[Snyk] Upgrade: adm-zip, ms, cfenv, consolidate, dustjs-helpers, errorhandler, express-session, hbs, jquery, marked, mongoose, stream-buffers, typeorm, validator #7
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade:
- adm-zip from 0.5.2 to 0.5.15.
See this package in npm: https://www.npmjs.com/package/adm-zip
- ms from 2.0.0 to 2.1.3.
See this package in npm: https://www.npmjs.com/package/ms
- cfenv from 1.2.2 to 1.2.4.
See this package in npm: https://www.npmjs.com/package/cfenv
- consolidate from 0.14.5 to 0.16.0.
See this package in npm: https://www.npmjs.com/package/consolidate
- dustjs-helpers from 1.5.0 to 1.7.4.
See this package in npm: https://www.npmjs.com/package/dustjs-helpers
- errorhandler from 1.5.0 to 1.5.1.
See this package in npm: https://www.npmjs.com/package/errorhandler
- express-session from 1.17.2 to 1.18.0.
See this package in npm: https://www.npmjs.com/package/express-session
- hbs from 4.1.2 to 4.2.0.
See this package in npm: https://www.npmjs.com/package/hbs
- jquery from 3.5.0 to 3.7.1.
See this package in npm: https://www.npmjs.com/package/jquery
- marked from 4.0.10 to 4.3.0.
See this package in npm: https://www.npmjs.com/package/marked
- mongoose from 5.13.20 to 5.13.22.
See this package in npm: https://www.npmjs.com/package/mongoose
- stream-buffers from 3.0.2 to 3.0.3.
See this package in npm: https://www.npmjs.com/package/stream-buffers
- typeorm from 0.3.18 to 0.3.20.
See this package in npm: https://www.npmjs.com/package/typeorm
- validator from 13.7.0 to 13.12.0.
See this package in npm: https://www.npmjs.com/package/validator
See this project in Snyk:
https://app.snyk.io/org/sean.durney/project/0a6e40c2-72a6-4025-8658-e32a7c75bd72?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade multiple dependencies.
👯 The following dependencies are linked and will therefore be updated together.ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
adm-zip
from 0.5.2 to 0.5.15 | 13 versions ahead of your current version | a month ago
on 2024-08-05
ms
from 2.0.0 to 2.1.3 | 4 versions ahead of your current version | 4 years ago
on 2020-12-08
cfenv
from 1.2.2 to 1.2.4 | 2 versions ahead of your current version | 3 years ago
on 2021-04-07
consolidate
from 0.14.5 to 0.16.0 | 3 versions ahead of your current version | 4 years ago
on 2020-09-08
dustjs-helpers
from 1.5.0 to 1.7.4 | 9 versions ahead of your current version | 7 years ago
on 2017-12-09
errorhandler
from 1.5.0 to 1.5.1 | 1 version ahead of your current version | 5 years ago
on 2019-05-09
express-session
from 1.17.2 to 1.18.0 | 2 versions ahead of your current version | 8 months ago
on 2024-01-28
hbs
from 4.1.2 to 4.2.0 | 1 version ahead of your current version | 3 years ago
on 2021-11-17
jquery
from 3.5.0 to 3.7.1 | 8 versions ahead of your current version | a year ago
on 2023-08-28
marked
from 4.0.10 to 4.3.0 | 25 versions ahead of your current version | a year ago
on 2023-03-22
mongoose
from 5.13.20 to 5.13.22 | 2 versions ahead of your current version | 8 months ago
on 2024-01-02
stream-buffers
from 3.0.2 to 3.0.3 | 1 version ahead of your current version | 3 months ago
on 2024-06-17
typeorm
from 0.3.18 to 0.3.20 | 17 versions ahead of your current version | 8 months ago
on 2024-01-26
validator
from 13.7.0 to 13.12.0 | 3 versions ahead of your current version | 4 months ago
on 2024-05-09
Issues fixed by the recommended upgrade:
SNYK-JS-UNDERSCORE-1080984
Release notes
Package name: adm-zip
-
0.5.15 - 2024-08-05
- Fix utils canonical to valid posix by @ skoniks in #499
- addFile backslash test by @ 5saviahv in #500
- added addLocalFolderAsync2 by @ 5saviahv in #501
- fixed windows paths by @ roosipuu in #503
- Add Windows build by @ 5saviahv in #504
- inital "decoder" functionality by @ 5saviahv in #505
- Bump braces from 3.0.2 to 3.0.3 by @ dependabot in #506
- Write out Electron original-fs auto loading by @ 5saviahv in #502
- using writeZip() twice throws "Invalid LOC header (bad signature)" error by @ 5saviahv in #507
- Descriptor check & Main Header locating by @ 5saviahv in #508
- House keeping by @ 5saviahv in #509
- typo by @ 5saviahv in #510
- Allow interoperability files with non-UTF-8 (bit 11 = 0) name by @ yfdyh000 in #450
- package lock update by @ 5saviahv in #511
- small updates by @ 5saviahv in #513
- CodeQL check by @ 5saviahv in #514
- Keep local extra data by @ 5saviahv in #515
- Update old test by @ 5saviahv in #516
- make all errors a function by @ 5saviahv in #517
- Update date time functions by @ 5saviahv in #518
- Add a length check when extra field parsed by @ code-sunbo in #520
- deleteFile is too eager by @ 5saviahv in #525
- @ skoniks made their first contribution in #499
- @ roosipuu made their first contribution in #503
- @ code-sunbo made their first contribution in #520
-
0.5.14 - 2024-06-04
-
0.5.13 - 2024-06-01
- Fixed extractAllToAsync callback @ 5saviahv
- Fixed issue with "toAsyncBuffer" where after that command all entries are gone @ 5saviahv
- Minor fixes (tests, typos etc) @ 5saviahv
- Added a an option to specificy the maximum expectedLength of the file to protect against zip bombs or limit memory usage @ undefined-moe
- Add check for invalid large disk entries @ criyle
-
0.5.12 - 2024-03-14
-
0.5.11 - 2024-03-13
- Add support for Info-Zip password check spec for ZipCrypto @ lukemalcolm
- Extraction of password protected zip entries @ Santa77
- Fixed unnecessary scanning a local file headers (except in the case of corrupted archives) @ likev
- Added GitHub actions @ kibertoad
- Fixed cases when extra data was lost @ yfdyh000
- Fixed throw empty error in extractAllToAsync on operation done @ Autokaka
-
0.5.10 - 2022-12-20
-
0.5.9 - 2021-10-07
-
0.5.8 - 2021-10-07
-
0.5.7 - 2021-10-01
-
0.5.6 - 2021-09-12
-
0.5.5 - 2021-03-31
-
0.5.4 - 2021-03-08
-
0.5.3 - 2021-02-18
-
0.5.2 - 2021-01-27
from adm-zip GitHub release notesWhat's Changed
New Contributors
Full Changelog: v0.5.14...v0.5.15
Fixed an issue introduced on version 0.5.13 requiring a new mandatory parameter on the inflater on nodejs version >= 15
Fixed extraction error
v0.5.9
v0.5.8
v0.5.7
Package name: ms
-
2.1.3 - 2020-12-08
- Rename zeit to vercel: #151
- Bump eslint from 4.12.1 to 4.18.2: #122
- Add prettier as a dev dependency: #135 #153
- Use GitHub Actions CI: #154
-
2.1.2 - 2019-06-06
- Fixed negative decimals less than -10 don't work: #111
- Support error in case of Infinity: #116
- Update regexp for
- Update chat badge: #119
-
2.1.1 - 2017-11-30
- Add full support for negative numbers: #104
-
2.1.0 - 2017-11-30
- Add "week" / "w" support: a2caead
- Fixed match regex to support negative numbers: #96
- Applied a few text improvements: 15dc8c5
- Fixed spelling of “millisecond” in description: #95
- Lockfile added: 2425ebd
-
2.0.0 - 2017-05-16
- Limit str to 100 to avoid ReDoS of 0.3s: #89
- Ignored logs coming from npm: b1eaab7
- Bumped dependencies to the latest version: bcf5715
- Invalidated cache for slack badge: 94b995c
from ms GitHub release notesPatches
Credits
Huge thanks to @ getsnoopy for helping!
Patches
10-.5is invalid input: #117Credits
Huge thanks to @ yuler and @ 7ma7X for helping!
Patches
Credits
Huge thanks to @ thevtm for helping!
Minor Changes
Patches
Credits
Huge thanks to @ yoavmmn and @ binki for helping!
Major Changes
Patches
Credits
Huge thanks to @ karenyavine for their help!
Package name: cfenv
-
1.2.4 - 2021-04-07
-
1.2.3 - 2020-07-24
-
1.2.2 - 2019-03-26
from cfenv GitHub release notesNo content.
version 1.2.3
No content.
Package name: consolidate
-
0.16.0 - 2020-09-08
-
0.15.1 - 2018-03-20
-
0.15.0 - 2017-11-01
-
0.14.5 - 2016-11-17
from consolidate GitHub release notesPackage name: dustjs-helpers
-
1.7.4 - 2017-12-09
-
1.7.3 - 2015-07-28
-
1.7.2 - 2015-07-08
-
1.7.1 - 2015-04-29
-
1.7.0 - 2015-04-18
- If a provided key is
-
1.6.3 - 2015-04-13
- Fixes truth tests that were used with a context created from
-
1.6.2 - 2015-03-27
- Bugfixes around
- Fixes #124
- dust.helpers.tap has been deprecated in favor of Context#resolve in Dust >= 2.6.2.
- More info: https://github.com/linkedin/dustjs-helpers/wiki/Deprecated-Features#tap
-
1.6.1 - 2015-03-11
-
1.6.0 - 2015-03-05
-
1.5.0 - 2014-11-20
- #102 Deprecate {@ if} and {@ idx} helpers (@ sethkinast)
- #105 Comparison helpers should still execute when their key parameter is set, but it resolves to undefined. (@ sethkinast)
- #104 Coerce falsy values when a type is specified by a comparison helper. (@ sethkinast)
- #101 Update README and add CHANGELOG (@ sethkinast)
from dustjs-helpers GitHub release notesVersion 1.7.4
Version 1.7.3
Version 1.7.2
Version 1.7.1
Notable Changes
{@ select}New behavior:
keyis no longer required. If it is not provided,keymust be present on individual truth tests inside the select block.typecan be attached to the select to apply it to all truth tests inside (and a truth test can override the type)undefinedand atypeis provided, the undefined value will be cast totype.{@ default}{@ default}has been removed after being deprecated in 1.6.You can replace
{@ default}with{@ none}in your templates without any change in functionality (but you can have more than one{@ none}block, and only one{@ default}was allowed.){@ size}{@ size}will evaluate Dust template strings and provide the size of the result.{@ math}{@ any}and{@ none}now work inside{@ math}blocks.Notable Changes
dust.makeBasein Dust <= 2.6.2 (most commonly seen if you use Adaro)Notable Changes
{@ select}state handling.Version 1.6.1
The helpers can now be included as an AMD module alongside Dust 2.6.0 or newer.
New helpers:
{@ any}, which executes if any truth test in a{@ select}block passes.{@ none}, the opposite{@ first}, executes on the first iteration of a loop{@ last}... you get the ideaRemoved helpers: https://github.com/linkedin/dustjs-helpers/wiki/Deprecated-Features
{@ if}(use other truth test helpers or context helpers instead){@ idx}(use {$idx}, a Dust core built-in, insteadPackage name: errorhandler
-
1.5.1 - 2019-05-09
- deps: accepts@~1.3.7
- deps: mime-types@~2.1.24
- deps: negotiator@0.6.2
-
1.5.0 - 2016-11-16
- Pretty print JSON error response
- deps: accepts@~1.3.3
- deps: mime-types@~2.1.11
- deps: negotiator@0.6.1
- perf: front-load HTML template and stylesheet at middleware construction
- perf: only load template and stylesheet once
- perf: resolve file paths at start up
from errorhandler GitHub release notesPackage name: express-session
-
1.18.0 - 2024-01-28
- Add debug log for pathname mismatch
- Add
- Add
- Fix handling errors from setting cookie
- Support any type in
- deps: cookie@0.6.0
- Fix
- perf: improve default decode speed
- perf: remove slow string split in parse
- deps: cookie-signature@1.0.7
-
1.17.3 - 2022-05-11
- Fix resaving already-saved new session at end of request
