Skip to content

[Snyk] Upgrade: bcrypt, body-parser, dotenv, express, express-session, moment, mongodb, mongoose, multer, passport, pug #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Upgrade: bcrypt, body-parser, dotenv, express, express-session, moment, mongodb, mongoose, multer, passport, pug #24

wants to merge 1 commit into from

Conversation

@LeeSangMin1029
Copy link
Owner

@LeeSangMin1029 LeeSangMin1029 commented Sep 20, 2024

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

bcrypt
from 5.0.0 to 5.1.1 | 3 versions ahead of your current version | a year ago
on 2023-08-16
body-parser
from 1.19.0 to 1.20.2 | 5 versions ahead of your current version | 2 years ago
on 2023-02-22
dotenv
from 8.2.0 to 8.6.0 | 5 versions ahead of your current version | 3 years ago
on 2021-05-05
express
from 4.17.1 to 4.19.2 | 9 versions ahead of your current version | 6 months ago
on 2024-03-25
express-session
from 1.17.1 to 1.18.0 | 3 versions ahead of your current version | 8 months ago
on 2024-01-28
moment
from 2.27.0 to 2.30.1 | 8 versions ahead of your current version | 9 months ago
on 2023-12-27
mongodb
from 3.5.9 to 3.7.4 | 21 versions ahead of your current version | a year ago
on 2023-06-21
mongoose
from 5.9.20 to 5.13.22 | 89 versions ahead of your current version | 9 months ago
on 2024-01-02
multer
from 1.4.2 to 1.4.4 | 3 versions ahead of your current version | 3 years ago
on 2021-12-07
passport
from 0.4.1 to 0.7.0 | 6 versions ahead of your current version | 10 months ago
on 2023-11-27
pug
from 3.0.0 to 3.0.3 | 6 versions ahead of your current version | 4 months ago
on 2024-05-24

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Prototype Pollution
SNYK-JS-MQUERY-1050858		 686 Proof of Concept
high severity Prototype Pollution
SNYK-JS-MQUERY-1089718		 686 Proof of Concept
high severity Remote Code Execution (RCE)
SNYK-JS-PUG-1071616		 686 Proof of Concept
high severity Remote Code Execution (RCE)
SNYK-JS-PUGCODEGEN-1082232		 686 Proof of Concept
high severity Improper Control of Generation of Code ('Code Injection')
SNYK-JS-PUGCODEGEN-7086056		 686 Proof of Concept
high severity Prototype Poisoning
SNYK-JS-QS-3153490		 686 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 686 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 686 Proof of Concept
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 686 No Known Exploit
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 686 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579147		 686 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579152		 686 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579155		 686 No Known Exploit
high severity Directory Traversal
SNYK-JS-MOMENT-2440688		 686 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOMENT-2944238		 686 Proof of Concept
high severity Prototype Pollution
SNYK-JS-MONGOOSE-2961688		 686 Proof of Concept
high severity Prototype Pollution
SNYK-JS-MONGOOSE-5777721		 686 Proof of Concept
high severity Remote Memory Exposure
SNYK-JS-BL-608877		 686 Proof of Concept
high severity Prototype Pollution
SNYK-JS-INI-1048974		 686 Proof of Concept
medium severity Session Fixation
SNYK-JS-PASSPORT-2840631		 686 No Known Exploit
medium severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JS-TAR-6476909		 686 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-MONGOOSE-1086688		 686 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-MPATH-1577289		 686 Proof of Concept
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509		 686 No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 686 No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 686 Proof of Concept
Release notes
Package name: bcrypt from bcrypt GitHub release notes
Package name: body-parser from body-parser GitHub release notes
Package name: dotenv from dotenv GitHub release notes
Package name: express from express GitHub release notes
Package name: express-session
  • 1.18.0 - 2024-01-28
    • Add debug log for pathname mismatch
    • Add partitioned to cookie options
    • Add priority to cookie options
    • Fix handling errors from setting cookie
    • Support any type in secret that crypto.createHmac supports
    • deps: [email protected]
      • Fix expires option to reject invalid dates
      • perf: improve default decode speed
      • perf: remove slow string split in parse
    • deps: [email protected]
  • 1.17.3 - 2022-05-11
  • 1.17.2 - 2021-05-19
  • 1.17.1 - 2020-04-17
    • Fix internal method wrapping error on failed reloads
from express-session GitHub release notes
Package name: moment from moment GitHub release notes
Package name: mongodb
  • 3.7.4 - 2023-06-21

    The MongoDB Node.js team is pleased to announce version 3.7.4 of the mongodb package!

    Release Highlights

    This release fixes a bug that throws a type error when SCRAM-SHA-256 is used with saslprep in a webpacked environment.

    3.7.4 (2023-06-21)

    Bug Fixes

    Documentation

    We invite you to try the mongodb library immediately, and report any issues to the NODE project.

  • 3.7.3 - 2021-10-20
  • 3.7.2 - 2021-10-05
  • 3.7.1 - 2021-09-14
  • 3.7.0 - 2021-08-31
  • 3.6.12 - 2021-08-30
  • 3.6.11 - 2021-08-05
  • 3.6.10 - 2021-07-06
  • 3.6.9 - 2021-05-26
  • 3.6.8 - 2021-05-21
  • 3.6.7 - 2021-05-18
  • 3.6.6 - 2021-04-06
  • 3.6.5 - 2021-03-16
  • 3.6.4 - 2021-02-02
  • 3.6.3 - 2020-11-06
  • 3.6.2 - 2020-09-10
  • 3.6.1 - 2020-09-02
  • 3.6.0 - 2020-07-30
  • 3.6.0-beta.0 - 2020-04-14
  • 3.5.11 - 2020-09-10
  • 3.5.10 - 2020-07-30
  • 3.5.9 - 2020-06-12
from mongodb GitHub release notes
Package name: mongoose
  • 5.13.22 - 2024-01-02
  • 5.13.21 - 2023-10-19
  • 5.13.20 - 2023-07-12
  • 5.13.19 - 2023-06-22
  • 5.13.18 - 2023-06-22
  • 5.13.17 - 2023-04-04
  • 5.13.16 - 2023-02-20
  • 5.13.15 - 2022-08-22
  • 5.13.14 - 2021-1...

@snyk-bot
fix: upgrade multiple dependencies with Snyk
31660e1 
Snyk has created this PR to upgrade:
  - bcrypt from 5.0.0 to 5.1.1.
    See this package in npm: https://www.npmjs.com/package/bcrypt
  - body-parser from 1.19.0 to 1.20.2.
    See this package in npm: https://www.npmjs.com/package/body-parser
  - dotenv from 8.2.0 to 8.6.0.
    See this package in npm: https://www.npmjs.com/package/dotenv
  - express from 4.17.1 to 4.19.2.
    See this package in npm: https://www.npmjs.com/package/express
  - express-session from 1.17.1 to 1.18.0.
    See this package in npm: https://www.npmjs.com/package/express-session
  - moment from 2.27.0 to 2.30.1.
    See this package in npm: https://www.npmjs.com/package/moment
  - mongodb from 3.5.9 to 3.7.4.
    See this package in npm: https://www.npmjs.com/package/mongodb
  - mongoose from 5.9.20 to 5.13.22.
    See this package in npm: https://www.npmjs.com/package/mongoose
  - multer from 1.4.2 to 1.4.4.
    See this package in npm: https://www.npmjs.com/package/multer
  - passport from 0.4.1 to 0.7.0.
    See this package in npm: https://www.npmjs.com/package/passport
  - pug from 3.0.0 to 3.0.3.
    See this package in npm: https://www.npmjs.com/package/pug

See this project in Snyk:
https://app.snyk.io/org/leesangmin1029/project/4e14e974-db74-4ad9-9d57-403ba1bf7ddc?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@LeeSangMin1029 @snyk-bot