Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Upgrade: , , babel-jest, dotenv, express, express-session, jsonwebtoken, mongoose #8

Closed
wants to merge 1 commit into from
Closed

[Snyk] Upgrade: , , babel-jest, dotenv, express, express-session, jsonwebtoken, mongoose #8

wants to merge 1 commit into from
+2,209 −1,850

Conversation

navodveduth
Copy link
Collaborator

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

@babel/core
from 7.21.8 to 7.25.2 | 31 versions ahead of your current version | 2 months ago
on 2024-07-30
@babel/preset-env
from 7.21.5 to 7.25.4 | 31 versions ahead of your current version | a month ago
on 2024-08-22
babel-jest
from 29.5.0 to 29.7.0 | 6 versions ahead of your current version | a year ago
on 2023-09-12
dotenv
from 16.0.3 to 16.4.5 | 17 versions ahead of your current version | 7 months ago
on 2024-02-20
express
from 4.18.2 to 4.19.2 | 4 versions ahead of your current version | 6 months ago
on 2024-03-25
express-session
from 1.17.3 to 1.18.0 | 1 version ahead of your current version | 8 months ago
on 2024-01-28
jsonwebtoken
from 9.0.0 to 9.0.2 | 2 versions ahead of your current version | a year ago
on 2023-08-30
mongoose
from 7.1.1 to 7.8.1 | 39 versions ahead of your current version | a month ago
on 2024-08-19

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
critical severity Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962462		 786 Proof of Concept
high severity Server-side Request Forgery (SSRF)
SNYK-JS-IP-6240864		 786 Proof of Concept
high severity Prototype Pollution
SNYK-JS-MONGOOSE-5777721		 786 Proof of Concept
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509		 786 No Known Exploit
medium severity Server-Side Request Forgery (SSRF)
SNYK-JS-IP-7148531		 786 Proof of Concept
medium severity Information Exposure
SNYK-JS-MONGODB-5871303		 786 No Known Exploit
Release notes
Package name: @babel/core
  • 7.25.2 - 2024-07-30

    v7.25.2 (2024-07-30)

    🐛 Bug Fix

    • babel-core, babel-traverse

    Committers: 2

  • 7.24.9 - 2024-07-15

    v7.24.9 (2024-07-15)

    🐛 Bug Fix

    💅 Polish

    • babel-generator, babel-plugin-transform-optional-chaining

    🏠 Internal

    • babel-helper-module-transforms

    Committers: 5

  • 7.24.8 - 2024-07-11
  • 7.24.7 - 2024-06-05
  • 7.24.6 - 2024-05-24
  • 7.24.5 - 2024-04-29
  • 7.24.4 - 2024-04-03
  • 7.24.3 - 2024-03-20
  • 7.24.1 - 2024-03-19
  • 7.24.0 - 2024-02-28
  • 7.23.9 - 2024-01-25
  • 7.23.7 - 2023-12-29
  • 7.23.6 - 2023-12-11
  • 7.23.5 - 2023-11-29
  • 7.23.3 - 2023-11-09
  • 7.23.2 - 2023-10-12
  • 7.23.0 - 2023-09-25
  • 7.22.20 - 2023-09-16
  • 7.22.19 - 2023-09-14
  • 7.22.18 - 2023-09-14
  • 7.22.17 - 2023-09-08
  • 7.22.15 - 2023-09-04
  • 7.22.11 - 2023-08-24
  • 7.22.10 - 2023-08-07
  • 7.22.9 - 2023-07-12
  • 7.22.8 - 2023-07-06
  • 7.22.7 - 2023-07-06
  • 7.22.6 - 2023-07-04
  • 7.22.5 - 2023-06-08
  • 7.22.1 - 2023-05-26
  • 7.22.0 - 2023-05-26
  • 7.21.8 - 2023-05-02
from @babel/core GitHub release notes
Package name: @babel/preset-env
  • 7.25.4 - 2024-08-22

    v7.25.4 (2024-08-22)

    🐛 Bug Fix

    💅 Polish

    • babel-generator, babel-plugin-proposal-decorators, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-pipeline-operator, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-typescript, babel-runtime-corejs2, babel-runtime, babel-traverse
    • babel-generator, babel-plugin-transform-class-properties
    • babel-generator, babel-plugin-proposal-decorators, babel-plugin-proposal-destructuring-private, babel-plugin-transform-object-rest-spread

    🔬 Output optimization

    Committers: 4

  • 7.25.3 - 2024-07-31

    v7.25.3 (2024-07-31)

    🐛 Bug Fix

    • babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-traverse

    🏠 Internal

    Committers: 2

  • 7.25.2 - 2024-07-30

    v7.25.2 (2024-07-30)

    🐛 Bug Fix

    • babel-core, babel-traverse

    Committers: 2

  • 7.25.0 - 2024-07-26

    v7.25.0 (2024-07-26)

    Thanks @ davidtaylorhq and @ slatereax for your first PR!

    You can find the release blog post with some highlights at https://babeljs.io/blog/2024/07/26/7.25.0.

    👓 Spec Compliance

    • babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
    • babel-plugin-transform-typescript
      • #16602 Ensure enum members syntactically determinable to be strings do not get reverse mappings (@ liuxingbaoyu)

    🚀 New Feature

    • babel-helper-create-class-features-plugin, babel-helper-function-name, babel-helper-plugin-utils, babel-helper-wrap-function, babel-plugin-bugfix-safari-class-field-initializer-scope, babel-plugin-bugfix-safari-id-destructuring-collision-in-function-expression, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-preset-env, babel-traverse, babel-types
    • babel-helper-hoist-variables, babel-helper-plugin-utils, babel-plugin-proposal-async-do-expressions, babel-plugin-transform-modules-systemjs, babel-traverse
    • babel-helper-create-class-features-plugin, babel-helper-module-transforms, babel-helper-plugin-utils, babel-helper-split-export-declaration, babel-plugin-transform-classes, babel-traverse, babel-types
    • babel-helper-create-class-features-plugin, babel-helper-environment-visitor, babel-helper-module-transforms, babel-helper-plugin-utils, babel-helper-remap-async-to-generator, babel-helper-replace-supers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-transform-async-generator-functions, babel-plugin-transform-classes, babel-traverse
    • babel-core, babel-parser
    • babel-compat-data, babel-plugin-bugfix-safari-class-field-initializer-scope, babel-preset-env
    • babel-plugin-transform-block-scoping, babel-traverse, babel-types
    • babel-helper-import-to-platform-api, babel-plugin-proposal-json-modules
    • babel-helper-transform-fixture-test-runner, babel-node
    • babel-compat-data, babel-helper-create-regexp-features-plugin, babel-plugin-proposal-duplicate-named-capturing-groups-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-preset-env, babel-standalone
      • #16445 Add duplicate-named-capturing-groups-regex to preset-env (@ JLHwung)

    🐛 Bug Fix

    🏠 Internal

    • Other
    • babel-generator
    • babel-helper-function-name, babel-plugin-transform-arrow-functions, babel-plugin-transform-function-name, babel-preset-env, babel-traverse

    🏃‍♀️ Performance

    • babel-parser, babel-plugin-proposal-pipeline-operator

    🔬 Output optimization

    • babel-plugin-transform-classes
    • babel-helper-create-class-features-plugin, babel-helper-replace-supers, babel-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-classes, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-object-super, babel-plugin-transform-private-methods, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
    • babel-plugin-transform-class-properties, babel-plugin-transform-classes

    Committers: 6

  • 7.24.8 - 2024-07-11
  • 7.24.7 - 2024-06-05
  • 7.24.6 - 2024-05-24
  • 7.24.5 - 2024-04-29
  • 7.24.4 - 2024-04-03
  • 7.24.3 - 2024-03-20
  • 7.24.1 - 2024-03-19
  • 7.24.0 - 2024-02-28
  • 7.23.9 - 2024-01-25
  • 7.23.8 - 2024-01-08
  • 7.23.7 - 2023-12-29
  • 7.23.6 - 2023-12-11
  • 7.23.5 - 2023-11-29
  • 7.23.3 - 2023-11-09
  • 7.23.2 - 2023-10-11
  • 7.22.20 - 2023-09-16
  • 7.22.15 - 2023-09-04
  • 7.22.14 - 2023-08-30
  • 7.22.10 - 2023-08-07
  • 7.22.9 - 2023-07-12
  • 7.22.7 - 2023-07-06
  • 7.22.6 - 2023-07-04
  • 7.22.5 - 2023-06-08
  • 7.22.4 - 2023-05-29
  • 7.22.2 - 2023-05-26
  • 7.22.1 - 2023-05-26
  • 7.22.0 - 2023-05-26
  • 7.21.5 - 2023-04-28
from @babel/preset-env GitHub release notes
Package name: babel-jest
  • 29.7.0 - 2023-09-12

    Features

    • [create-jest] Add npm init / yarn create initialiser for Jest projects (#14465)
    • [jest-validate] Allow deprecation warnings for unknown options (#14499)

    Fixes

    • [jest-resolver] Replace unmatched capture groups in moduleNameMapper with empty string instead of undefined (#14507)
    • [jest-snapshot] Allow for strings as well as template literals in inline snapshots (#14465)
    • [@ jest/test-sequencer] Calculate test runtime if perStats.duration is missing (#14473)

    Performance

    • [@ jest/create-cache-key-function] Cache access of NODE_ENV and BABEL_ENV (#14455)

    Chore & Maintenance

    • [jest-cli] Move internal config initialisation logic to the create-jest package (#14465)

    New Contributors

    Full Changelog: v29.6.4...v29.7.0

  • 29.6.4 - 2023-08-24

    Fixes

    • [jest-core] Fix typo in scheduleAndRun performance marker (#14434)
    • [jest-environment-node] Make sure atob and btoa are writeable in Node 20 (#14446)
    • [jest-worker] Additional error wrapper for parentPort.postMessage to fix unhandled DataCloneError. (#14437)

    New Contributors

    Full Changelog: v29.6.3...v29.6.4

  • 29.6.3 - 2023-08-21

    Fixes

    • [expect, @ jest/expect-utils] ObjectContaining support symbol as key (#14414)
    • [expect] Remove @ types/node from dependencies (#14385)
    • [jest-core] Use workers in watch mode by default to avoid crashes (#14059 & #14085).
    • [jest-reporters] Update istanbul-lib-instrument dependency to v6. (#14401)
    • [jest-mock] Revert #13692 as it was a breaking change (#14429)
    • [jest-mock] Revert #13866 as it was a breaking change (#14429)
    • [jest-mock] Revert #13867 as it was a breaking change (#14429)
    • [@ jest/reporters] Marks Reporter's hooks as optional (#14433)
    • [jest-runtime] Fix dynamic ESM import module bug when loaded module through jest.isolateModulesAsync (#14397)

    Chore & Maintenance

    • [jest-changed-files, jest-circus, jest-console, @ jest/core, @ jest/runtime, @ jest/transform] Use invariant and notEmpty from jest-util rather than own internal (#14366)

    New Contributors

    Full Changelog: v29.6.2...v29.6.3

  • 29.6.2 - 2023-07-27

    Fixes

    • [jest-circus] Fix snapshot matchers in concurrent tests when nr of tests exceeds maxConcurrency (#14335)
    • [@ jest/core] When running global setup and teardown, do not try to change the message property of the thrown error object when the message property is unwritable (#14113)
    • [jest-snapshot] Move @ types/prettier from dependencies to devDependencies (#14328)
    • [jest-snapshot] Throw an explicit error if Prettier v3 is used (#14367)
    • [jest-reporters] Add "skipped" and "todo" symbols to Github Actions Reporter (#14309)

    Chore & Maintenance

    • [@ jest/core] Use pluralize from jest-util rather than own internal (#14322)

    New Contributors

    Full Changelog: v29.6.1...v29.6.2

  • 29.6.1 - 2023-07-06

    Fixes

    • [jest-circus] Revert #14110 as it was a breaking change (#14304)

    Full Changelog: v29.6.0...v29.6.1

  • 29.6.0 - 2023-07-04

    Features

    • [jest-circus, jest-snapshot] Add support for snapshot matchers in concurrent tests (#14139)
    • [jest-cli] Include type definitions to generated config files (#14078)
    • [jest-snapshot] Support arrays as property matchers (#14025)
    • [jest-core, jest-circus, jest-reporter, jest-runner] Added support for reporting about start individual test cases using jest-circus (#14174)

    Fixes

    • [jest-circus] Prevent false test failures caused by promise rejections handled asynchronously (#14110)
    • [jest-config] Handle frozen config object (#14054)
    • [jest-config] Allow coverageDirectory and collectCoverageFrom in project config (#14180)
    • [jest-core] Always use workers in watch mode to avoid crashes (#14059).
    • [jest-environment-jsdom, jest-environment-node] Fix assignment of customExportConditions via testEnvironmentOptions when custom env subclass defines a default value (#13989)
    • [jest-matcher-utils] Fix copying value of inherited getters (#14007)
    • [jest-mock] Tweak typings to allow jest.replaceProperty() replace methods (#14008)
    • [jest-mock] Improve user input validation and error messages of spyOn and replaceProperty methods (#14087)
    • [jest-runtime] Bind jest.isolateModulesAsync to this (#14083)
    • [jest-runtime] Forward wrapperLength to the Script constructor as columnOffset for accurate debugging (#14148)
    • [jest-runtime] Guard _isMockFunction access with in (#14188)
    • [jest-snapshot] Fix a potential bug when not using prettier and improve performance (#14036)
    • [@ jest/transform] Do not instrument .json modules (#14048)
    • [jest-worker] Restart a shut down worker before sending it a task (#14015)

    Chore & Maintenance

    • [*] Update semver dependency to get vulnerability fix (#14262)
    • [docs] Updated documentation for the --runTestsByPath CLI command (#14004)
    • [docs] Updated documentation regarding the synchronous fallback when asynchronous code transforms are unavailable (#14056)
    • [docs] Update jest statistics of use and downloads in website Index.

    New Contributors

    Full Changelog: v29.5.0...v29.6.0

  • 29.5.0 - 2023-03-06

    Features

    • [jest-changed-files] Support Sapling (#13941)
    • [jest-circus, @ jest/cli, jest-config] Add feature to randomize order of tests via CLI flag or through the config file(#12922)
    • [jest-cli, jest-config, @ jest/core, jest-haste-map, @ jest/reporters, jest-runner, jest-runtime, @ jest/types] Add workerThreads configuration option to allow using worker threads for parallelization (

@snyk-bot
fix: upgrade multiple dependencies with Snyk
f1180cc 
Snyk has created this PR to upgrade:
  - @babel/core from 7.21.8 to 7.25.2.
    See this package in npm: https://www.npmjs.com/package/@babel/core
  - @babel/preset-env from 7.21.5 to 7.25.4.
    See this package in npm: https://www.npmjs.com/package/@babel/preset-env
  - babel-jest from 29.5.0 to 29.7.0.
    See this package in npm: https://www.npmjs.com/package/babel-jest
  - dotenv from 16.0.3 to 16.4.5.
    See this package in npm: https://www.npmjs.com/package/dotenv
  - express from 4.18.2 to 4.19.2.
    See this package in npm: https://www.npmjs.com/package/express
  - express-session from 1.17.3 to 1.18.0.
    See this package in npm: https://www.npmjs.com/package/express-session
  - jsonwebtoken from 9.0.0 to 9.0.2.
    See this package in npm: https://www.npmjs.com/package/jsonwebtoken
  - mongoose from 7.1.1 to 7.8.1.
    See this package in npm: https://www.npmjs.com/package/mongoose

See this project in Snyk:
https://app.snyk.io/org/navodveduth/project/5f859037-de17-46f3-80c9-67b95bee1c4f?utm_source=github&utm_medium=referral&page=upgrade-pr
@sonarcloud SonarCloud
Copy link

sonarcloud bot commented Sep 19, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@IT20159030 IT20159030 closed this Sep 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@navodveduth @IT20159030 @snyk-bot