[Snyk] Upgrade: , , axios, body-parser, dotenv, express, nodemon, tslint, typescript #40

WontonSam · 2024-09-19T19:12:52Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Name	Versions	Released on

@types/express
from 4.17.0 to 4.17.21 | 21 versions ahead of your current version | 10 months ago
on 2023-11-07
@xboxreplay/xboxlive-auth
from 1.0.1 to 4.0.0 | 17 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 3 years ago
on 2021-07-26
axios
from 0.19.0 to 1.7.5 | 62 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | a month ago
on 2024-08-23
body-parser
from 1.19.0 to 1.20.2 | 5 versions ahead of your current version | 2 years ago
on 2023-02-22
dotenv
from 8.0.0 to 16.4.5 | 50 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 7 months ago
on 2024-02-20
express
from 4.17.1 to 4.19.2 | 9 versions ahead of your current version | 6 months ago
on 2024-03-25
nodemon
from 1.19.1 to 3.1.4 | 48 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 3 months ago
on 2024-06-20
tslint
from 5.18.0 to 5.20.1 | 3 versions ahead of your current version | 5 years ago
on 2019-11-05
typescript
from 3.5.3 to 5.5.4 | 1793 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 2 months ago
on 2024-07-22

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Prototype Pollution SNYK-JS-AJV-584908	165	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	165	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	165	Proof of Concept
Asymmetric Resource Consumption (Amplification) SNYK-JS-BODYPARSER-7926860	165	No Known Exploit
Uncontrolled resource consumption SNYK-JS-BRACES-6838727	165	Proof of Concept
Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	165	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-1579269	165	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-1579269	165	Proof of Concept
Improper Input Validation SNYK-JS-FOLLOWREDIRECTS-6141137	165	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	165	Proof of Concept
Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	165	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	165	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	165	No Known Exploit
Prototype Poisoning SNYK-JS-QS-3153490	165	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	165	Proof of Concept
Arbitrary File Write SNYK-JS-TAR-1579147	165	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	165	No Known Exploit
Prototype Pollution SNYK-JS-UNSETVALUE-2400660	165	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	165	No Known Exploit
Improper Input Validation SNYK-JS-FOLLOWREDIRECTS-6141137	165	Proof of Concept
Prototype Pollution SNYK-JS-INI-1048974	165	Proof of Concept
Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	165	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	165	Proof of Concept
Prototype Pollution SNYK-JS-DOTPROP-543489	165	Proof of Concept
Open Redirect SNYK-JS-EXPRESS-6474509	165	No Known Exploit
Cross-site Scripting SNYK-JS-EXPRESS-7926867	165	No Known Exploit
Information Exposure SNYK-JS-FOLLOWREDIRECTS-2332181	165	Proof of Concept
Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	165	Proof of Concept
Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	165	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	165	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-559764	165	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-559764	165	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	165	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	165	Proof of Concept
Information Exposure SNYK-JS-FOLLOWREDIRECTS-2332181	165	Proof of Concept
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	165	Proof of Concept
Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	165	Proof of Concept
Prototype Pollution SNYK-JS-UNDEFSAFE-548940	165	Proof of Concept
Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	165	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	165	Proof of Concept
Open Redirect SNYK-JS-GOT-2932019	165	No Known Exploit
Information Exposure SNYK-JS-FOLLOWREDIRECTS-2396346	165	No Known Exploit
Cross-site Scripting SNYK-JS-SEND-7926862	165	No Known Exploit
Cross-site Scripting SNYK-JS-SERVESTATIC-7926865	165	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	165	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-2429795	165	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	165	No Known Exploit
Information Exposure SNYK-JS-FOLLOWREDIRECTS-2396346	165	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:debug:20170905	165	Proof of Concept
Regular Expression Denial of Service (ReDoS) npm:debug:20170905	165	Proof of Concept
Validation Bypass SNYK-JS-KINDOF-537849	165	Proof of Concept

Release notes

Package name: @types/express

4.17.21 - 2023-11-07
4.17.20 - 2023-10-18
4.17.19 - 2023-10-10
4.17.18 - 2023-09-23
4.17.17 - 2023-02-03
4.17.16 - 2023-01-23
4.17.15 - 2022-12-13
4.17.14 - 2022-09-13
4.17.13 - 2021-07-06
4.17.12 - 2021-05-25
4.17.11 - 2021-01-12
4.17.10 - 2021-01-11
4.17.9 - 2020-11-11
4.17.8 - 2020-09-01
4.17.7 - 2020-07-06
4.17.6 - 2020-04-09
4.17.5 - 2020-04-08
4.17.4 - 2020-03-31
4.17.3 - 2020-03-03
4.17.2 - 2019-11-01
4.17.1 - 2019-08-19
4.17.0 - 2019-06-04

from @types/express GitHub release notes

Package name: @xboxreplay/xboxlive-auth

4.0.0 - 2021-07-26
- Updated documentation
- OAuth2.0 support
- Experimental "device token" generation
- Electron usage example
- Bug fixes and workarounds for known issues
4.0.0-beta.5 - 2021-02-25
4.0.0-beta.4 - 2021-02-21
4.0.0-beta.3 - 2021-02-19
4.0.0-beta.2 - 2021-02-19
4.0.0-beta.1 - 2021-01-17
4.0.0-beta.0 - 2021-01-16
3.3.3 - 2021-01-08
Merge pull request #12 from XboxReplay/hoxfix_missing_build

