[Snyk] Upgrade: bcrypt, body-parser, dotenv, ejs, express, express-rate-limit, express-session, mongoose, passport, passport-local-mongoose #353

natalieermeryd · 2024-09-21T10:38:38Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

bcrypt
from 5.0.1 to 5.1.1 | 2 versions ahead of your current version | a year ago
on 2023-08-16
body-parser
from 1.19.1 to 1.20.2 | 4 versions ahead of your current version | 2 years ago
on 2023-02-22
dotenv
from 16.0.0 to 16.4.5 | 20 versions ahead of your current version | 7 months ago
on 2024-02-20
ejs
from 3.1.6 to 3.1.10 | 4 versions ahead of your current version | 5 months ago
on 2024-04-12
express
from 4.17.2 to 4.19.2 | 8 versions ahead of your current version | 6 months ago
on 2024-03-25
express-rate-limit
from 6.2.0 to 6.11.2 | 16 versions ahead of your current version | a year ago
on 2023-09-12
express-session
from 1.17.2 to 1.18.0 | 2 versions ahead of your current version | 8 months ago
on 2024-01-28
mongoose
from 6.1.9 to 6.13.0 | 84 versions ahead of your current version | 3 months ago
on 2024-06-06
passport
from 0.5.2 to 0.7.0 | 3 versions ahead of your current version | 10 months ago
on 2023-11-27
passport-local-mongoose
from 6.1.0 to 6.3.0 | 4 versions ahead of your current version | 3 years ago
on 2022-03-12

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Remote Code Execution (RCE) SNYK-JS-EJS-2803307	265	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	265	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	265	No Known Exploit
Information Exposure SNYK-JS-MONGODB-5871303	265	No Known Exploit
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	265	Proof of Concept
Improper Control of Dynamically-Managed Code Resources SNYK-JS-EJS-6689533	265	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	265	No Known Exploit
Session Fixation SNYK-JS-PASSPORT-2840631	265	No Known Exploit

Release notes

Package name: bcrypt

5.1.1 - 2023-08-16
What's Changed
- Refactored example with async await by @ lpizzinidev in #894
- Fixed z/OS build issue by @ laijonathan in #968
- Update dependencies by @ recrsn in #993
New Contributors
- @ lpizzinidev made their first contribution in #894
- @ laijonathan made their first contribution in #968
Full Changelog: v5.1.0...v5.1.1
5.1.0 - 2022-10-06
What's Changed
- Update node-pre-gyp to 1.0.2 by @ feuxfollets1013 in #865
- Update README for inclusion of musl by @ arbourd in #883
- Version bump, security updates to sub dep npmlog by @ adaniels-parabol in #905
- document ESM usage (#892) by @ mariusa in #899
- fix: update travis CI Docker image repository by @ cokia in #930
- Update node versions in appveyor test matrix by @ p-kuen in #936
- chore(appveyor): not use latest npm by @ cokia in #932
- chore: update Appveyor readme badge by @ cokia in #933
- Use Github actions for CI by @ recrsn in #858
- Update dependencies by @ recrsn in #953
- Migrate tests to use Jest by @ recrsn in #958
- Pin NAPI to v3 by @ recrsn in #959
New Contributors
- @ feuxfollets1013 made their first contribution in #865
- @ arbourd made their first contribution in #883
- @ adaniels-parabol made their first contribution in #905
- @ mariusa made their first contribution in #899
- @ cokia made their first contribution in #930
- @ p-kuen made their first contribution in #936
Full Changelog: v5.0.1...v5.1.0
5.0.1 - 2021-02-26
Update node-pre-gyp to 1.0.0

from bcrypt GitHub release notes

Package name: body-parser

1.20.2 - 2023-02-22
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
  - perf: skip value escaping when unnecessary
- deps: [email protected]
1.20.1 - 2022-10-06
- deps: [email protected]
- perf: remove unnecessary object clone
1.20.0 - 2022-04-03
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: [email protected]
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
1.19.2 - 2022-02-16
- deps: [email protected]
- deps: [email protected]
  - Fix handling of __proto__ keys
- deps: [email protected]
  - deps: [email protected]
1.19.1 - 2021-12-10
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: type-is@~1.6.18

from body-parser GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: ejs

3.1.10 - 2024-04-12
Version 3.1.10
3.1.9 - 2023-03-12
Version 3.1.9
3.1.8 - 2022-05-11
Version 3.1.8
3.1.7 - 2022-04-20
Version 3.1.7
3.1.6 - 2021-02-06
Version 3.1.6

from ejs GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: [email protected]
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: [email protected]
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: [email protected] and [email protected] by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add [email protected] by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: [email protected]
  - deps: [email protected]
  - perf: remove unnecessary object clone
- deps: [email protected]
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: [email protected]
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: [email protected]
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: [email protected]
  - Remove set content headers that break response
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Prevent loss of async hooks context
- deps: [email protected]
- deps: [email protected]
  - Fix emitted 416 error missing headers property
  - Limit the headers removed for 304 response
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Remove code 306
  - Rename 425 Unordered Collection to standard 425 Too Early
4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
  - deps: mime-types@~2.1.34
  - deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - Fix handling of __proto__ keys
- pref: remove unnecessary regexp for trust proxy
4.17.2 - 2021-12-17
- Fix handling of undefined in res.jsonp
- Fix handling of undefined when "json escape" is enabled
- Fix incorrect middleware execution with unanchored RegExps
- Fix res.jsonp(obj, status) deprecation message
- Fix typo in res.is JSDoc
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.18
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Fix maxAge option to reject invalid values
- deps: proxy-addr@~2.0.7
  - Use req.socket over deprecated req.connection
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - pref: ignore empty http tokens
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]

from express GitHub release notes

Package name: express-rate-limit

6.11.2 - 2023-09-12
Fixed
- Restored IncrementResponse TypeScript type (See #397)
6.11.1 - 2023-09-10
Fixed
- Check for prefixed keys when validating that the stores have single counted keys (See #395).
6.11.0 - 2023-09-06
Added
- Support for retrieving the current hit count and reset time for a given key from a store (See #390).
6.10.0 - 2023-08-30
Added
- Support for combined RateLimit header from the RateLimit header fields for HTTP standardization draft adopted by the IETF. Enable by setting standardHeaders: 'draft-7'
- New standardHeaders: 'draft-6' option, treated equivalent to standardHeaders: true from previous releases. (true and false are still supported.)
- New RateLimit-Policy header added when standardHeaders is set to 'draft-6', 'draft-7', or true
- Warning when using deprecated draft_polli_ratelimit_headers option
- Warning when using deprecated onLimitReached option
- Warning when totalHits value returned from Store is invalid
6.9.0 - 2023-08-06
Added
- New validaion check for double-counted requests
- Added help link to each ValidationError, directing users to the appropriate wiki page for more info
Changed
- Miscaleanous documenation improvements
You can view the full changelog here.
6.8.1 - 2023-07-27
Changed
- Revert 6.7.1 change that bumped typescript from 5.x to 4.x and dts-bundle-generator from 8.x to 7.x (See #360)
You can view the full changelog here.
6.8.0 - 2023-07-21
Added
- Added a set of validation checks that will log an error if failed. See
  https://github.com/express-rate-limit/express-rate-limit/wiki/Error-Codes for
  a list of potential errors. Can be disabled by setting validate: false in
  the configuration. Automatically disables after the first request. (See
  #358)
You can view the changelog here.
6.7.2 - 2023-07-27
(Backport of v6.8.1)

You can view the full changelog here.
6.7.1 - 2023-07-06
Fixed
- Fixed compatibility with TypeScript's TypeScript new node16 module
  resolution strategy (See
  #355)
Changed
- Bumped development dependencies.
- Added node 20 to list of versions the CI jobs run on.
No functional changes.

You can view the changelog here.
6.7.0 - 2022-11-15

No functional changes.

Changed
- Updated links to point to the new express-rate-limit organization on GitHub.
- Added advertisement to readme.md for project sponsor Zuplo.
- Updated to typescript version 5 and bumped other dependencies.
- Dropped node 12, and added node 19 to the list of versions the CI jobs run on.
You can view the changelog here.
6.6.0 - 2022-09-04
6.5.2 - 2022-08-24
6.5.1 - 2022-07-23
6.4.0 - 2022-04-24
6.3.0 - 2022-02-19
6.2.1 - 2022-02-10
6.2.0 - 2022-01-22

from express-rate-limit GitHub release notes

Package name: express-session

1.18.0 - 2024-01-28
- Add debug log for pathname mismatch
- Add partitioned to cookie options
- Add priority to cookie options
- Fix handling errors from setting cookie
- Support any type in secret that crypto.createHmac supports
- deps: [email protected]
  - Fix expires option to reject invalid dates
  - perf: improve default decode speed
  - perf: remove slow string split in parse
- deps: [email protected]
1.17.3 - 2022-05-11
- Fix resaving already-saved new session at end of request
- deps: [email protected]
1.17.2 - 2021-05-19
- Fix res.end patch to always commit headers
- deps: [email protected]
- deps: [email protected]

from express-session GitHub release notes

Package name: mongoose

6.13.0 - 2024-06-06
6.12.9 - 2024-05-24
6.12.8 - 2024-04-10
6.12.7 - 2024-03-01
6.12.6 - 2024-01-22
6.12.5 - 2024-01-03
6.12.4 - 2023-12-27
6.12.3 - 2023-11-07
6.12.2 - 2023-10-25
6.12.1 - 2023-10-12
6.12.0 - 2023-08-24
6.11.6 - 2023-08-21
6.11.5 - 2023-08-01
6.11.4 - 2023-07-17
6.11.3 - 2023-07-11
6.11.2 - 2023-06-08
6.11.1 - 2023-05-08
6.11.0 - 2023-05-01
6.10.5 - 2023-04-06
6.10.4 - 2023-03-21
6.10.3 - 2023-03-13
6.10.2 - 2023-03-07
6.10.1 - 2023-03-03
6.10.0 - 2023-02-22
6.9.3 - 2023-02-22
6.9.2 - 2023-02-16
6.9.1 - 2023-02-06
6.9.0 - 2023-01-25
6.8.4 - 2023-01-17
6.8.3 - 2023-01-06
6.8.2 - 2022-12-28
6.8.1 - 2022-12-19
6.8.0 - 2022-12-05
6.7.5 - 2022-11-30
6.7.4 - 2022-11-28
6.7.3 - 2022-11-22
6.7.2 - 2022-11-07
6.7.1 - 2022-11-02
6.7.0 - 2022-10-24
6.6.7 - 2022-10-21
6.6.6 - 2022-10-20
6.6.5

Snyk has created this PR to upgrade: - bcrypt from 5.0.1 to 5.1.1. See this package in npm: https://www.npmjs.com/package/bcrypt - body-parser from 1.19.1 to 1.20.2. See this package in npm: https://www.npmjs.com/package/body-parser - dotenv from 16.0.0 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - ejs from 3.1.6 to 3.1.10. See this package in npm: https://www.npmjs.com/package/ejs - express from 4.17.2 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - express-rate-limit from 6.2.0 to 6.11.2. See this package in npm: https://www.npmjs.com/package/express-rate-limit - express-session from 1.17.2 to 1.18.0. See this package in npm: https://www.npmjs.com/package/express-session - mongoose from 6.1.9 to 6.13.0. See this package in npm: https://www.npmjs.com/package/mongoose - passport from 0.5.2 to 0.7.0. See this package in npm: https://www.npmjs.com/package/passport - passport-local-mongoose from 6.1.0 to 6.3.0. See this package in npm: https://www.npmjs.com/package/passport-local-mongoose See this project in Snyk: https://app.snyk.io/org/nataliaermeryd/project/b5ac9290-b985-4c57-978b-29e2ec8d38a1?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Upgrade: bcrypt, body-parser, dotenv, ejs, express, express-rate-limit, express-session, mongoose, passport, passport-local-mongoose #353

[Snyk] Upgrade: bcrypt, body-parser, dotenv, ejs, express, express-rate-limit, express-session, mongoose, passport, passport-local-mongoose #353

Uh oh!

natalieermeryd commented Sep 21, 2024

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Fixed

Fixed

Added

Added

Added

Changed

Changed

Added

Fixed

Changed

Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

[Snyk] Upgrade: bcrypt, body-parser, dotenv, ejs, express, express-rate-limit, express-session, mongoose, passport, passport-local-mongoose #353

Are you sure you want to change the base?

[Snyk] Upgrade: bcrypt, body-parser, dotenv, ejs, express, express-rate-limit, express-session, mongoose, passport, passport-local-mongoose #353

Uh oh!

Conversation

natalieermeryd commented Sep 21, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Fixed

Fixed

Added

Added

Added

Changed

Changed

Added

Fixed

Changed

Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants