[Snyk] Upgrade: debug, body-parser, cookie-parser, ejs, log4js, morgan, serve-favicon by trabab · Pull Request #12 · trabab/vulnerable-node

trabab · 2024-09-07T06:01:59Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

debug
from 2.2.0 to 2.6.9 | 23 versions ahead of your current version | 7 years ago
on 2017-09-22
body-parser
from 1.13.3 to 1.20.2 | 21 versions ahead of your current version | 2 years ago
on 2023-02-22
cookie-parser
from 1.3.5 to 1.4.6 | 7 versions ahead of your current version | 3 years ago
on 2021-11-16
ejs
from 0.3.0 to 0.8.8 | 19 versions ahead of your current version | 10 years ago
on 2014-03-24
log4js
from 0.1.0 to 0.6.38 | 68 versions ahead of your current version | 8 years ago
on 2016-07-17
morgan
from 1.6.1 to 1.10.0 | 7 versions ahead of your current version | 4 years ago
on 2020-03-20
serve-favicon
from 2.3.2 to 2.5.0 | 7 versions ahead of your current version | 6 years ago
on 2018-03-29

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Prototype Poisoning SNYK-JS-QS-3153490	661	Proof of Concept
Prototype Override Protection Bypass npm:qs:20170213	661	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:fresh:20170908	661	No Known Exploit
Arbitrary Code Injection SNYK-JS-MORGAN-72579	661	Proof of Concept
Regular Expression Denial of Service (ReDoS) npm:debug:20170905	661	Proof of Concept
Regular Expression Denial of Service (ReDoS) npm:ms:20170412	661	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:ms:20170412	661	No Known Exploit

Release notes

Package name: debug

2.6.9 - 2017-09-22
2.6.8 - 2017-05-18
2.6.7 - 2017-05-17
2.6.6 - 2017-04-27
2.6.5 - 2017-04-27
2.6.4 - 2017-04-20
2.6.3 - 2017-03-14
2.6.2 - 2017-03-10
2.6.1 - 2017-02-10
2.6.0 - 2016-12-29
2.5.2 - 2016-12-26
2.5.1 - 2016-12-21
2.5.0 - 2016-12-21
2.4.5 - 2016-12-18
2.4.4 - 2016-12-15
2.4.3 - 2016-12-14
2.4.2 - 2016-12-14
2.4.1 - 2016-12-14
2.4.0 - 2016-12-14
2.3.3 - 2016-11-19
2.3.2 - 2016-11-10
2.3.1 - 2016-11-10
2.3.0 - 2016-11-07
2.2.0 - 2015-05-10

from debug GitHub release notes

Package name: body-parser

from body-parser GitHub release notes

Package name: cookie-parser

1.4.6 - 2021-11-16
- deps: cookie@0.4.1
1.4.5 - 2020-03-15
- deps: cookie@0.4.0
1.4.4 - 2019-02-13
- perf: normalize secret argument only once
1.4.3 - 2016-05-27
- deps: cookie@0.3.1
  - perf: use for loop in parse
1.4.2 - 2016-05-21
- deps: cookie@0.2.4
  - perf: enable strict mode
  - perf: use for loop in parse
  - perf: use string concatination for serialization
1.4.1 - 2016-01-11
- deps: cookie@0.2.3
- perf: enable strict mode
1.4.0 - 2015-09-18
1.4.0
1.3.5 - 2015-05-20
- deps: cookie@0.1.3
  - Slight optimizations

from cookie-parser GitHub release notes

Package name: ejs

0.8.8 - 2014-03-24
0.8.6 - 2014-03-21
0.8.5 - 2013-11-22
0.8.4 - 2013-05-08
0.8.3 - 2012-09-13
0.8.2 - 2012-08-16
0.8.1 - 2012-08-11
0.8.0 - 2012-07-25
0.7.2 - 2012-06-22
0.7.1 - 2012-03-26
0.7.0 - 2012-03-25
0.6.1 - 2011-12-10
0.6.0 - 2011-12-09
0.5.0 - 2011-11-20
0.4.3 - 2011-06-20
0.4.2 - 2011-05-11
0.4.1 - 2011-04-21
0.4.0 - 2011-04-21
0.3.1 - 2011-02-24
0.3.0 - 2011-02-14

