[Snyk] Fix for 1 vulnerabilities

[apmarshall]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-QS-3153490	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: express

The new version differs by 250 commits.

• 3d7fce5 4.17.3
• f906371 build: update example dependencies
• 6381bc6 deps: qs@6.9.7
• a007863 deps: body-parser@1.19.2
• e98f584 Revert "build: use minimatch@3.0.4 for Node.js < 4"
• a659137 tests: use strict mode
• a39e409 tests: prevent leaking changes to NODE_ENV
• 82de4de examples: fix path traversal in downloads example
• 12310c5 build: use nyc for test coverage
• 884657d examples: remove bitwise syntax for includes check
• 7511d08 build: use minimatch@3.0.4 for Node.js < 4
• 2585f20 tests: fix test missing assertion
• 9d09762 build: supertest@6.2.2
• 43cc56e build: clean up gitignore
• 1c7bbcc build: Node.js@14.19
• 9cbbc8a deps: cookie@0.4.2
• 6fbc269 pref: remove unnecessary regexp for trust proxy
• 2bc734a deps: accepts@~1.3.8
• 89bb531 docs: fix typo in res.download jsdoc
• 744564f tests: add test for multiple ips in "trust proxy"
• da6cb0e tests: add range tests to res.download
• 00ad5be tests: add more tests for app.request & app.response
• 141914e tests: fix tests that did not bubble errors
• bd4fdfe tests: remove global dependency on should

See the full diff

Package name: qs

The new version differs by 118 commits.

• 90d9f2b v6.2.4
• ba24e74 [Fix] `parse`: ignore `__proto__` keys (Add a small Calypso banner on top of the HTML Automattic/wp-calypso#428)
• f047c9d [Dev Deps] backport from main
• 5f8e28b [actions] backport actions from main
• 2c38654 [Robustness] `stringify`: avoid relying on a global `undefined` (Docs: add "components.md" documentation. Automattic/wp-calypso#427)
• 37e176d [meta] fix README.md (Me: Updating password unselects Password nav item Automattic/wp-calypso#399)
• 081a3ab [Tests] use `safer-buffer` instead of `Buffer` constructor
• 943e411 [meta] Clean up license text so it’s properly detected as BSD-3-Clause
• 0d82916 [Fix] `utils.merge`: avoid a crash with a null target and an array source
• c103b90 [Fix]` `utils.merge`: avoid a crash with a null target and a truthy non-array source
• 563588d [Refactor] use cached `Array.isArray`
• 39a11bc [Docs] Clarify the need for "arrayLimit" option
• 4c8dcaf [Fix] `utils`: `merge`: fix crash when `source` is a truthy primitive & no options are provided
• 42de207 [Tests] remove nonexistent tape option
• 1b7c83e [meta] add FUNDING.yml
• d828941 [Fix] when `parseArrays` is false, properly handle keys ending in `[]`
• 1fb74cb v6.2.3
• eb2e3a5 [Tests] up to `node` `v7.7`, `v6.10`,` v4.8`; disable osx builds since they block linux builds.
• 1c045ca [Fix] support keys starting with brackets.
• 7d58e13 [Fix] chmod a-x
• 760d0a1 [Fix] follow `allowPrototypes` option during merge
• ff662ec v6.2.2
• 970fb26 remove unnecessary escapes (according to npm test results)
• 50ea161 [Fix] ensure that `allowPrototypes: false` does not ever shadow Object.prototype properties.

See the full diff

Package name: superagent

The new version differs by 250 commits.

• fda9b5e v2.0.0
• 2429a1e 2.0.0-alpha.3
• 2ae9281 Catch errors thrown during end event
• 536e9a6 Merge pull request Editor: add preview_URL to post APIs Automattic/wp-calypso#989 from focusaurus/doc-electron-browser
• d0c57f1 document browser version in electron
• b3ef32c Merge pull request Reader: link user's name to their blog Automattic/wp-calypso#981 from visionmedia/pipeevents
• b24ab0b Emit response event when piping
• 8ae7380 Exclude bower.json from npm to avoid generating a confusing package
• 6b0e527 Alpha 2
• b47a011 Backwards compatibility with superagent-mock
• 984fbc6 Merge remote-tracking branch 'origin/headredirects'
• d351b1c Skip redirect test that exposes bug in IE
• 94f6f0a Merge pull request Reader: make "in-stream" comment bubble more useful Automattic/wp-calypso#974 from visionmedia/formserialize
• 6ff9350 Browsers are broken
• 1d8dc66 Localtunnel timeouts
• 61401a7 Fix DISALLOW_FILE_EDIT prevents manage plugins from working Automattic/wp-calypso#669
• 93a1cef Move method
• e302db1 Split test
• 62a077b Reused server for redirect tests
• b29520d Catch assertion errors to report them properly
• d7c3daa Redundant
• 781580f Moved tests
• 4ecd3f0 Serialize nested objects same way as node
• 2097cd2 Lint

See the full diff

Package name: wpcom-xhr-request

The new version differs by 56 commits.

• 2c5d870 Release 1.0.0
• e982315 test: add media files
• c16f1a3 test: add POSTs tests
• 5621425 pgk: 1.0.0-beta.4
• 712186a test: add pass `headers` to request test
• b628f50 test: fix nox-passed tests
• f445109 core: refact core using ES2015
• ddaeef4 test: add oauth tests
• abeee01 util: add token stuff
• a7a4ad5 pkg: bump 1.0.0-beta.3
• 23e4c3c core: make a copy of origin req parameters
• 0dd01e7 pkg: update package main file
• 35a356e Readme: update doc file
• 7f3d2c9 make: add `examples` rule
• 86f60b1 test: add REST-API and WP-API tests
• 8b877cc core: handling http envelope mode
• 2408ab2 add circle integration
• f6f34b0 ignore bundle example file
• 9dddfc3 do not rev bundle file
• a63f7b1 pkg: compile in prepublish. Set npm pack files
• 94e2f27 compile bundle only for examples purposes
• bc422aa ignoring build/ folder
• 04e9d80 core: ES6ify
• 99a0eb2 set eslint rules

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution