[Snyk] Upgrade: body-parser, consolidate, csurf, dont-sniff-mimetype, express, express-session, marked, needle, underscore #18

ollijarva0 · 2024-09-14T10:14:12Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

body-parser
from 1.18.3 to 1.20.2 | 6 versions ahead of your current version | 2 years ago
on 2023-02-22
consolidate
from 0.14.5 to 0.16.0 | 3 versions ahead of your current version | 4 years ago
on 2020-09-08
csurf
from 1.9.0 to 1.10.0 | 1 version ahead of your current version | 5 years ago
on 2019-04-23
dont-sniff-mimetype
from 1.0.0 to 1.1.0 | 1 version ahead of your current version | 5 years ago
on 2019-05-11
express
from 4.16.4 to 4.19.2 | 11 versions ahead of your current version | 6 months ago
on 2024-03-25
express-session
from 1.15.6 to 1.18.0 | 8 versions ahead of your current version | 8 months ago
on 2024-01-28
marked
from 0.3.9 to 0.8.2 | 20 versions ahead of your current version | 4 years ago
on 2020-03-22
needle
from 2.2.4 to 2.9.1 | 14 versions ahead of your current version | 3 years ago
on 2021-09-01
underscore
from 1.9.1 to 1.13.7 | 19 versions ahead of your current version | 2 months ago
on 2024-07-24

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Regular Expression Denial of Service (ReDoS) npm:marked:20180225	596	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	596	Proof of Concept
Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	596	Proof of Concept
Open Redirect SNYK-JS-EXPRESS-6474509	596	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKED-174116	596	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKED-451540	596	No Known Exploit

Release notes

Package name: body-parser

1.20.2 - 2023-02-22
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
  - perf: skip value escaping when unnecessary
- deps: raw-body@2.5.2
1.20.1 - 2022-10-06
- deps: qs@6.11.0
- perf: remove unnecessary object clone
1.20.0 - 2022-04-03
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: http-errors@2.0.0
  - deps: depd@2.0.0
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
- deps: qs@6.10.3
- deps: raw-body@2.5.1
  - deps: http-errors@2.0.0
1.19.2 - 2022-02-16
- deps: bytes@3.1.2
- deps: qs@6.9.7
  - Fix handling of __proto__ keys
- deps: raw-body@2.4.3
  - deps: bytes@3.1.2
1.19.1 - 2021-12-10
- deps: bytes@3.1.1
- deps: http-errors@1.8.1
  - deps: inherits@2.0.4
  - deps: toidentifier@1.0.1
  - deps: setprototypeof@1.2.0
- deps: qs@6.9.6
- deps: raw-body@2.4.2
  - deps: bytes@3.1.1
  - deps: http-errors@1.8.1
- deps: safe-buffer@5.2.1
- deps: type-is@~1.6.18
1.19.0 - 2019-04-26
- deps: bytes@3.1.0
  - Add petabyte (pb) support
- deps: http-errors@1.7.2
  - Set constructor name when possible
  - deps: setprototypeof@1.1.1
  - deps: statuses@'>= 1.5.0 < 2'
- deps: iconv-lite@0.4.24
  - Added encoding MIK
- deps: qs@6.7.0
  - Fix parsing array brackets after index
- deps: raw-body@2.4.0
  - deps: bytes@3.1.0
  - deps: http-errors@1.7.2
  - deps: iconv-lite@0.4.24
- deps: type-is@~1.6.17
  - deps: mime-types@~2.1.24
  - perf: prevent internal throw on invalid type
1.18.3 - 2018-05-14
- Fix stack trace for strict json parse error
- deps: depd@~1.1.2
  - perf: remove argument reassignment
- deps: http-errors@~1.6.3
  - deps: depd@~1.1.2
  - deps: setprototypeof@1.1.0
  - deps: statuses@'>= 1.3.1 < 2'
- deps: iconv-lite@0.4.23
  - Fix loading encoding with year appended
  - Fix deprecation warnings on Node.js 10+
- deps: qs@6.5.2
- deps: raw-body@2.3.3
  - deps: http-errors@1.6.3
  - deps: iconv-lite@0.4.23
- deps: type-is@~1.6.16
  - deps: mime-types@~2.1.18

