Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Snyk] Upgrade: , , , cookie-session, express, express-validator, mongoose, stripe, typescript #113

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade: , , , cookie-session, express, express-validator, mongoose, stripe, typescript #113

wants to merge 1 commit into from

Conversation

AlexanderSCK
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

@types/express
from 4.17.13 to 4.17.21 | 8 versions ahead of your current version | 10 months ago
on 2023-11-07
@types/cookie-session
from 2.0.44 to 2.0.49 | 5 versions ahead of your current version | 5 months ago
on 2024-04-17
@types/jsonwebtoken
from 8.5.8 to 8.5.9 | 1 version ahead of your current version | 2 years ago
on 2022-08-24
cookie-session
from 2.0.0 to 2.1.0 | 1 version ahead of your current version | 8 months ago
on 2024-01-24
express
from 4.18.1 to 4.19.2 | 5 versions ahead of your current version | 6 months ago
on 2024-03-25
express-validator
from 6.14.0 to 6.15.0 | 4 versions ahead of your current version | 2 years ago
on 2023-02-16
mongoose
from 8.0.0 to 8.5.4 | 30 versions ahead of your current version | 22 days ago
on 2024-08-23
stripe
from 9.1.0 to 9.16.0 | 18 versions ahead of your current version | 2 years ago
on 2022-07-26
typescript
from 4.6.4 to 4.9.5 | 259 versions ahead of your current version | 2 years ago
on 2023-01-30

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509		 519 No Known Exploit
Release notes
Package name: @types/express
  • 4.17.21 - 2023-11-07
  • 4.17.20 - 2023-10-18
  • 4.17.19 - 2023-10-10
  • 4.17.18 - 2023-09-23
  • 4.17.17 - 2023-02-03
  • 4.17.16 - 2023-01-23
  • 4.17.15 - 2022-12-13
  • 4.17.14 - 2022-09-13
  • 4.17.13 - 2021-07-06
from @types/express GitHub release notes
Package name: @types/cookie-session
  • 2.0.49 - 2024-04-17
  • 2.0.48 - 2023-11-20
  • 2.0.47 - 2023-11-07
  • 2.0.46 - 2023-10-18
  • 2.0.45 - 2023-09-04
  • 2.0.44 - 2021-12-23
from @types/cookie-session GitHub release notes
Package name: @types/jsonwebtoken
  • 8.5.9 - 2022-08-24
  • 8.5.8 - 2022-01-17
from @types/jsonwebtoken GitHub release notes
Package name: cookie-session
  • 2.1.0 - 2024-01-24
    • Fix loading sessions with special keys
    • deps: cookies@0.9.1
      • Add partitioned option for CHIPS support
      • Add priority option for Priority cookie support
      • Fix accidental cookie name/value truncation when given invalid chars
      • Fix maxAge option to reject invalid values
      • Remove quotes from returned quoted cookie value
      • Use req.socket over deprecated req.connection
      • pref: small lookup regexp optimization
  • 2.0.0 - 2021-12-16
    • Change default cookie name to session
    • Change .populated to .isPopulated
    • Create new session for all types of invalid sessions
    • Drop support for Node.js 0.8
    • Remove private req.session.save()
    • Remove the key option; use name instead
    • Remove undocumented req.session.length to free up key name
    • Remove undocumented req.sessionCookies and req.sessionKey
    • Save all enumerable properties on req.session
      • Including _-prefixed properties
    • Use Object.defineProperty instead of deprecated __define*__
    • Use safe-buffer for improved Buffer API
    • deps: cookies@0.8.0
      • Fix check for default secure option behavior
      • Fix maxAge option preventing cookie deletion
      • Support "none" in sameSite option
      • deps: depd@~2.0.0
      • deps: keygrip@~1.1.0
      • perf: remove argument reassignment
    • deps: debug@3.2.7
      • Add DEBUG_HIDE_DATE
      • Add 256 color mode support
      • Enable / disable namespaces dynamically
      • Make millisecond timer namespace-specific
      • Remove DEBUG_FD support
      • Use Date#toISOString() when output is not a TTY
    • deps: on-headers@~1.0.2
      • Fix res.writeHead patch missing return value
    • deps: safe-buffer@5.2.1
    • perf: reduce the scope of try-catch deopt
    • perf: remove internal reference to request from session object
from cookie-session GitHub release notes
Package name: express from express GitHub release notes
Package name: express-validator from express-validator GitHub release notes
Package name: mongoose
  • 8.5.4 - 2024-08-23

    8.5.4 / 2024-08-23

    • fix: add empty string check for collection name passed #14806 Shubham2552
    • docs(model): add 'throw' as valid strict value for bulkWrite() and add some more clarification on throwOnValidationError #14809
  • 8.5.3 - 2024-08-13

    8.5.3 / 2024-08-13

    • fix(document): call required functions on subdocuments underneath nested paths with correct context #14801 #14788
    • fix(populate): avoid throwing error when no result and lean() set #14799 #14794 #14759 MohOraby
    • fix(document): apply virtuals to subdocuments if parent schema has virtuals: true for backwards compatibility #14774 #14771 #14623 #14394
    • types: make HydratedSingleSubdocument and HydratedArraySubdocument merge types instead of using & #14800 #14793
    • types: support schema type inference based on schema options timestamps as well #14773 #13215 ark23CIS
    • types(cursor): indicate that cursor.next() can return null #14798 #14787
    • types: allow mongoose.connection.db to be undefined #14797 #14789
    • docs: add schema type widening advice #14790 JstnMcBrd
  • 8.5.2 - 2024-07-30

    8.5.2 / 2024-07-30

    • perf(clone): avoid further unnecessary checks if cloning a primitive value #14762 #14394
    • fix: allow setting document array default to null #14769 #14717 #6691
    • fix(model): support session: null option for save() to opt out of automatic session option with transactionAsyncLocalStorage #14744 #14736
    • fix(model+document): avoid depopulating manually populated doc as getter value #14760 #14759
    • fix: correct shardkey access in buildBulkWriteOps #14753 #14752 adf0nt3s
    • fix(query): handle casting $switch in $expr #14755 #14751
    • types: allow calling SchemaType.cast() without parent and init parameters #14756 #14748 #9076
    • docs: fix a wrong example in v6 migration guide #14758 abdelrahman-elkady
  • 8.5.1 - 2024-07-12
  • 8.5.0 - 2024-07-08
  • 8.4.5 - 2024-07-05
  • 8.4.4 - 2024-06-25
  • 8.4.3 - 2024-06-17
  • 8.4.2 - 2024-06-17
  • 8.4.1 - 2024-05-31
  • 8.4.0 - 2024-05-17
  • 8.3.5 - 2024-05-15
  • 8.3.4 - 2024-05-06
  • 8.3.3 - 2024-04-29
  • 8.3.2 - 2024-04-16
  • 8.3.1 - 2024-04-08
  • 8.3.0 - 2024-04-03
  • 8.2.4 - 2024-03-28
  • 8.2.3 - 2024-03-21
  • 8.2.2 - 2024-03-15
  • 8.2.1 - 2024-03-04
  • 8.2.0 - 2024-02-22
  • 8.1.3 - 2024-02-16
  • 8.1.2 - 2024-02-11
  • 8.1.1 - 2024-01-24
  • 8.1.0 - 2024-01-16
  • 8.0.4 - 2024-01-09
  • 8.0.3 - 2023-12-07
  • 8.0.2 - 2023-11-28
  • 8.0.1 - 2023-11-15
  • 8.0.0 - 2023-10-31
from

@snyk-bot
fix: upgrade multiple dependencies with Snyk
817340b 
Snyk has created this PR to upgrade:
  - @types/express from 4.17.13 to 4.17.21.
    See this package in npm: https://www.npmjs.com/package/@types/express
  - @types/cookie-session from 2.0.44 to 2.0.49.
    See this package in npm: https://www.npmjs.com/package/@types/cookie-session
  - @types/jsonwebtoken from 8.5.8 to 8.5.9.
    See this package in npm: https://www.npmjs.com/package/@types/jsonwebtoken
  - cookie-session from 2.0.0 to 2.1.0.
    See this package in npm: https://www.npmjs.com/package/cookie-session
  - express from 4.18.1 to 4.19.2.
    See this package in npm: https://www.npmjs.com/package/express
  - express-validator from 6.14.0 to 6.15.0.
    See this package in npm: https://www.npmjs.com/package/express-validator
  - mongoose from 8.0.0 to 8.5.4.
    See this package in npm: https://www.npmjs.com/package/mongoose
  - stripe from 9.1.0 to 9.16.0.
    See this package in npm: https://www.npmjs.com/package/stripe
  - typescript from 4.6.4 to 4.9.5.
    See this package in npm: https://www.npmjs.com/package/typescript

See this project in Snyk:
https://app.snyk.io/org/alexandersck/project/715ad775-9d02-4d91-afe3-c1ae2df048e6?utm_source=github&utm_medium=referral&page=upgrade-pr
# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@AlexanderSCK @snyk-bot