Update mime

[castilloandres]

Update mime package from v1.4.1 to v1.6.0 to fix -> expressjs/express#3486

[dougwilson]

Awesome, thanks! Before I can merge this, I need to make the following fixes (I'm listing them here in case you have some time to help with them, but otherwise I'll take care of them):

1. Remove the version bump from package.json
2. Remove the package-lock.json file
3. Add an entry to HISTORY.md describing that the dependency has changed and what the changes are

[castilloandres]

@dougwilson done! 👍

[dougwilson]

Thanks! I feel like there would have been more than ome change between 1.4.1 and 1.6.0 (i.e. there was a 1.5.0 at least)? I'll take a look into this unless you're saying there wasn't any other changes. Also I need to remove the version and date from the top of the HISTORY file before I can get it merged and remove the unrelated line changes.

I'm not asking you to make these changes unless you want to, just being transparent in the changes I will be making to the PR before merging.

[castilloandres]

@dougwilson I did the following changes:

1. Removed date and version in HISTORY.md
2. Added missing changes from node-mime @1.5.0 in HISTORY.md
3. Put trailing spaces back in HISTORY.md. My sublime removes them when saving the file.

Please let me know if any further changes are needed.

Thanks for the help!

[dougwilson]

Thanks @castilloandres ! I'm not sure that is right, because at least one of those (the vulnerability one) was already included in a prior version (1.4.1). I would expect to only see the changes between 1.4.1 and 1.6.0 included in the notes. I'll take a look at the mime library to see what the changes between those versions are.

[castilloandres]

@dougwilson indeed the fix was included from mime@1.x so I went ahead and updated the HISTORY.md.

[devongovett]

bump, can we get this in?

[dougwilson]

Just need the history updated to reflect the actual changes included here.

[dougwilson]

Also looks like there is an update to the history file for a very old version of this module. Not sure why that is being updated in the PR. Can someone explain?

[devongovett]

here's the diff: broofa/mime@v1.4.1...v1.6.0

[dougwilson]

Which one of those commits does the entry Fix vulnerable regular expression refer to?

[devongovett]

broofa/mime#167

[devongovett]

oh hmm, that commit doesn't actually look like it's in the diff... only in the 2.x series? broofa/mime@1df903f

changelog lies

[dougwilson]

That's an issue, not a commit that was included in that diff you provided. That issue was resolved in mime version 1.4.1, though. Why would that be listed in the changes here?

[devongovett]

yup agreed, it shouldn't be in the history here.

[dougwilson]

Like I said, the included change list in this PR is not correct. I can merge it when it's fixed up. Here are the issues I see blocking merging right now:

1. The change log doesn't actually describe the changes of mime 1.4.1 to 1.6.0
2. There is no description of what types are being changes here that would help anyone understand what is happening. For example @devongovett I assume you're looking for some particular change. Is that listed in the history file here?
3. There is a change included lower down in the HISTORY file for an older version. Not sure why that change is there. Should it actually be at the top with the rest of the changes?

Once this is resolved, this will create a candidate for a new minor version of this module. Versions of this are locked with Express and so will need to schedule a new minor version of Express 4.x as well. Once the scheduling is done, we'll get new releases cut. We don't even start the scheduling process until there is at least one candidate change, and this PR is still pending updates.

I hope that helps provide the state of the PR @devongovett

[devongovett]

I'm looking for correct mime type for .wasm files for the Parcel dev server: https://github.com/parcel-bundler/parcel. We just use serve-static directly without express, so once that and send are updated, we'll be set.

I'll make a new PR and address the issues you raised.

[dougwilson]

Thanks @devongovett . Please verify with @castilloandres that that is OK. Of course just as an FYI you can always define new MIME types and extensions with this module; you are not locked in to the ones included by default -- they are just the defaults not the only possible values.

[devongovett]

#154

[castilloandres]

Closing this PR. Following up on #154