from body-parser GitHub release notes

Package name: consolidate

0.16.0 - 2020-09-08
0.15.1 - 2018-03-20
0.15.0 - 2017-11-01
0.14.5 - 2016-11-17

from consolidate GitHub release notes

Package name: csurf

1.10.0 - 2019-04-23
- deps: csrf@3.1.0
  - Remove base64-url dependency
  - deps: tsscmp@1.0.6
  - deps: uid-safe@2.1.5
- deps: http-errors@~1.7.2
  - Make message property enumerable for HttpErrors
  - Set constructor name when possible
  - deps: depd@~1.1.2
  - deps: inherits@2.0.3
  - deps: setprototypeof@1.1.1
  - deps: statuses@'>= 1.5.0 < 2'
- perf: remove argument reassignment
- perf: use plain object for internal cookie options
1.9.0 - 2016-05-27
- Pass invalid csrf token error to next() instead of throwing
- Pass misconfigured error to next() instead of throwing
- Provide misconfigured error when using cookies without cookie-parser
- deps: cookie@0.3.1
  - Add sameSite option
  - Fix cookie Max-Age to never be a floating point number
  - Improve error message when expires is not a Date
  - Throw better error for invalid argument to parse
  - Throw on invalid values provided to serialize
  - perf: enable strict mode
  - perf: hoist regular expression
  - perf: use for loop in parse
  - perf: use string concatination for serialization
- deps: csrf@~3.0.3
  - Use tsscmp module for timing-safe token verification
  - deps: base64-url@1.2.2
  - deps: rndm@1.2.0
  - deps: uid-safe@2.1.1
- deps: http-errors@~1.5.0
  - Add HttpError export, for err instanceof createError.HttpError
  - Support new code 421 Misdirected Request
  - Use setprototypeof module to replace __proto__ setting
  - deps: inherits@2.0.1
  - deps: statuses@'>= 1.3.0 < 2'
  - perf: enable strict mode
- perf: enable strict mode
- perf: remove argument reassignment

from csurf GitHub release notes

Package name: dont-sniff-mimetype

1.1.0 - 2019-05-11
v1.1.0
1.0.0 - 2015-12-18
1.0.0

from dont-sniff-mimetype GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: body-parser@1.20.2
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: raw-body@2.5.2
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: Node.js@16.18 and Node.js@18.12 by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add Node.js@19.7 by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: body-parser@1.20.1
  - deps: qs@6.11.0
  - perf: remove unnecessary object clone
- deps: qs@6.11.0
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: body-parser@1.20.0
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: depd@2.0.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: qs@6.10.3
  - deps: raw-body@2.5.1
- deps: cookie@0.5.0
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: finalhandler@1.2.0
  - Remove set content headers that break response
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
  - Prevent loss of async hooks context
- deps: qs@6.10.3
- deps: send@0.18.0
  - Fix emitted 416 error missing headers property
  - Limit the headers removed for 304 response
  - deps: depd@2.0.0
  - deps: destroy@1.2.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: serve-static@1.15.0
  - deps: send@0.18.0
- deps: statuses@2.0.1
  - Remove code 306
  - Rename 425 Unordered Collection to standard 425 Too Early
4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
  - deps: mime-types@~2.1.34
  - deps: negotiator@0.6.3
- deps: body-parser@1.19.2
  - deps: bytes@3.1.2
  - deps: qs@6.9.7
  - deps: raw-body@2.4.3
- deps: cookie@0.4.2
- deps: qs@6.9.7
  - Fix handling of __proto__ keys
- pref: remove unnecessary regexp for trust proxy
4.17.2 - 2021-12-17
- Fix handling of undefined in res.jsonp
- Fix handling of undefined when "json escape" is enabled
- Fix incorrect middleware execution with unanchored RegExps
- Fix res.jsonp(obj, status) deprecation message
- Fix typo in res.is JSDoc
- deps: body-parser@1.19.1
  - deps: bytes@3.1.1
  - deps: http-errors@1.8.1
  - deps: qs@6.9.6
  - deps: raw-body@2.4.2
  - deps: safe-buffer@5.2.1
  - deps: type-is@~1.6.18
- deps: content-disposition@0.5.4
  - deps: safe-buffer@5.2.1
- deps: cookie@0.4.1
  - Fix maxAge option to reject invalid values
- deps: proxy-addr@~2.0.7
  - Use req.socket over deprecated req.connection
  - deps: forwarded@0.2.0
  - deps: ipaddr.js@1.9.1
- deps: qs@6.9.6
- deps: safe-buffer@5.2.1
- deps: send@0.17.2
  - deps: http-errors@1.8.1
  - deps: ms@2.1.3
  - pref: ignore empty http tokens
- deps: serve-static@1.14.2
  - deps: send@0.17.2
- deps: setprototypeof@1.2.0
4.17.1 - 2019-05-26
4.17.0 - 2019-05-17
4.16.4 - 2018-10-11

