[Snyk] Upgrade: body-parser, debug, express, http-server, jstransformer-markdown-it, pug by ali8889 · Pull Request #48 · ali8889/ethereum-org

ali8889 · 2024-09-13T03:32:20Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

body-parser
from 1.18.3 to 1.20.2 | 6 versions ahead of your current version | 2 years ago
on 2023-02-22
debug
from 3.1.0 to 3.2.7 | 8 versions ahead of your current version | 4 years ago
on 2020-11-19
express
from 4.16.3 to 4.19.2 | 12 versions ahead of your current version | 6 months ago
on 2024-03-25
http-server
from 0.11.1 to 0.13.0 | 6 versions ahead of your current version | 3 years ago
on 2021-08-07
jstransformer-markdown-it
from 2.0.0 to 2.1.0 | 1 version ahead of your current version | 6 years ago
on 2018-04-23
pug
from 2.0.0-rc.4 to 2.0.4 | 5 versions ahead of your current version | 5 years ago
on 2019-06-18

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Denial of Service (DoS) SNYK-JS-ECSTATIC-540354	484	Proof of Concept
Improper Input Validation SNYK-JS-FOLLOWREDIRECTS-6141137	484	Proof of Concept
Remote Code Execution (RCE) SNYK-JS-PUGCODEGEN-1082232	484	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	484	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	484	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	484	Proof of Concept
Prototype Override Protection Bypass npm:qs:20170213	484	No Known Exploit
Open Redirect SNYK-JS-ECSTATIC-174543	484	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	484	No Known Exploit
Information Exposure SNYK-JS-FOLLOWREDIRECTS-2332181	484	Proof of Concept
Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	484	Proof of Concept
Denial of Service (DoS) SNYK-JS-HTTPPROXY-569139	484	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-559764	484	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-559764	484	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-559764	484	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	484	Proof of Concept
Information Exposure SNYK-JS-FOLLOWREDIRECTS-2396346	484	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	484	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-2429795	484	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-2429795	484	Proof of Concept
Regular Expression Denial of Service (ReDoS) npm:clean-css:20180306	484	Proof of Concept
Sandbox Bypass npm:constantinople:20180421	484	No Known Exploit

Release notes

Package name: body-parser

1.20.2 - 2023-02-22
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
  - perf: skip value escaping when unnecessary
- deps: raw-body@2.5.2
1.20.1 - 2022-10-06
- deps: qs@6.11.0
- perf: remove unnecessary object clone
1.20.0 - 2022-04-03
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: http-errors@2.0.0
  - deps: depd@2.0.0
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
- deps: qs@6.10.3
- deps: raw-body@2.5.1
  - deps: http-errors@2.0.0
1.19.2 - 2022-02-16
- deps: bytes@3.1.2
- deps: qs@6.9.7
  - Fix handling of __proto__ keys
- deps: raw-body@2.4.3
  - deps: bytes@3.1.2
1.19.1 - 2021-12-10
- deps: bytes@3.1.1
- deps: http-errors@1.8.1
  - deps: inherits@2.0.4
  - deps: toidentifier@1.0.1
  - deps: setprototypeof@1.2.0
- deps: qs@6.9.6
- deps: raw-body@2.4.2
  - deps: bytes@3.1.1
  - deps: http-errors@1.8.1
- deps: safe-buffer@5.2.1
- deps: type-is@~1.6.18
1.19.0 - 2019-04-26
- deps: bytes@3.1.0
  - Add petabyte (pb) support
- deps: http-errors@1.7.2
  - Set constructor name when possible
  - deps: setprototypeof@1.1.1
  - deps: statuses@'>= 1.5.0 < 2'
- deps: iconv-lite@0.4.24
  - Added encoding MIK
- deps: qs@6.7.0
  - Fix parsing array brackets after index
- deps: raw-body@2.4.0
  - deps: bytes@3.1.0
  - deps: http-errors@1.7.2
  - deps: iconv-lite@0.4.24
- deps: type-is@~1.6.17
  - deps: mime-types@~2.1.24
  - perf: prevent internal throw on invalid type
1.18.3 - 2018-05-14
- Fix stack trace for strict json parse error
- deps: depd@~1.1.2
  - perf: remove argument reassignment
- deps: http-errors@~1.6.3
  - deps: depd@~1.1.2
  - deps: setprototypeof@1.1.0
  - deps: statuses@'>= 1.3.1 < 2'
- deps: iconv-lite@0.4.23
  - Fix loading encoding with year appended
  - Fix deprecation warnings on Node.js 10+
- deps: qs@6.5.2
- deps: raw-body@2.3.3
  - deps: http-errors@1.6.3
  - deps: iconv-lite@0.4.23
- deps: type-is@~1.6.16
  - deps: mime-types@~2.1.18

from body-parser GitHub release notes

Package name: debug

3.2.7 - 2020-11-19
3.2.7
3.2.6 - 2018-10-10
3.2.5 - 2018-09-11
3.2.4 - 2018-09-11
3.2.3 - 2018-09-11
3.2.2 - 2018-09-11
3.2.1 - 2018-09-11
3.2.0 - 2018-09-11
3.1.0 - 2017-09-26

