[Snyk] Upgrade express from 4.12.4 to 4.21.0 #19

YamagutiSenior · 2024-10-18T06:25:29Z

Snyk has created this PR to upgrade express from 4.12.4 to 4.21.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 31 versions ahead of your current version.
The recommended version was released a month ago, on 2024-09-11.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Regular Expression Denial of Service (ReDoS) npm:fresh:20170908	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Cross-site Scripting SNYK-JS-EXPRESS-7926867	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	589/1000 Why? Has a fix available, CVSS 7.5	Proof of Concept
Cross-site Scripting SNYK-JS-SEND-7926862	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Cross-site Scripting SNYK-JS-SERVESTATIC-7926865	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: express

4.21.0 - 2024-09-11
What's Changed
- Deprecate "back" magic string in redirects by @ blakeembrey in #5935
- finalhandler@1.3.1 by @ wesleytodd in #5954
- fix(deps): serve-static@1.16.2 by @ wesleytodd in #5951
- Upgraded dependency qs to 6.13.0 to match qs in body-parser by @ agadzinski93 in #5946
New Contributors
- @ agadzinski93 made their first contribution in #5946
Full Changelog: 4.20.0...4.21.0
4.20.0 - 2024-09-10
Read more
4.19.2 - 2024-03-25
What's Changed
- Improved fix for open redirect allow list bypass
Full Changelog: 4.19.1...4.19.2
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
4.18.2 - 2022-10-08
4.18.1 - 2022-04-29
4.18.0 - 2022-04-25
4.17.3 - 2022-02-17
4.17.2 - 2021-12-17
4.17.1 - 2019-05-26
4.17.0 - 2019-05-17
4.16.4 - 2018-10-11
4.16.3 - 2018-03-12
4.16.2 - 2017-10-10
4.16.1 - 2017-09-29
4.16.0 - 2017-09-28
4.15.5 - 2017-09-25
4.15.4 - 2017-08-07
4.15.3 - 2017-05-17
4.15.2 - 2017-03-06
4.15.1 - 2017-03-06
4.15.0 - 2017-03-01
4.14.1 - 2017-01-28
4.14.0 - 2016-06-16
4.13.4 - 2016-01-22
4.13.3 - 2015-08-03
4.13.2 - 2015-07-31
4.13.1 - 2015-07-06
4.13.0 - 2015-06-21
4.12.4 - 2015-05-18

from express GitHub release notes

Commit messages

Package name: express

7e562c6 4.21.0
1bcde96 fix(deps): qs@6.13.0 (#5946)
7d36477 fix(deps): serve-static@1.16.2 (#5951)
40d2d8f fix(deps): finalhandler@1.3.1
77ada90 Deprecate `"back"` magic string in redirects (#5935)
21df421 4.20.0
4c9ddc1 feat: upgrade to serve-static@0.16.0
9ebe5d5 feat: upgrade to send@0.19.0 (#5928)
ec4a01b feat: upgrade to body-parser@1.20.3 (#5926)
54271f6 fix: don't render redirect values in anchor href
125bb74 path-to-regexp@0.1.10 (#5902)
2a980ad merge-descriptors@1.0.3 (#5781)
a3e7e05 docs: specify new instructions for `question` and `discuss`
c5addb9 deps: path-to-regexp@0.1.8 (#5603)
e35380a docs: add @ IamLizu to the triage team (#5836)
f5b6e67 docs: update scorecard link (#5814)
2177f67 docs: add OSSF Scorecard badge (#5436)
f4bd86e Replace Appveyor windows testing with GHA (#5599)
2ec589c Fix Contributor Covenant link definition reference in attribution section (#5762)
4cf7eed remove minor version pinning from ci (#5722)
6d08471 📝 update people, add ctcpip to TC (#5683)
61421a8 skip QUERY tests for Node 21 only, still not supported (#5695)
f42b160 [v4] Deprecate `res.clearCookie` accepting `options.maxAge` and `options.expires` (#5672)
689073d ✨ bring back query tests for node 21 (#5690)