from express GitHub release notes

Package name: express-session

1.18.0 - 2024-01-28
- Add debug log for pathname mismatch
- Add partitioned to cookie options
- Add priority to cookie options
- Fix handling errors from setting cookie
- Support any type in secret that crypto.createHmac supports
- deps: cookie@0.6.0
  - Fix expires option to reject invalid dates
  - perf: improve default decode speed
  - perf: remove slow string split in parse
- deps: cookie-signature@1.0.7
1.17.3 - 2022-05-11
- Fix resaving already-saved new session at end of request
- deps: cookie@0.4.2
1.17.2 - 2021-05-19
- Fix res.end patch to always commit headers
- deps: cookie@0.4.1
- deps: safe-buffer@5.2.1
1.17.1 - 2020-04-17
- Fix internal method wrapping error on failed reloads
1.17.0 - 2019-10-11
- deps: cookie@0.4.0
  - Add SameSite=None support
- deps: safe-buffer@5.2.0
1.16.2 - 2019-06-12
- Fix restoring cookie.originalMaxAge when store returns Date
- deps: parseurl@~1.3.3
1.16.1 - 2019-04-11
- Fix error passing data option to Cookie constructor
- Fix uncaught error from bad session data
1.16.0 - 2019-04-11
- Catch invalid cookie.maxAge value earlier
- Deprecate setting cookie.maxAge to a Date object
- Fix issue where resave: false may not save altered sessions
- Remove utils-merge dependency
- Use safe-buffer for improved Buffer API
- Use Set-Cookie as cookie header name for compatibility
- deps: depd@~2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
  - perf: remove argument reassignment
- deps: on-headers@~1.0.2
  - Fix res.writeHead patch missing return value
1.15.6 - 2017-09-26
- deps: debug@2.6.9
- deps: parseurl@~1.3.2
  - perf: reduce overhead for full URLs
  - perf: unroll the "fast-path" RegExp
- deps: uid-safe@~2.1.5
  - perf: remove only trailing =
- deps: utils-merge@1.0.1

from express-session GitHub release notes

Package name: marked

0.8.2 - 2020-03-22
Fixes
- Add html to TextRenderer for html in headings #1622
- Remove html tags in heading ids #1622
Docs
- Update comment about GitHub breaks #1620
0.8.1 - 2020-03-18
Fixes
- Fix marked --help #1588
- Fix GFM Example 116 code fences #1600
- Send inline html to renderer #1602 (fixes #1601)
- Improve docs example for invoking highlight.js #1603
- Fix block-level elements breaking tables #1598 (fixes #1467)
- break nptables on block-level structures #1617
0.8.0 - 2019-12-12
Breaking changes
- Remove substitutions #1532
- Separate source into modules #1563 #1572 #1573 #1575 #1576 #1581
Fixes
- Fix relative urls in baseUrl option #1526
- Loose task list #1535
- Fix image parentheses #1557
- remove module field & update devDependencies #1581
Docs
- Update examples with es6+ #1521
- Fix link to USING_PRO.md page #1552
- Fix typo in USING_ADVANCED.md #1558
- Node worker threads are stable #1555
Dev Dependencies
- Update deps #1516
- Update eslint #1542
- Update htmldiffer async matcher #1543
0.7.0 - 2019-07-06
Security
- Sanitize paragraph and text tokens #1504
- Fix ReDOS for links with backticks (issue #1493) #1515
Breaking Changes
- Deprecate sanitize and sanitizer options #1504
- Move fences to CommonMark #1511
- Move tables to GFM #1511
- Remove tables option #1511
- Single backtick in link text needs to be escaped #1515
Fixes
- Fix parentheses around a link #1509
- Fix headings (issue #1510) #1511
Tests
- Run tests with correct options #1511
0.6.3 - 2019-06-30
Fixes
- Fix nested blockquotes #1464
- Fix <em> issue with mixed content #1451
- revert #1464 #1497
- Fix breaks: true #1507
Docs
- add docs for workers #1432
- Add security policy #1492
- Update supported spec versions #1491
- Update test folder descriptions #1506
DevOps
- Use latest commit for demo master #1457
- Update tests to commonmark 0.29 #1465
- Update tests to GFM 0.29 #1470
- Fix commonmark spec 57 and 40 (headings) #1475
0.6.2 - 2019-04-05
Security
- Link redos #1426

Snyk has created this PR to upgrade: - body-parser from 1.18.3 to 1.20.2. See this package in npm: https://www.npmjs.com/package/body-parser - consolidate from 0.14.5 to 0.16.0. See this package in npm: https://www.npmjs.com/package/consolidate - csurf from 1.9.0 to 1.10.0. See this package in npm: https://www.npmjs.com/package/csurf - dont-sniff-mimetype from 1.0.0 to 1.1.0. See this package in npm: https://www.npmjs.com/package/dont-sniff-mimetype - express from 4.16.4 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - express-session from 1.15.6 to 1.18.0. See this package in npm: https://www.npmjs.com/package/express-session - marked from 0.3.9 to 0.8.2. See this package in npm: https://www.npmjs.com/package/marked - needle from 2.2.4 to 2.9.1. See this package in npm: https://www.npmjs.com/package/needle - underscore from 1.9.1 to 1.13.7. See this package in npm: https://www.npmjs.com/package/underscore See this project in Snyk: https://app.snyk.io/org/olli.jarva/project/8c005515-2264-4240-82d9-de23627fe2f3?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: body-parser, consolidate, csurf, dont-sniff-mimetype, express, express-session, marked, needle, underscore #18

[Snyk] Upgrade: body-parser, consolidate, csurf, dont-sniff-mimetype, express, express-session, marked, needle, underscore #18

ollijarva0 commented Sep 14, 2024

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Fixes

Docs

Fixes

Breaking changes

Fixes

Docs

Dev Dependencies

Security

Breaking Changes

Fixes

Tests

Fixes

Docs

DevOps

Security

[Snyk] Upgrade: body-parser, consolidate, csurf, dont-sniff-mimetype, express, express-session, marked, needle, underscore #18

Are you sure you want to change the base?

[Snyk] Upgrade: body-parser, consolidate, csurf, dont-sniff-mimetype, express, express-session, marked, needle, underscore #18

Conversation

ollijarva0 commented Sep 14, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Fixes

Docs

Fixes

Breaking changes

Fixes

Docs

Dev Dependencies

Security

Breaking Changes

Fixes

Tests

Fixes

Docs

DevOps

Security