[Snyk] Upgrade: , bcrypt, dotenv, express, helmet, sequelize, sqlite3, swagger-ui-express #80

Allo3 · 2024-09-18T11:07:09Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@fortawesome/fontawesome-svg-core
from 6.3.0 to 6.6.0 | 6 versions ahead of your current version | 2 months ago
on 2024-07-16
bcrypt
from 5.0.1 to 5.1.1 | 2 versions ahead of your current version | a year ago
on 2023-08-16
dotenv
from 16.0.0 to 16.4.5 | 20 versions ahead of your current version | 7 months ago
on 2024-02-20
express
from 4.18.0 to 4.19.2 | 6 versions ahead of your current version | 6 months ago
on 2024-03-25
helmet
from 5.0.2 to 5.1.1 | 2 versions ahead of your current version | 2 years ago
on 2022-07-23
sequelize
from 6.19.0 to 6.37.3 | 50 versions ahead of your current version | 5 months ago
on 2024-04-13
sqlite3
from 5.0.5 to 5.1.7 | 15 versions ahead of your current version | 8 months ago
on 2024-01-05
swagger-ui-express
from 4.3.0 to 4.6.3 | 6 versions ahead of your current version | a year ago
on 2023-05-05

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Prototype Pollution SNYK-JS-DOTTIE-3332763	696	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	696	Proof of Concept
Improper Filtering of Special Elements SNYK-JS-SEQUELIZE-3324088	696	No Known Exploit
Arbitrary Code Execution SNYK-JS-SQLITE3-3358947	696	No Known Exploit
SQL Injection SNYK-JS-SEQUELIZE-2959225	696	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	696	No Known Exploit
Information Exposure SNYK-JS-SEQUELIZE-3324089	696	No Known Exploit
Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-SEQUELIZE-3324090	696	No Known Exploit
SQL Injection SNYK-JS-SEQUELIZE-2932027	696	Proof of Concept

Release notes

Package name: @fortawesome/fontawesome-svg-core

6.6.0 - 2024-07-16
Change log available at https://fontawesome.com/docs/changelog/
6.5.2 - 2024-04-02
Change log available at https://fontawesome.com/docs/changelog/
6.5.1 - 2023-11-30
Change log available at https://fontawesome.com/docs/changelog/
6.5.0 - 2023-11-28
Change log available at https://fontawesome.com/docs/changelog/
6.4.2 - 2023-08-02
Change log available at https://fontawesome.com/docs/changelog/
6.4.0 - 2023-03-27
Change log available at https://fontawesome.com/docs/changelog/
6.3.0 - 2023-02-07
Change log available at https://fontawesome.com/docs/changelog/

from @fortawesome/fontawesome-svg-core GitHub release notes

Package name: bcrypt

5.1.1 - 2023-08-16
What's Changed
- Refactored example with async await by @ lpizzinidev in #894
- Fixed z/OS build issue by @ laijonathan in #968
- Update dependencies by @ recrsn in #993
New Contributors
- @ lpizzinidev made their first contribution in #894
- @ laijonathan made their first contribution in #968
Full Changelog: v5.1.0...v5.1.1
5.1.0 - 2022-10-06
What's Changed
- Update node-pre-gyp to 1.0.2 by @ feuxfollets1013 in #865
- Update README for inclusion of musl by @ arbourd in #883
- Version bump, security updates to sub dep npmlog by @ adaniels-parabol in #905
- document ESM usage (#892) by @ mariusa in #899
- fix: update travis CI Docker image repository by @ cokia in #930
- Update node versions in appveyor test matrix by @ p-kuen in #936
- chore(appveyor): not use latest npm by @ cokia in #932
- chore: update Appveyor readme badge by @ cokia in #933
- Use Github actions for CI by @ recrsn in #858
- Update dependencies by @ recrsn in #953
- Migrate tests to use Jest by @ recrsn in #958
- Pin NAPI to v3 by @ recrsn in #959
New Contributors
- @ feuxfollets1013 made their first contribution in #865
- @ arbourd made their first contribution in #883
- @ adaniels-parabol made their first contribution in #905
- @ mariusa made their first contribution in #899
- @ cokia made their first contribution in #930
- @ p-kuen made their first contribution in #936
Full Changelog: v5.0.1...v5.1.0
5.0.1 - 2021-02-26
Update node-pre-gyp to 1.0.0

from bcrypt GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: body-parser@1.20.2
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: raw-body@2.5.2
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: Node.js@16.18 and Node.js@18.12 by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add Node.js@19.7 by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: body-parser@1.20.1
  - deps: qs@6.11.0
  - perf: remove unnecessary object clone
- deps: qs@6.11.0
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: body-parser@1.20.0
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: depd@2.0.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: qs@6.10.3
  - deps: raw-body@2.5.1
- deps: cookie@0.5.0
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: finalhandler@1.2.0
  - Remove set content headers that break response
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
  - Prevent loss of async hooks context
- deps: qs@6.10.3
- deps: send@0.18.0
  - Fix emitted 416 error missing headers property
  - Limit the headers removed for 304 response
  - deps: depd@2.0.0
  - deps: destroy@1.2.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: serve-static@1.15.0
  - deps: send@0.18.0
- deps: statuses@2.0.1
  - Remove code 306
  - Rename 425 Unordered Collection to standard 425 Too Early

from express GitHub release notes

Package name: helmet

5.1.1 - 2022-07-23
5.1.1
5.1.0 - 2022-05-17
5.1.0
5.0.2 - 2022-01-22
5.0.2

from helmet GitHub release notes

Package name: sequelize

6.37.3 - 2024-04-13
6.37.3 (2024-04-13)

Bug Fixes
- postgres: use schema for foreign key constrains of a table (#17099) (6aba382)
6.37.2 - 2024-03-29
6.37.2 (2024-03-29)

Bug Fixes
- add readOnly to the transaction options types and docs (#17226) (7c8972f)
6.37.1 - 2024-02-18
6.37.1 (2024-02-18)

Bug Fixes
- types: Add definition of returning in SaveOptions. (#16954) (505467b)
6.37.0 - 2024-02-11
6.37.0 (2024-02-11)

Features
- postgres: support connectionTimeoutMillis dialectOption (#14119) (e81200e)
6.36.0 - 2024-02-02
6.35.2 - 2023-12-11
6.35.1 - 2023-11-19
6.35.0 - 2023-11-12
6.34.0 - 2023-11-03
6.33.0 - 2023-09-08
6.32.1 - 2023-06-17
6.32.0 - 2023-06-01
6.31.1 - 2023-05-01
6.31.0 - 2023-04-09
6.30.0 - 2023-03-24
6.29.3 - 2023-03-10
6.29.2 - 2023-03-09
6.29.1 - 2023-03-07
6.29.0 - 2023-02-23
6.28.2 - 2023-02-22
6.28.1 - 2023-02-21
6.28.0 - 2022-12-20
6.27.0 - 2022-12-12
6.26.0 - 2022-11-29
6.25.8 - 2022-11-22
6.25.7 - 2022-11-19
6.25.6 - 2022-11-15
6.25.5 - 2022-11-07
6.25.4 - 2022-11-05
6.25.3 - 2022-10-19
6.25.2 - 2022-10-15
6.25.1 - 2022-10-13
6.25.0 - 2022-10-11
6.24.0 - 2022-10-04
6.23.2 - 2022-09-27
6.23.1 - 2022-09-22
6.23.0 - 2022-09-17
6.22.1 - 2022-09-16
6.22.0 - 2022-09-15
6.21.6 - 2022-09-09
6.21.5 - 2022-09-08
6.21.4 - 2022-08-18
6.21.3 - 2022-07-11
6.21.2 - 2022-06-28
6.21.1 - 2022-06-25
6.21.0 - 2022-06-16
6.20.1 - 2022-05-27
6.20.0 - 2022-05-23
6.19.2 - 2022-05-18
6.19.1 - 2022-05-17
6.19.0 - 2022-04-12

from sequelize GitHub release notes

Package name: sqlite3

5.1.7 - 2024-01-05
What's Changed
- Updated bundled SQLite to v3.44.2 by @ daniellockyer
- Replaced @ mapbox/node-pre-gyp with prebuild + prebuild-install (605c7f9) by @ daniellockyer
  - this should fix a lot of bundling issues reported by the community
- Improved RowToJS performance by removing Napi::String::New instantiation by @ daniellockyer
- Various minor code refactors and improvements (thanks @ zenon8adams!)
New Contributors
- @ zenon8adams made their first contribution in #1701
Full Changelog: v5.1.6...v5.1.7
5.1.7-rc.0 - 2023-12-29
Please install v5.1.7 instead.

Full Changelog: v5.1.6...v5.1.7-rc.0
5.1.6 - 2023-03-14
What's Changed
- Fixed glibc compatibility by hardcoding lower version for log2 by @ daniellockyer
- Add generic type annotations for Statement and Database get/all/each methods callback rows by @ stevescruz in #1686
New Contributors
- @ stevescruz made their first contribution in #1686
Full Changelog: v5.1.5...v5.1.6
5.1.5 - 2023-03-13
What's Changed
- 🔒 Fixed code execution vulnerability due to Object coercion by @ daniellockyer
- Updated bundled SQLite to v3.41.1 by @ daniellockyer
- Fixed rpath linker option when using a custom sqlite by @ jeromew in #1654
Full Changelog: v5.1.4...v5.1.5
5.1.4 - 2022-12-12
What's Changed
- Fixed glibc compatibility by downgrading CI to Ubuntu 20 by @ daniellockyer in #1664
Full Changelog:

Snyk has created this PR to upgrade: - @fortawesome/fontawesome-svg-core from 6.3.0 to 6.6.0. See this package in npm: https://www.npmjs.com/package/@fortawesome/fontawesome-svg-core - bcrypt from 5.0.1 to 5.1.1. See this package in npm: https://www.npmjs.com/package/bcrypt - dotenv from 16.0.0 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - express from 4.18.0 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - helmet from 5.0.2 to 5.1.1. See this package in npm: https://www.npmjs.com/package/helmet - sequelize from 6.19.0 to 6.37.3. See this package in npm: https://www.npmjs.com/package/sequelize - sqlite3 from 5.0.5 to 5.1.7. See this package in npm: https://www.npmjs.com/package/sqlite3 - swagger-ui-express from 4.3.0 to 4.6.3. See this package in npm: https://www.npmjs.com/package/swagger-ui-express See this project in Snyk: https://app.snyk.io/org/allo3/project/2f6f4b1f-984e-434b-811a-8d5e003e62c9?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: , bcrypt, dotenv, express, helmet, sequelize, sqlite3, swagger-ui-express #80

[Snyk] Upgrade: , bcrypt, dotenv, express, helmet, sequelize, sqlite3, swagger-ui-express #80

Allo3 commented Sep 18, 2024

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

6.37.3 (2024-04-13)

Bug Fixes

6.37.2 (2024-03-29)

Bug Fixes

6.37.1 (2024-02-18)

Bug Fixes

6.37.0 (2024-02-11)

Features

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

[Snyk] Upgrade: , bcrypt, dotenv, express, helmet, sequelize, sqlite3, swagger-ui-express #80

Are you sure you want to change the base?

[Snyk] Upgrade: , bcrypt, dotenv, express, helmet, sequelize, sqlite3, swagger-ui-express #80

Conversation

Allo3 commented Sep 18, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

6.37.3 (2024-04-13)

Bug Fixes

6.37.2 (2024-03-29)

Bug Fixes

6.37.1 (2024-02-18)

Bug Fixes

6.37.0 (2024-02-11)

Features

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed