[Snyk] Fix for 4 vulnerabilities

[danielmocan]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	589/1000 Why? Has a fix available, CVSS 7.5	Directory Traversal SNYK-JS-MOMENT-2440688	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:bson:20180225	Yes	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:moment:20170905	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: express-jwt

The new version differs by 2 commits.

• 5766a24 Merge pull request #186 from auth0/jwt_update
• 11f3ac4 Update jsonwebtoken dependency to 8.1.0

See the full diff

Package name: jsonwebtoken

The new version differs by 28 commits.

• f313850 8.0.0
• f38bd8e updated changelog
• 2ec3263 Merge pull request #393 from ziluvatar/migration-notes-to-readme
• 12cd8f7 docs: readme, migration notes
• cfc04a9 Merge pull request #349 from ziluvatar/fix-max-age-number-and-seconds
• 3305cf0 verify: remove process.nextTick (#302)
• 0be5409 Reduce size of NPM package (#347)
• 2e7e68d Remove joi to shrink module size (#348)
• 66a4f8b maxAge: Add validation to timespan result
• e54e53c update changelog
• fb48dde 7.4.3
• 2e4e30b Merge pull request #386 from ziluvatar/issue_381
• 2a3404f add test & modify guard code
• 91ba14d Fixed alg non + secret set unit test
• b1ff632 Fix for #381. Set secret string before using jws when alg is none
• e56f904 update changelog
• 480bb9b 7.4.2
• c6a7026 Merge pull request #374 from ziluvatar/add-check-for-empty-secrets
• c584d1c sign: add check to be sure secret has a value
• 43739dc Merge pull request #371 from ziluvatar/docs-about-refreshing-tokens
• 016fc10 docs: about refreshing tokens
• 5f44a86 Merge pull request #365 from ziluvatar/information-regarding-base64-secrets
• c25e990 docs: verifying with base64 encoded secrets
• 2f36063 Merge pull request #360 from ziluvatar/add-ecdsa-tests

See the full diff

Package name: mongodb

The new version differs by 250 commits.

• 79da11f 3.1.3
• 337cb79 feat(core): update to mongodb-core 3.1.2
• ff5fafc refactor(topology-base): `getServer` => `selectServer`
• b33fc74 3.1.2
• 78f6977 fix(mongo_client): translate options for connectWithUrl
• 36e92f1 fix(db_ops): call collection.find() with correct parameters (#1795)
• 759dd85 fix(buffer): replace deprecated Buffer constructor
• cb9d915 docs(connect): remove references to MongoClient.connect
• b8d2f1d fix(teardown): properly destroy a topology when initial connect fails
• 64027e8 refactor(export): expose CommandCursor
• 6ef85c4 refactor(export): expose AggregationCursor
• 13d776f fix(cursor): set readPreference for cursor.count
• a5d0f1d feat(deprecation): wrap deprecated functions
• 4f907a0 feat(deprecation): create deprecation function
• 666b8fa refactor(bulk): Unify bulk operations
• a0d84f6 test(evergreen): adding evergreen config to native driver
• b8471f1 fix(collection): isCapped returns false instead of undefined
• 86344f4 fix(collection): ensure findAndModify always use readPreference primary
• c25c519 test(countDocuments): full test coverage for countDocuments
• 25ca557 docs(contributing): fix link to HISTORY.md
• 4395110 chore(MongoClient): add missing legacy option name on warning message
• 297d843 docs(sessions): updating docs for sessions
• 15dc808 fix(db_ops): fix two incorrectly named variables
• fca1185 fix(count-documents): return callback on error case

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Directory Traversal