw-body@2.5.2
deps: cookie@0.6.0
- Add partitioned option

`v4.18.2`

Compare Source

===================

Fix regression routing a large stack in a single route
deps: body-parser@1.20.1
- deps: qs@6.11.0
- perf: remove unnecessary object clone
deps: qs@6.11.0

`v4.18.1`

Compare Source

===================

Fix hanging on large stack of sync routes

`v4.18.0`

Compare Source

===================

Add "root" option to res.download
Allow options without filename in res.download
Deprecate string and non-integer arguments to res.status
Fix behavior of null/undefined as maxAge in res.cookie
Fix handling very large stacks of sync middleware
Ignore Object.prototype values in settings through app.set/app.get
Invoke default with same arguments as types in res.format
Support proper 205 responses using res.send
Use http-errors for res.format error
deps: body-parser@1.20.0
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: depd@2.0.0
- deps: http-errors@2.0.0
- deps: on-finished@2.4.1
- deps: qs@6.10.3
- deps: raw-body@2.5.1
deps: cookie@0.5.0
- Add priority option
- Fix expires option to reject invalid dates
deps: depd@2.0.0
- Replace internal eval usage with Function constructor
- Use instance methods on process to check for listeners
deps: finalhandler@1.2.0
- Remove set content headers that break response
- deps: on-finished@2.4.1
- deps: statuses@2.0.1
deps: on-finished@2.4.1
- Prevent loss of async hooks context
deps: qs@6.10.3
deps: send@0.18.0
- Fix emitted 416 error missing headers property
- Limit the headers removed for 304 response
- deps: depd@2.0.0
- deps: destroy@1.2.0
- deps: http-errors@2.0.0
- deps: on-finished@2.4.1
- deps: statuses@2.0.1
deps: serve-static@1.15.0
- deps: send@0.18.0
deps: statuses@2.0.1
- Remove code 306
- Rename 425 Unordered Collection to standard 425 Too Early

`v4.17.3`

Compare Source

===================

deps: accepts@~1.3.8
- deps: mime-types@~2.1.34
- deps: negotiator@0.6.3
deps: body-parser@1.19.2
- deps: bytes@3.1.2
- deps: qs@6.9.7
- deps: raw-body@2.4.3
deps: cookie@0.4.2
deps: qs@6.9.7
- Fix handling of __proto__ keys
pref: remove unnecessary regexp for trust proxy

`v4.17.2`

Compare Source

===================

Fix handling of undefined in res.jsonp
Fix handling of undefined when "json escape" is enabled
Fix incorrect middleware execution with unanchored RegExps
Fix res.jsonp(obj, status) deprecation message
Fix typo in res.is JSDoc
deps: body-parser@1.19.1
- deps: bytes@3.1.1
- deps: http-errors@1.8.1
- deps: qs@6.9.6
- deps: raw-body@2.4.2
- deps: safe-buffer@5.2.1
- deps: type-is@~1.6.18
deps: content-disposition@0.5.4
- deps: safe-buffer@5.2.1
deps: cookie@0.4.1
- Fix maxAge option to reject invalid values
deps: proxy-addr@~2.0.7
- Use req.socket over deprecated req.connection
- deps: forwarded@0.2.0
- deps: ipaddr.js@1.9.1
deps: qs@6.9.6
deps: safe-buffer@5.2.1
deps: send@0.17.2
- deps: http-errors@1.8.1
- deps: ms@2.1.3
- pref: ignore empty http tokens
deps: serve-static@1.14.2
- deps: send@0.17.2
deps: setprototypeof@1.2.0

expressjs/session (express-session)

`v1.18.0`

Compare Source

===================

Add debug log for pathname mismatch
Add partitioned to cookie options
Add priority to cookie options
Fix handling errors from setting cookie
Support any type in secret that crypto.createHmac supports
deps: cookie@0.6.0
- Fix expires option to reject invalid dates
- perf: improve default decode speed
- perf: remove slow string split in parse
deps: cookie-signature@1.0.7

`v1.17.3`

Compare Source

===================

Fix resaving already-saved new session at end of request
deps: cookie@0.4.2

`v1.17.2`

Compare Source

===================

Fix res.end patch to always commit headers
deps: cookie@0.4.1
deps: safe-buffer@5.2.1

`v1.17.1`

Compare Source

===================

Fix internal method wrapping error on failed reloads

gruntjs/grunt (grunt)

`v1.6.1`

Compare Source

Changelog updates 72f6f03
Merge pull request #1755 from gruntjs/rm-dep 8d4c183
Add recursive 1c7d483
Merge pull request #1756 from gruntjs/downgrade-glob 2d4fd38
Downgrade glob 902db7c
Fix syntax 494f243
remove mkdirp b01389e
remove dep on rimraf and mkdirp 0072510

`v1.6.0`

Compare Source

Merge pull request #1750 from gruntjs/dep-update-jan28 2805dc3
README updates 3f1e423
Bump to 16 8fd096d
Update more deps 42c5f95
Bump eslint and node version 1d88050

`v1.5.3`

Compare Source

Merge pull request #1745 from gruntjs/fix-copy-op 572d79b
Patch up race condition in symlink copying. 58016ff
Merge pull request #1746 from JamieSlome/patch-1 0749e1d
Create SECURITY.md 69b7c50

`v1.5.2`

Compare Source

Update Changelog 7f15fd5
Merge pull request #1743 from gruntjs/cleanup-link b0ec6e1
Clean up link handling 433f91b

`v1.5.1`

Compare Source

Merge pull request #1742 from gruntjs/update-symlink-test ad22608
Fix symlink test 0652305

`v1.5.0`

Compare Source

Updated changelog b2b2c2b
Merge pull request #1740 from gruntjs/update-deps-22-10 3eda6ae
Update testing matrix 47d32de
More updates 2e9161c
Remove console log 04b960e
Update dependencies, tests... aad3d45
Merge pull request #1736 from justlep/main fdc7056
support .cjs extension e35fe54

`v1.4.1`

Compare Source

Update Changelog e7625e5
Merge pull request #1731 from gruntjs/update-options 5d67e34
Fix ci install d13bf88
Switch to Actions 08896ae
Update grunt-known-options eee0673
Add note about a breaking change 1b6e288

`v1.4.0`

Compare Source

Merge pull request #1728 from gruntjs/update-deps-changelog 63b2e89
Update changelog and util dep 106ed17
Merge pull request #1727 from gruntjs/update-deps-apr 49de70b
Update CLI and nodeunit 47cf8b6
Merge pull request #1722 from gruntjs/update-through e86db1c
Update deps 4952368

`v1.3.0`

Compare Source

Merge pull request #1720 from gruntjs/update-changelog-deps faab6be
Update Changelog and legacy-util dependency 520fedb
Merge pull request #1719 from gruntjs/yaml-refactor 7e669ac
Switch to use safeLoad for loading YML files via file.readYAML. e350cea
Merge pull request #1718 from gruntjs/legacy-log-bumo 7125f49
Bump legacy-log 00d5907

`v1.2.1`

Compare Source

Changelog update ae11839
Merge pull request #1715 from sibiraj-s/remove-path-is-absolute 9d23cb6
Remove path-is-absolute dependency e789b1f

`v1.2.0`

Compare Source

Allow usage of grunt plugins that are located in any location that
is visible to Node.js and NPM, instead of node_modules directly
inside package that have a dev dependency to these pluginhttps://github.com/gruntjs/grunt/pull/1677nt/pull/1677)
Removed coffeescript from dependencies. To ease transition, if
coffeescript is still around, Grunt will attempt to load it.
If it is not, and the user loads a CoffeeScript file,
Grunt will print a useful error indicating that the
coffeescript package should be installed as a dev dependency.
This is considerably more user-friendly than dropping the require entirely,
but doing so is feasible with the latest grunt-cli as users
may simply use grunt --require https://github.com/gruntjs/grunt/pull/1675thub.com/Remove coffeescript from dependencies. gruntjs/grunt#1675)
Exposes Grunt Option keys for ease of use.
(https://github.com/gruntjs/grunt/pull/15701570)
Avoiding infinite loop on very long command names.
(https://github.com/gruntjs/grunt/pull/16971697)

gruntjs/grunt-cli (grunt-cli)

Update changelog bbc4400
Ignore package-lock 3fa5bf6
Update deps, switch to actions (#141) c271173
Bump deps, required node version and ci (#137) 84ebcb8

jashkenas/underscore (underscore)

`v1.13.6`

Compare Source

`v1.13.5`

Compare Source

`v1.13.4`

Compare Source

`v1.13.3`

Compare Source

`v1.13.2`

Compare Source

`v1.13.1`

Compare Source

`v1.13.0`

Compare Source

`v1.12.1`

Compare Source

`v1.12.0`

Compare Source

`v1.11.0`

Compare Source

`v1.10.2`

Compare Source

`v1.10.1`

Compare Source

`v1.10.0`

Compare Source

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 68d4557 to b82c6a1 Compare February 16, 2024 05:46

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from b82c6a1 to 63beca7 Compare February 17, 2024 05:33

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 09602c1 to 266db22 Compare February 27, 2024 06:50

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from ac2f319 to ea72712 Compare March 12, 2024 06:05

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from e38d337 to 7e8353a Compare March 20, 2024 06:01

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 7 times, most recently from 1a95a8b to 4e5780a Compare April 1, 2024 06:18

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from 4e5780a to 369ec0c Compare April 2, 2024 19:01

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 545a836 to bd815b8 Compare April 11, 2024 06:25

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from bd815b8 to 1911169 Compare April 18, 2024 18:21

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 902ba4a to 68b0ab7 Compare May 1, 2024 06:39

Update Mend: high confidence minor and patch dependency updates

04f0c11

mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from 68b0ab7 to 04f0c11 Compare May 2, 2024 06:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update Mend: high confidence minor and patch dependency updates #4

Update Mend: high confidence minor and patch dependency updates #4

mend-for-github-com bot commented Feb 7, 2024 •

edited

Update Mend: high confidence minor and patch dependency updates #4

Are you sure you want to change the base?

Update Mend: high confidence minor and patch dependency updates #4

Conversation

mend-for-github-com bot commented Feb 7, 2024 • edited

Release Notes

Configuration

mend-for-github-com bot commented Feb 7, 2024 •

edited