Upgrade mime dependency to version 2.0.3.

[josueorozco]

See https://nodesecurity.io/advisories/535 for more info. References broofa/mime#167

[dougwilson]

It is not possible to upgrade to the 2.x series of the mime module, because it requires Node.js 6+ to function. The 1.4.1 version of mime is not vulnerable, as noted in the vulnerable / not ranges at the top of the advisory, and1.4.1 ships with 0.16.0 of this module already.

[dougwilson]

The 2.x series API is also completely different; please run the tests at least prior to a PR :)

[josueorozco]

Hey Doug,

Was just reading over the reference again and realized you were already on top of it. Thanks!

[dougwilson]

It's no problem 👍 Not sure if you are using this though Express.js or not, but if you are, hang tight and the usage of this module doesn't introduce a vulnerability anyway, but still trying to get an update out.

[josueorozco]

Yep, using this through Express.js. Got wind of it via nsp check, which outputs:

~$ nsp check
(+) 1 vulnerabilities found
┌───────────────┬────────────────────────────┐
│                     │ Regular Expression Denial of Service
├───────────────┼────────────────────────────┤
│ Name          │ mime 
├───────────────┼────────────────────────────┤
│ CVSS          │ 7.5 (High) 
├───────────────┼────────────────────────────┤
│ Installed     │ 1.3.4          
├───────────────┼────────────────────────────┤
│ Vulnerable    │ < 1.4.1 || > 2.0.0 < 2.0.3 
├───────────────┼────────────────────────────┤
│ Patched       │ >= 1.4.1 < 2.0.0 || >= 2.0.3 
├───────────────┼────────────────────────────┤
│ Path.            │ dxcc.local@1.0.0 > express@4.15.5 > send@0.15.6 > mime@1.3.4
├───────────────┼────────────────────────────┤
│ More Info     │ https://nodesecurity.io/advisories/535 
└───────────────┴────────────────────────────┘

Adding the advisory as an exception on my project for now as per the docs here https://github.com/nodesecurity/nsp#exceptions.

Thanks again for your work on this 👍

[dougwilson]

Express.js 4.16.0 is out now with the updated dependency 🎉