Bump to 3.3.3
3.3.2 - 2021-01-08
3.3.1 - 2021-01-08
No content.
3.3.0 - 2020-04-12
3.1.1 - 2020-04-12
3.0.2 - 2020-04-11
3.0.1 - 2020-04-10
- Removed request dependency (deprecated)
- Updated tests (e2e)
- Improved types
- Reworked logic and structure
2.2.0 - 2019-08-14
No content.
2.0.1 - 2019-08-14
2.0.0 - 2019-08-11
Merge pull request #5 from XboxReplay/handle-additional-errors

2.0.0 - Handle additional error cases w/ additional infos
1.0.1 - 2019-07-31
No content.

from @xboxreplay/xboxlive-auth GitHub release notes

Package name: axios

1.7.5 - 2024-08-23
Release notes:

Bug Fixes
- adapter: fix undefined reference to hasBrowserEnv (#6572) (7004707)
- core: add the missed implementation of AxiosError#status property; (#6573) (6700a8a)
- core: fix ReferenceError: navigator is not defined for custom environments; (#6567) (fed1a4b)
- fetch: fix credentials handling in Cloudflare workers (#6533) (550d885)
Contributors to this release
- Dmitriy Mozgovoy
- Antonin Bas
- Hans Otto Wirtz
1.7.4 - 2024-08-13
Release notes:

Bug Fixes
- sec: CVE-2024-39338 (#6539) (#6543) (6b6b605)
- sec: disregard protocol-relative URL to remediate SSRF (#6539) (07a661a)
Contributors to this release
- Lev Pachmanov
- Đỗ Trọng Hải
1.7.3 - 2024-08-01
Release notes:

Bug Fixes
- adapter: fix progress event emitting; (#6518) (e3c76fc)
- fetch: fix withCredentials request config (#6505) (85d4d0e)
- xhr: return original config on errors from XHR adapter (#6515) (8966ee7)
Contributors to this release
- Dmitriy Mozgovoy
- Valerii Sidorenko
- prianYu
1.7.2 - 2024-05-21
Release notes:

Bug Fixes
- fetch: enhance fetch API detection; (#6413) (4f79aef)
Contributors to this release
- Dmitriy Mozgovoy
1.7.1 - 2024-05-20
Release notes:

Bug Fixes
- fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#6410) (733f15f)
Contributors to this release
- Dmitriy Mozgovoy
1.7.0 - 2024-05-19
Release notes:

Features
- adapter: add fetch adapter; (#6371) (a3ff99b)
Bug Fixes
- core/axios: handle un-writable error stack (#6362) (81e0455)
Contributors to this release
- Dmitriy Mozgovoy
- Jay
- Alexandre ABRIOUX
1.7.0-beta.2 - 2024-05-19
Release notes:

Bug Fixes
- fetch: capitalize HTTP method names; (#6395) (ad3174a)
- fetch: fix & optimize progress capturing for cases when the request data has a nullish value or zero data length (#6400) (95a3e8e)
- fetch: fix headers getting from a stream response; (#6401) (870e0a7)
Contributors to this release
- Dmitriy Mozgovoy
1.7.0-beta.1 - 2024-05-07
Release notes:

Bug Fixes
- core/axios: handle un-writable error stack (#6362) (81e0455)
- fetch: fix cases when ReadableStream or Response.body are not available; (#6377) (d1d359d)
- fetch: treat fetch-related TypeError as an AxiosError.ERR_NETWORK error; (#6380) (bb5f9a5)
Contributors to this release
- Alexandre ABRIOUX
- Dmitriy Mozgovoy
Install
```
npm i axios@next
```
1.7.0-beta.0 - 2024-04-28
Release notes:

Features
- adapter: add fetch adapter; (#6371) (a3ff99b)
Contributors to this release
- Dmitriy Mozgovoy
- Jay
Install
```
npm i axios@next
```
1.6.8 - 2024-03-15
1.6.7 - 2024-01-25
1.6.6 - 2024-01-24
1.6.5 - 2024-01-05
1.6.4 - 2024-01-03
1.6.3 - 2023-12-26
1.6.2 - 2023-11-14
1.6.1 - 2023-11-08
1.6.0 - 2023-10-26
1.5.1 - 2023-09-26
1.5.0 - 2023-08-26
1.4.0 - 2023-04-27
1.3.6 - 2023-04-19
1.3.5 - 2023-04-05
1.3.4 - 2023-02-22
1.3.3 - 2023-02-13
1.3.2 - 2023-02-03
1.3.1 - 2023-02-01
1.3.0 - 2023-01-31
1.2.6 - 2023-01-28
1.2.5 - 2023-01-26
1.2.4 - 2023-01-24
1.2.3 - 2023-01-17
1.2.2 - 2022-12-29
1.2.1 - 2022-12-05
1.2.0 - 2022-11-22
1.2.0-alpha.1 - 2022-11-10
1.1.3 - 2022-10-15
1.1.2 - 2022-10-07
1.1.1 - 2022-10-07
1.1.0 - 2022-10-06
1.0.0 - 2022-10-04
1.0.0-alpha.1 - 2022-05-31
0.28.1 - 2024-03-28
Release notes:

Release notes:

Bug Fixes
- fix(backport): custom params serializer support (#6263)
- fix(backport): uncaught ReferenceError req is not defined (#6307)
0.28.0 - 2024-02-12
0.27.2 - 2022-04-27
0.27.1 - 2022-04-26
0.27.0 - 2022-04-25
0.26.1 - 2022-03-09
0.26.0 - 2022-02-13
0.25.0 - 2022-01-18
0.24.0 - 2021-10-25
0.23.0 - 2021-10-12
0.22.0 - 2021-10-01
0.21.4 - 2021-09-06
0.21.3 - 2021-09-04
0.21.2 - 2021-09-04
0.21.1 - 2020-12-22
0.21.0 - 2020-10-23
0.20.0 - 2020-08-21
0.20.0-0 - 2020-07-15
0.19.2 - 2020-01-22
0.19.1 - 2020-01-07
0.19.0 - 2019-05-30

from axios GitHub release notes

Package name: body-parser

1.20.2 - 2023-02-22
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
  - perf: skip value escaping when unnecessary
- deps: raw-body@2.5.2
1.20.1 - 2022-10-06
- deps: qs@6.11.0
- perf: remove unnecessary object clone
1.20.0 - 2022-04-03
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: http-errors@2.0.0
  - deps: depd@2.0.0
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
- deps: qs@6.10.3
- deps: raw-body@2.5.1
  - deps: http-errors@2.0.0
1.19.2 - 2022-02-16
- deps: bytes@3.1.2
- deps: qs@6.9.7
  - Fix handling of __proto__ keys
- deps: raw-body@2.4.3
  - deps: bytes@3.1.2
1.19.1 - 2021-12-10
- deps: bytes@3.1.1
- deps: http-errors@1.8.1
  - deps: inherits@2.0.4
  - deps: toidentifier@1.0.1
  - deps: setprototypeof@1.2.0
- deps: qs@6.9.6
- deps: raw-body@2.4.2
  - deps: bytes@3.1.1
  - deps: http-errors@1.8.1
- deps: safe-buffer@5.2.1
- deps: type-is@~1.6.18
1.19.0 - 2019-04-26
- deps: bytes@3.1.0
  - Add petabyte (pb) support
- deps: http-errors@1.7.2
  - Set constructor name when possible
  - deps: setprototypeof@1.1.1
  - deps: statuses@'>= 1.5.0 < 2'
- deps: iconv-lite@0.4.24
  - Added encoding MIK
- deps: qs@6.7.0
  - Fix parsing array brackets after index
- deps: raw-body@2.4.0
  - deps: bytes@3.1.0
  - deps: http-errors@1.7.2
  - deps: iconv-lite@0.4.24
- deps: type-is@~1.6.17
  - deps: mime-types@~2.1.24
  - perf: prevent internal throw on invalid type

from body-parser GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: body-parser@1.20.2
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: raw-body@2.5.2
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: Node.js@16.18 and Node.js@18.12 by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add Node.js@19.7 by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032

Snyk has created this PR to upgrade: - @types/express from 4.17.0 to 4.17.21. See this package in npm: https://www.npmjs.com/package/@types/express - @xboxreplay/xboxlive-auth from 1.0.1 to 4.0.0. See this package in npm: https://www.npmjs.com/package/@xboxreplay/xboxlive-auth - axios from 0.19.0 to 1.7.5. See this package in npm: https://www.npmjs.com/package/axios - body-parser from 1.19.0 to 1.20.2. See this package in npm: https://www.npmjs.com/package/body-parser - dotenv from 8.0.0 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - express from 4.17.1 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - nodemon from 1.19.1 to 3.1.4. See this package in npm: https://www.npmjs.com/package/nodemon - tslint from 5.18.0 to 5.20.1. See this package in npm: https://www.npmjs.com/package/tslint - typescript from 3.5.3 to 5.5.4. See this package in npm: https://www.npmjs.com/package/typescript See this project in Snyk: https://app.snyk.io/org/cachiman/project/eb53fe3c-9f44-4f52-bcad-b9b3193111b5?utm_source=github&utm_medium=referral&page=upgrade-pr

google-cla · 2024-09-19T19:12:56Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Snyk] Upgrade: , , axios, body-parser, dotenv, express, nodemon, tslint, typescript #40

Are you sure you want to change the base?

[Snyk] Upgrade: , , axios, body-parser, dotenv, express, nodemon, tslint, typescript #40

Conversation

WontonSam commented Sep 19, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Features

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Install

Release notes:

Features

Contributors to this release

Install

Release notes:

Release notes:

Bug Fixes

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

google-cla bot commented Sep 19, 2024