from debug GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: body-parser@1.20.2
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: raw-body@2.5.2
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: Node.js@16.18 and Node.js@18.12 by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add Node.js@19.7 by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: body-parser@1.20.1
  - deps: qs@6.11.0
  - perf: remove unnecessary object clone
- deps: qs@6.11.0
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: body-parser@1.20.0
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: depd@2.0.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: qs@6.10.3
  - deps: raw-body@2.5.1
- deps: cookie@0.5.0
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: finalhandler@1.2.0
  - Remove set content headers that break response
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
  - Prevent loss of async hooks context
- deps: qs@6.10.3
- deps: send@0.18.0
  - Fix emitted 416 error missing headers property
  - Limit the headers removed for 304 response
  - deps: depd@2.0.0
  - deps: destroy@1.2.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: serve-static@1.15.0
  - deps: send@0.18.0
- deps: statuses@2.0.1
  - Remove code 306
  - Rename 425 Unordered Collection to standard 425 Too Early
4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
  - deps: mime-types@~2.1.34
  - deps: negotiator@0.6.3
- deps: body-parser@1.19.2
  - deps: bytes@3.1.2
  - deps: qs@6.9.7
  - deps: raw-body@2.4.3
- deps: cookie@0.4.2
- deps: qs@6.9.7
  - Fix handling of __proto__ keys
- pref: remove unnecessary regexp for trust proxy
4.17.2 - 2021-12-17
- Fix handling of undefined in res.jsonp
- Fix handling of undefined when "json escape" is enabled
- Fix incorrect middleware execution with unanchored RegExps
- Fix res.jsonp(obj, status) deprecation message
- Fix typo in res.is JSDoc
- deps: body-parser@1.19.1
  - deps: bytes@3.1.1
  - deps: http-errors@1.8.1
  - deps: qs@6.9.6
  - deps: raw-body@2.4.2
  - deps: safe-buffer@5.2.1
  - deps: type-is@~1.6.18
- deps: content-disposition@0.5.4
  - deps: safe-buffer@5.2.1
- deps: cookie@0.4.1
  - Fix maxAge option to reject invalid values
- deps: proxy-addr@~2.0.7
  - Use req.socket over deprecated req.connection
  - deps: forwarded@0.2.0
  - deps: ipaddr.js@1.9.1
- deps: qs@6.9.6
- deps: safe-buffer@5.2.1
- deps: send@0.17.2
  - deps: http-errors@1.8.1
  - deps: ms@2.1.3
  - pref: ignore empty http tokens
- deps: serve-static@1.14.2
  - deps: send@0.17.2
- deps: setprototypeof@1.2.0
4.17.1 - 2019-05-26
4.17.0 - 2019-05-17
4.16.4 - 2018-10-11
4.16.3 - 2018-03-12

from express GitHub release notes

Package name: http-server

0.13.0 - 2021-08-07
A long time coming, the next major release for http-server! This will be the final release before a switch to actual semantic versioning. This release's major achievement is the internalization of the functionality of the now-abandoned ecstatic library, thus removing it as a dependency. Huge thanks to @ zbynek for help on that front, as well as several other included changes.

Breaking changes:
- No longer sends the header server: http-server-${version} with every response
New features:
- All responses include Accept-Ranges: bytes to advertise support for partial requests
Fixes
- Removes dependency on the abandoned ecstatic library
- Dependency upgrades to fix several security alerts
- http-server -a 0.0.0.0 will now do what you told it to do, rather than overriding the address to 127.0.0.1
- Will no longer serve binary files with a charset in the Content-Type, fixing serving WebAssembly files, among other issues
- Support .mjs MimeType correctly
Internal
- Switched from Travis to GH Actions for CI
0.12.3 - 2020-04-27
Patch release to package man page
0.12.2 - 2020-04-27
In this release we:
- Move from optimist to minimist
- Add a man page
- Update README screenshots
- Fix a couple miscellaneous bugs
0.12.1 - 2020-01-08
0.12.1
0.12.0 - 2019-11-26
0.12.0
0.11.2 - 2021-08-07
Upgrades several dependencies to avoid security vulnerabilities, especially as mentioned in #707.
0.11.1 - 2018-01-10
Bumping version to deal with npm line ending
issues.

from http-server GitHub release notes

Package name: jstransformer-markdown-it

2.1.0 - 2018-04-23
2.1.0
2.0.0 - 2016-10-19
Release 2.0.0

from jstransformer-markdown-it GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade: - body-parser from 1.18.3 to 1.20.2. See this package in npm: https://www.npmjs.com/package/body-parser - debug from 3.1.0 to 3.2.7. See this package in npm: https://www.npmjs.com/package/debug - express from 4.16.3 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - http-server from 0.11.1 to 0.13.0. See this package in npm: https://www.npmjs.com/package/http-server - jstransformer-markdown-it from 2.0.0 to 2.1.0. See this package in npm: https://www.npmjs.com/package/jstransformer-markdown-it - pug from 2.0.0-rc.4 to 2.0.4. See this package in npm: https://www.npmjs.com/package/pug See this project in Snyk: https://app.snyk.io/org/ali8668/project/6b555464-717b-4583-adda-e485b221534b?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: body-parser, debug, express, http-server, jstransformer-markdown-it, pug#48

[Snyk] Upgrade: body-parser, debug, express, http-server, jstransformer-markdown-it, pug#48
ali8889 wants to merge 1 commit into
masterfrom
snyk-upgrade-39dcf86db72823228a80fe20de4c4148

ali8889 commented Sep 13, 2024

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Breaking changes:

New features:

Fixes

Internal

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ali8889 commented Sep 13, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Breaking changes:

New features:

Fixes

Internal

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants