Skip to content

[Snyk] Upgrade: body-parser, express, express-validator, moment, sqlite3 #188

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade: body-parser, express, express-validator, moment, sqlite3 #188

wants to merge 1 commit into from

Conversation

@irklva
Copy link
Owner

@irklva irklva commented Sep 13, 2024

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

body-parser
from 1.19.0 to 1.20.2 | 5 versions ahead of your current version | 2 years ago
on 2023-02-22
express
from 4.17.1 to 4.19.2 | 9 versions ahead of your current version | 6 months ago
on 2024-03-25
express-validator
from 6.12.1 to 6.15.0 | 7 versions ahead of your current version | 2 years ago
on 2023-02-16
moment
from 2.29.1 to 2.30.1 | 5 versions ahead of your current version | 9 months ago
on 2023-12-27
sqlite3
from 5.0.2 to 5.1.7 | 18 versions ahead of your current version | 8 months ago
on 2024-01-05

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Arbitrary Code Execution
SNYK-JS-SQLITE3-3358947		 619 No Known Exploit
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 619 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOMENT-2944238		 619 Proof of Concept
high severity Prototype Poisoning
SNYK-JS-QS-3153490		 619 Proof of Concept
high severity Prototype Poisoning
SNYK-JS-QS-3153490		 619 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 619 Proof of Concept
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 619 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579147		 619 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579152		 619 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579155		 619 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 619 Proof of Concept
high severity Denial of Service (DoS)
SNYK-JS-SQLITE3-2388645		 619 Proof of Concept
high severity Directory Traversal
SNYK-JS-MOMENT-2440688		 619 No Known Exploit
medium severity Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 619 Proof of Concept
medium severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JS-TAR-6476909		 619 Proof of Concept
medium severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JS-TAR-6476909		 619 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 619 Proof of Concept
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509		 619 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 619 No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 619 No Known Exploit
Release notes
Package name: body-parser from body-parser GitHub release notes
Package name: express from express GitHub release notes
Package name: express-validator from express-validator GitHub release notes
Package name: moment from moment GitHub release notes
Package name: sqlite3
  • 5.1.7 - 2024-01-05

    What's Changed

    • Updated bundled SQLite to v3.44.2 by @ daniellockyer
    • Replaced @ mapbox/node-pre-gyp with prebuild + prebuild-install (605c7f9) by @ daniellockyer
      • this should fix a lot of bundling issues reported by the community
    • Improved RowToJS performance by removing Napi::String::New instantiation by @ daniellockyer
    • Various minor code refactors and improvements (thanks @ zenon8adams!)

    New Contributors

@snyk-bot
fix: upgrade multiple dependencies with Snyk
d163528 
Snyk has created this PR to upgrade:
  - body-parser from 1.19.0 to 1.20.2.
    See this package in npm: https://www.npmjs.com/package/body-parser
  - express from 4.17.1 to 4.19.2.
    See this package in npm: https://www.npmjs.com/package/express
  - express-validator from 6.12.1 to 6.15.0.
    See this package in npm: https://www.npmjs.com/package/express-validator
  - moment from 2.29.1 to 2.30.1.
    See this package in npm: https://www.npmjs.com/package/moment
  - sqlite3 from 5.0.2 to 5.1.7.
    See this package in npm: https://www.npmjs.com/package/sqlite3

See this project in Snyk:
https://app.snyk.io/org/irklva/project/293bdae2-c834-4575-9976-040b8941f464?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@irklva @snyk-bot