from ejs GitHub release notes

Package name: log4js

0.6.38 - 2016-07-17
0.6.37 - 2016-06-14
0.6.36 - 2016-05-05
0.6.35 - 2016-04-14
0.6.34 - 2016-04-14
0.6.33 - 2016-03-08
0.6.32 - 2016-02-28
0.6.31 - 2016-02-01
0.6.30 - 2016-01-26
0.6.29 - 2015-11-26
0.6.28 - 2015-11-18
0.6.27 - 2015-09-21
0.6.26 - 2015-06-10
0.6.25 - 2015-05-12
0.6.24 - 2015-04-17
0.6.23 - 2015-04-16
0.6.22 - 2015-01-10
0.6.21 - 2014-09-10
0.6.20 - 2014-08-25
0.6.19 - 2014-08-21
0.6.18 - 2014-08-19
0.6.17 - 2014-08-15
0.6.16 - 2014-07-18
0.6.15 - 2014-07-02
0.6.14 - 2014-04-22
0.6.13 - 2014-04-08
0.6.12 - 2014-03-05
0.6.11 - 2014-03-04
0.6.10 - 2014-02-10
0.6.9 - 2013-09-29
0.6.8 - 2013-08-22
0.6.7 - 2013-08-02
0.6.6 - 2013-05-25
0.6.5 - 2013-05-16
0.6.4 - 2013-05-05
0.6.3 - 2013-04-11
0.6.2 - 2013-04-02
0.6.1 - 2013-04-01
0.6.0 - 2013-03-20
0.5.8 - 2013-04-01
0.5.7 - 2013-02-25
0.5.6 - 2012-12-02
0.5.5 - 2012-11-09
0.5.4 - 2012-10-16
0.5.3 - 2012-09-25
0.5.2 - 2012-08-14
0.5.1 - 2012-07-03
0.5.0 - 2012-06-01
0.4.3 - 2012-03-21
0.4.2 - 2012-03-06
0.4.1 - 2011-11-23
0.4.0 - 2011-11-21
0.3.9 - 2011-09-14
0.3.8 - 2011-08-11
0.3.7 - 2011-07-27
0.3.6 - 2011-07-27
0.3.5 - 2011-07-25
0.3.4 - 2011-07-21
0.3.3 - 2011-07-21
0.3.2 - 2011-07-20
0.3.1 - 2011-07-18
0.3.0 - 2011-07-17
0.2.6 - 2011-06-05
0.2.5 - 2011-04-17
0.2.4 - 2011-03-04
0.2.3 - 2011-01-16
0.2.2 - 2011-01-16
0.2.0 - 2011-01-16
0.1.0 - 2011-01-16

from log4js GitHub release notes

Package name: morgan

1.10.0 - 2020-03-20
- Add :total-time token
- Fix trailing space in colored status code for dev format
- deps: basic-auth@~2.0.1
  - deps: safe-buffer@5.1.2
- deps: depd@~2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: on-headers@~1.0.2
  - Fix res.writeHead patch missing return value
1.9.1 - 2018-09-11
- Fix using special characters in format
- deps: depd@~1.1.2
  - perf: remove argument reassignment
1.9.0 - 2017-09-27
- Use res.headersSent when available
- deps: basic-auth@~2.0.0
  - Use safe-buffer for improved Buffer API
- deps: debug@2.6.9
- deps: depd@~1.1.1
  - Remove unnecessary Buffer loading
1.8.2 - 2017-05-24
- deps: debug@2.6.8
  - Fix DEBUG_MAX_ARRAY_LENGTH
  - deps: ms@2.0.0
1.8.1 - 2017-02-11
- deps: debug@2.6.1
  - Fix deprecation messages in WebStorm and other editors
  - Undeprecate DEBUG_FD set to 1 or 2
1.8.0 - 2017-02-05
- Fix sending unnecessary undefined argument to token functions
- deps: basic-auth@~1.1.0
- deps: debug@2.6.0
  - Allow colors in workers
  - Deprecated DEBUG_FD environment variable
  - Fix error when running under React Native
  - Use same color for same namespace
  - deps: ms@0.7.2
- perf: enable strict mode in compiled functions
1.7.0 - 2016-02-19
- Add digits argument to response-time token
- deps: depd@~1.1.0
  - Enable strict mode in more places
  - Support web browser loading
- deps: on-headers@~1.0.1
  - perf: enable strict mode
1.6.1 - 2015-07-04
- deps: basic-auth@~1.0.3

from morgan GitHub release notes

Package name: serve-favicon

2.5.0 - 2018-03-29
- Ignore requests without url property
- deps: ms@2.1.1
  - Add week
  - Add w
2.4.5 - 2017-09-26
- deps: etag@~1.8.1
  - perf: replace regular expression with substring
- deps: fresh@0.5.2
  - Fix regression matching multiple ETags in If-None-Match
  - perf: improve If-None-Match token parsing
2.4.4 - 2017-09-12
- deps: fresh@0.5.1
  - Fix handling of modified headers with invalid dates
  - perf: improve ETag match loop
- deps: parseurl@~1.3.2
  - perf: reduce overhead for full URLs
  - perf: unroll the "fast-path" RegExp
- deps: safe-buffer@5.1.1
2.4.3 - 2017-05-16
- Use safe-buffer for improved Buffer API
- deps: ms@2.0.0
2.4.2 - 2017-03-25
- deps: ms@1.0.0
2.4.1 - 2017-02-28
- Remove usage of res._headers private field
- deps: fresh@0.5.0
  - Fix incorrect result when If-None-Match has both * and ETags
  - Fix weak ETag matching to match spec
  - perf: skip checking modified time if ETag check failed
  - perf: skip parsing If-None-Match when no ETag header
  - perf: use Date.parse instead of new Date
2.4.0 - 2017-02-20
- deps: etag@~1.8.0
  - Use SHA1 instead of MD5 for ETag hashing
  - Works with FIPS 140-2 OpenSSL configuration
- deps: fresh@0.4.0
  - Fix false detection of no-cache request directive
  - perf: enable strict mode
  - perf: hoist regular expressions
  - perf: remove duplicate conditional
  - perf: remove unnecessary boolean coercions
- perf: simplify initial argument checking
2.3.2 - 2016-11-17
- deps: ms@0.7.2

from serve-favicon GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade: - debug from 2.2.0 to 2.6.9. See this package in npm: https://www.npmjs.com/package/debug - body-parser from 1.13.3 to 1.20.2. See this package in npm: https://www.npmjs.com/package/body-parser - cookie-parser from 1.3.5 to 1.4.6. See this package in npm: https://www.npmjs.com/package/cookie-parser - ejs from 0.3.0 to 0.8.8. See this package in npm: https://www.npmjs.com/package/ejs - log4js from 0.1.0 to 0.6.38. See this package in npm: https://www.npmjs.com/package/log4js - morgan from 1.6.1 to 1.10.0. See this package in npm: https://www.npmjs.com/package/morgan - serve-favicon from 2.3.2 to 2.5.0. See this package in npm: https://www.npmjs.com/package/serve-favicon See this project in Snyk: https://app.snyk.io/org/opsgenie/project/3355716a-cef1-42fb-9138-103dd26b3ea8?utm_source=github&utm_medium=referral&page=upgrade-pr

Navigation Menu

[Snyk] Upgrade: debug, body-parser, cookie-parser, ejs, log4js, morgan, serve-favicon - #12

[Snyk] Upgrade: debug, body-parser, cookie-parser, ejs, log4js, morgan, serve-favicon#12
trabab wants to merge 1 commit into
masterfrom
snyk-upgrade-6d271ead56e596703a6c0a0e38f8a4d1

trabab commented Sep 7, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

trabab commented Sep 7, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants