[Snyk] Upgrade: body-parser, dotenv, ejs, express, mongoose #307

Gabo-Tech · 2024-09-19T08:44:40Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Name	Versions	Released on

body-parser
from 1.18.3 to 1.20.2 | 6 versions ahead of your current version | 2 years ago
on 2023-02-22
dotenv
from 16.0.1 to 16.4.5 | 19 versions ahead of your current version | 7 months ago
on 2024-02-20
ejs
from 3.1.8 to 3.1.10 | 2 versions ahead of your current version | 5 months ago
on 2024-04-12
express
from 4.16.3 to 4.19.2 | 12 versions ahead of your current version | 6 months ago
on 2024-03-25
mongoose
from 5.13.14 to 8.6.0 | 205 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 22 days ago
on 2024-08-28

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Prototype Pollution SNYK-JS-MONGOOSE-2961688	479	Proof of Concept
Prototype Pollution SNYK-JS-MONGOOSE-5777721	479	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	479	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	479	Proof of Concept
Improper Control of Dynamically-Managed Code Resources SNYK-JS-EJS-6689533	479	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	479	No Known Exploit

Release notes

Package name: body-parser

1.20.2 - 2023-02-22
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
  - perf: skip value escaping when unnecessary
- deps: [email protected]
1.20.1 - 2022-10-06
- deps: [email protected]
- perf: remove unnecessary object clone
1.20.0 - 2022-04-03
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: [email protected]
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
1.19.2 - 2022-02-16
- deps: [email protected]
- deps: [email protected]
  - Fix handling of __proto__ keys
- deps: [email protected]
  - deps: [email protected]
1.19.1 - 2021-12-10
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: type-is@~1.6.18
1.19.0 - 2019-04-26
- deps: [email protected]
  - Add petabyte (pb) support
- deps: [email protected]
  - Set constructor name when possible
  - deps: [email protected]
  - deps: statuses@'>= 1.5.0 < 2'
- deps: [email protected]
  - Added encoding MIK
- deps: [email protected]
  - Fix parsing array brackets after index
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: type-is@~1.6.17
  - deps: mime-types@~2.1.24
  - perf: prevent internal throw on invalid type
1.18.3 - 2018-05-14
- Fix stack trace for strict json parse error
- deps: depd@~1.1.2
  - perf: remove argument reassignment
- deps: http-errors@~1.6.3
  - deps: depd@~1.1.2
  - deps: [email protected]
  - deps: statuses@'>= 1.3.1 < 2'
- deps: [email protected]
  - Fix loading encoding with year appended
  - Fix deprecation warnings on Node.js 10+
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: type-is@~1.6.16
  - deps: mime-types@~2.1.18

from body-parser GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: ejs

3.1.10 - 2024-04-12
Version 3.1.10
3.1.9 - 2023-03-12
Version 3.1.9
3.1.8 - 2022-05-11
Version 3.1.8

from ejs GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: [email protected]
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: [email protected]
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: [email protected] and [email protected] by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add [email protected] by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: [email protected]
  - deps: [email protected]
  - perf: remove unnecessary object clone
- deps: [email protected]
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: [email protected]
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: [email protected]
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: [email protected]
  - Remove set content headers that break response
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Prevent loss of async hooks context
- deps: [email protected]
- deps: [email protected]
  - Fix emitted 416 error missing headers property
  - Limit the headers removed for 304 response
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Remove code 306
  - Rename 425 Unordered Collection to standard 425 Too Early
4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
  - deps: mime-types@~2.1.34
  - deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - Fix handling of __proto__ keys
- pref: remove unnecessary regexp for trust proxy
4.17.2 - 2021-12-17
- Fix handling of undefined in res.jsonp
- Fix handling of undefined when "json escape" is enabled
- Fix incorrect middleware execution with unanchored RegExps
- Fix res.jsonp(obj, status) deprecation message
- Fix typo in res.is JSDoc
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.18
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Fix maxAge option to reject invalid values
- deps: proxy-addr@~2.0.7
  - Use req.socket over deprecated req.connection
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - pref: ignore empty http tokens
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
4.17.1 - 2019-05-26
4.17.0 - 2019-05-17
4.16.4 - 2018-10-11
4.16.3 - 2018-03-12

from express GitHub release notes

Package name: mongoose

8.6.0 - 2024-08-28
8.6.0 / 2024-08-28
- feat: upgrade mongodb -> 6.8.0, handle throwing error on closed cursor in Mongoose with MongooseError instead of MongoCursorExhaustedError #14813
- feat(model+query): support options parameter for distinct() #14772 #8006
- feat(QueryCursor): add getDriverCursor() function that returns the raw driver cursor #14745
- types: change query selector to disallow unknown top-level keys by default #14764 alex-statsig
- types: make toObject() and toJSON() not generic by default to avoid type widening #14819 #12883
- types: avoid automatically inferring lean result type when assigning to explicitly typed variable #14734
8.5.5 - 2024-08-28
8.5.5 / 2024-08-28
- fix(populate): fix a couple of other places where Mongoose gets the document's _id with getters #14833 #14827 #14759
- fix(discriminator): shallow clone Schema.prototype.obj before merging schemas to avoid modifying original obj #14821
- types: fix schema type based on timestamps schema options value #14829 #14825 ark23CIS
8.5.4 - 2024-08-23
8.5.4 / 2024-08-23
- fix: add empty string check for collection name passed #14806 Shubham2552
- docs(model): add 'throw' as valid strict value for bulkWrite() and add some more clarification on throwOnValidationError #14809
8.5.3 - 2024-08-13
8.5.3 / 2024-08-13
- fix(document): call required functions on subdocuments underneath nested paths with correct context #14801 #14788
- fix(populate): avoid throwing error when no result and lean() set #14799 #14794 #14759 MohOraby
- fix(document): apply virtuals to subdocuments if parent schema has virtuals: true for backwards compatibility #14774 #14771 #14623 #14394
- types: make HydratedSingleSubdocument and HydratedArraySubdocument merge types instead of using & #14800 #14793
- types: support schema type inference based on schema options timestamps as well #14773 #13215 ark23CIS
- types(cursor): indicate that cursor.next() can return null #14798 #14787
- types: allow mongoose.connection.db to be undefined #14797 #14789
- docs: add schema type widening advice #14790 JstnMcBrd
8.5.2 - 2024-07-30
8.5.1 - 2024-07-12
8.5.0 - 2024-07-08
8.4.5 - 2024-07-05
8.4.4 - 2024-06-25
8.4.3 - 2024-06-17
8.4.2 - 2024-06-17
8.4.1 - 2024-05-31
8.4.0 - 2024-05-17
8.3.5 - 2024-05-15
8.3.4 - 2024-05-06
8.3.3 - 2024-04-29
8.3.2 - 2024-04-16
8.3.1 - 2024-04-08
8.3.0 - 2024-04-03
8.2.4 - 2024-03-28
8.2.3 - 2024-03-21
8.2.2 - 2024-03-15
8.2.1 - 2024-03-04
8.2.0 - 2024-02-22
8.1.3 - 2024-02-16
8.1.2 - 2024-02-11
8.1.1 - 2024-01-24
8.1.0 - 2024-01-16
8.0.4 - 2024-01-09
8.0.3 - 2023-12-07
8.0.2 - 2023-11-28
8.0.1 - 2023-11-15
8.0.0 - 2023-10-31
8.0.0-rc0 - 2023-10-24
7.8.1 - 2024-08-19
chore: release 7.8.1
7.8.0 - 2024-07-23
7.7.0 - 2024-06-18
7.6.13 - 2024-06-05
7.6.12 - 2024-05-21
7.6.11 - 2024-04-11
7.6.10 - 2024-03-13
7.6.9 - 2024-02-26
7.6.8 - 2024-01-08
7.6.7 - 2023-12-06
7.6.6 - 2023-11-27
7.6.5 - 2023-11-14
7.6.4 - 2023-10-30
7.6.3 - 2023-10-17
7.6.2 - 2023-10-13
7.6.1 - 2023-10-09
7.6.0 - 2023-10-06
7.5.4 - 2023-10-04
7.5.3 - 2023-09-25
7.5.2 - 2023-09-15
7.5.1 - 2023-09-11
7.5.0 - 2023-08-29
7.4.5 - 2023-08-25
7.4.4 - 2023-08-22
7.4.3 - 2023-08-11
7.4.2 - 2023-08-03
7.4.1 - 2023-07-24
7.4.0 - 2023-07-18
7.3.4 - 2023-07-12
7.3.3 - 2023-07-11
7.3.2 - 2023-07-06
7.3.1 - 2023-06-21
7.3.0 - 2023-06-14
7.2.4 - 2023-06-12
7.2.3 - 2023-06-09
7.2.2 - 2023-05-30
7.2.1 - 2023-05-24
7.2.0 - 2023-05-19
7.1.2 - 2023-05-19
7.1.1 - 2023-05-10
7.1.0 - 2023-04-27
7.0.5 - 2023-04-24
7.0.4 - 2023-04-17
7.0.3 - 2023-03-23
7.0.2 - 2023-03-15
7.0.1 - 2023-03-06
7.0.0 - 2023-02-27
7.0.0-rc0 - 2023-02-23
6.13.2 - 2024-09-12
chore: release 6.13.2
6.13.1 - 2024-09-06
try fixing deno test
6.13.0 - 2024-06-06
6.12.9 - 2024-05-24
6.12.8 - 2024-04-10
6.12.7 - 2024-03-01
6.12.6 - 2024-01-22
6.12.5 - 2024-01-03
6.12.4 - 2023-12-27
6.12.3 - 2023-11-07
6.12.2 - 2023-10-25
6.12.1 - 2023-10-12
6.12.0 - 2023-08-24
6.11.6 - 2023-08-21
6.11.5 - 2023-08-01
6.11.4 - 2023-07-17
6.11.3 - 2023-07-11
6.11.2 - 2023-06-08
6.11.1 - 2023-05-08
6.11.0 - 2023-05-01
6.10.5 - 2023-04-06
6.10.4 - 2023-03-21
6.10.3 - 2023-03-13
6.10.2 - 2023-03-07
6.10.1 - 2023-03-03
6.10.0 - 2023-02-22
6.9.3 - 2023-02-22
6.9.2 - 2023-02-16
6.9.1 - 2023-02-06
6.9.0 - 2023-01-25
6.8.4 - 2023-01-17
6.8.3 - 2023-01-06
6.8.2 - 2022-12-28
6.8.1 - 2022-12-19
6.8.0 - 2022-12-05
6.7.5 - 2022-11-30
6.7.4 - 2022-11-28
6.7.3 - 2022-11-22
6.7.2 - 2022-11-07
6.7.1 - 2022-11-02
6.7.0 - 2022-10-24
6.6.7 - 2022-10-21
6.6.6 - 2022-10-20
6.6.5 - 2022-10-05
6.6.4 - 2022-10-03
6.6.3 - 2022-09-30
6.6.2 - 2022-09-26
6.6.1 - 2022-09-14
6.6.0 - 2022-09-08
6.5.5 - 2022-09-07
6.5.4 - 2022-08-30
6.5.3 - 2022-08-25
6.5.2 - 2022-08-10
6.5.1 - 2022-08-03
6.5.0 - 2022-07-26
6.4.7 - 2022-07-25
6.4.6 - 2022-07-20
6.4.5 - 2022-07-18
6.4.4 - 2022-07-08
6.4.3 - 2022-07-05
6.4.2 - 2022-07-01
6.4.1 - 2022-06-27
6.4.0 - 2022-06-17
6.3.9 - 2022-06-17
6.3.8 - 2022-06-13
6.3.7 - 2022-06-13
6.3.6 - 2022-06-07
6.3.5 - 2022-05-30
6.3.4 - 2022-05-19
6.3.3 - 2022-05-09
6.3.2 - 2022-05-02
6.3.1 - 2022-04-21
6.3.0 - 2022-04-14
6.2.11 - 2022-04-13
6.2.10 - 2022-04-04
6.2.9 - 2022-03-28
6.2.8 - 2022-03-23
6.2.7 - 2022-03-16
6.2.6 - 2022-03-11
6.2.5 - 2022-03-09
6.2.4 - 2022-02-28
6.2.3 - 2022-02-21
6.2.2 - 2022-02-16
6.2.1 - 2022-02-07
6.2.0 - 2022-02-02
6.1.10 - 2022-02-01
6.1.9 - 2022-01-31
6.1.8 - 2022-01-24
6.1.7 - 2022-01-17
6.1.6 - 2022-01-10
6.1.5 - 2022-01-04
6.1.4 - 2021-12-27
6.1.3 - 2021-12-21
6.1.2 - 2021-12-15
6.1.1 - 2021-12-09
6.1.0 - 2021-12-07
6.0.15 - 2021-12-06
6.0.14 - 2021-11-29
6.0.13 - 2021-11-15
6.0.12 - 2021-10-21
6.0.11 - 2021-10-14
6.0.10 - 2021-10-08
6.0.9 - 2021-10-04
6.0.8 - 2021-09-27
6.0.7 - 2021-09-20
6.0.6 - 2021-09-15
6.0.5 - 2021-09-06
6.0.4 - 2021-09-01
6.0.3 - 2021-08-30
6.0.2 - 2021-08-26
6.0.1 - 2021-08-25
6.0.0 - 2021-08-24
6.0.0-rc2 - 2021-08-23
6.0.0-rc1 - 2021-08-12
6.0.0-rc0 - 2021-08-03
5.13.22 - 2024-01-02
5.13.21 - 2023-10-19
5.13.20 - 2023-07-12
5.13.19 - 2023-06-22
5.13.18 - 2023-06-22
5.13.17 - 2023-04-04
5.13.16 - 2023-02-20

Snyk has created this PR to upgrade: - body-parser from 1.18.3 to 1.20.2. See this package in npm: https://www.npmjs.com/package/body-parser - dotenv from 16.0.1 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - ejs from 3.1.8 to 3.1.10. See this package in npm: https://www.npmjs.com/package/ejs - express from 4.16.3 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - mongoose from 5.13.14 to 8.6.0. See this package in npm: https://www.npmjs.com/package/mongoose See this project in Snyk: https://app.snyk.io/org/gabriel19971029/project/5f768f32-8289-42b4-9352-03cb8bdca27b?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: body-parser, dotenv, ejs, express, mongoose #307

[Snyk] Upgrade: body-parser, dotenv, ejs, express, mongoose #307

Gabo-Tech commented Sep 19, 2024

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

8.6.0 / 2024-08-28

8.5.5 / 2024-08-28

8.5.4 / 2024-08-23

8.5.3 / 2024-08-13

[Snyk] Upgrade: body-parser, dotenv, ejs, express, mongoose #307

Are you sure you want to change the base?

[Snyk] Upgrade: body-parser, dotenv, ejs, express, mongoose #307

Conversation

Gabo-Tech commented Sep 19, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

8.6.0 / 2024-08-28

8.5.5 / 2024-08-28

8.5.4 / 2024-08-23

8.5.3 / 2024-08-13