- deps: cookie@0.4.2
-
1.17.2 - 2021-05-19
- Fix
- deps: cookie@0.4.1
- deps: safe-buffer@5.2.1
from express-session GitHub release notespartitionedtocookieoptionsprioritytocookieoptionssecretthatcrypto.createHmacsupportsexpiresoption to reject invalid datesres.endpatch to always commit headersPackage name: hbs
-
4.2.0 - 2021-11-17
-
4.1.2 - 2021-04-15
from hbs GitHub release notesv4.2.0
v4.1.2
Package name: jquery
-
3.7.1 - 2023-08-28
-
3.7.0 - 2023-05-11
-
3.6.4 - 2023-03-08
-
3.6.3 - 2022-12-20
-
3.6.2 - 2022-12-13
-
3.6.1 - 2022-08-26
-
3.6.0 - 2021-03-02
-
3.5.1 - 2020-05-04
-
3.5.0 - 2020-04-10
from jquery GitHub release noteshttps://blog.jquery.com/2023/08/28/jquery-3-7-1-released-reliable-table-row-dimensions/
https://blog.jquery.com/2023/05/11/jquery-3-7-0-released-staying-in-order/
https://blog.jquery.com/2023/03/08/jquery-3-6-4-released-selector-forgiveness/
https://blog.jquery.com/2022/12/20/jquery-3-6-3-released-a-quick-selector-fix/
https://blog.jquery.com/2022/12/13/jquery-3-6-2-released/
https://blog.jquery.com/2022/08/26/jquery-3-6-1-maintenance-release/
https://blog.jquery.com/2021/03/02/jquery-3-6-0-released/
3.5.1
Package name: marked
-
4.3.0 - 2023-03-22
- always return promise if async (#2728) (042dcc5)
- fenced code doesn't need a trailing newline (#2756) (3acbb7f)
- add preprocess and postprocess hooks (#2730) (9b452bc)
-
4.2.12 - 2023-01-14
- revert to build script in ci (d2ab474)
-
4.2.11 - 2023-01-14
- just build in version (22ac2cf)
-
4.2.10 - 2023-01-14
- use version (fd759b3)
-
4.2.9 - 2023-01-14
- fix version (96380c3)
-
4.2.8 - 2023-01-14
- build in postversion for build file version (60c3b7f)
-
4.2.7 - 2023-01-14
- fix build file version (94fa76f)
-
4.2.6 - 2023-01-14
- add version to build files (79b8c0b)
-
4.2.5 - 2022-12-23
- fix paragraph continuation after block element (#2686) (1bbda68)
- fix tabs at beginning of list items (#2679) (e692634)
-
4.2.4 - 2022-12-07
- loose list items are loose (#2672) (df4eb0e)
- remove quotes at the end of gfm autolink (#2673) (697ac2a)
- use paragraph token in blockquote in list (#2671) (edc857c)
-
4.2.3 - 2022-11-20
-
4.2.2 - 2022-11-05
-
4.2.1 - 2022-11-02
-
4.2.0 - 2022-10-31
-
4.1.1 - 2022-10-01
-
4.1.0 - 2022-08-30
-
4.0.19 - 2022-08-21
-
4.0.18 - 2022-07-11
-
4.0.17 - 2022-06-13
-
4.0.16 - 2022-05-17
-
4.0.15 - 2022-05-02
-
4.0.14 - 2022-04-11
-
4.0.13 - 2022-04-08
-
4.0.12 - 2022-01-27
-
4.0.11 - 2022-01-26
-
4.0.10 - 2022-01-13
from marked GitHub release notes4.3.0 (2023-03-22)
Bug Fixes
Features
4.2.12 (2023-01-14)
Sorry for all of the quick releases. We were testing out different ways to build the files for releases. v4.2.5 - v4.2.12 have no changes to how marked works. The only addition is the version number in the comment in the build files.
Bug Fixes
4.2.11 (2023-01-14)
Bug Fixes
4.2.10 (2023-01-14)
Bug Fixes
4.2.9 (2023-01-14)
Bug Fixes
4.2.8 (2023-01-14)
Bug Fixes
4.2.7 (2023-01-14)
Bug Fixes
4.2.6 (2023-01-14)
Bug Fixes
4.2.5 (2022-12-23)
Bug Fixes
4.2.4 (2022-12-07)
Bug Fixes
Package name: mongoose
-
5.13.22 - 2024-01-02
-
5.13.21 - 2023-10-19
-
5.13.20 - 2023-07-12
from mongoose GitHub release notesPackage name: stream-buffers
-
3.0.3 - 2024-06-17
-
3.0.2 - 2018-05-21
from stream-buffers GitHub release notes3.0.3
3.0.2
Package name: typeorm
Bug Fixes
Features
Reverts
Bug Fixes
Cannot read properties of undefined (reading 'sync')caused after glob package upgradeBug Fixes