[Snyk] Upgrade: sweetalert2, bcrypt, dotenv, ejs, http-errors, express, express-session, express-validator, jsonwebtoken, mongoose, morgan, nodemailer, nodemon, socket.io #58

Vux142857 · 2024-09-07T06:54:52Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

sweetalert2
from 11.7.12 to 11.12.4 | 39 versions ahead of your current version | a month ago
on 2024-08-01
bcrypt
from 5.1.0 to 5.1.1 | 1 version ahead of your current version | a year ago
on 2023-08-16
dotenv
from 16.1.4 to 16.4.5 | 10 versions ahead of your current version | 7 months ago
on 2024-02-20
ejs
from 2.6.2 to 2.7.4 | 4 versions ahead of your current version | 5 years ago
on 2019-11-19
http-errors
from 1.6.3 to 1.8.1 | 6 versions ahead of your current version | 3 years ago
on 2021-11-14
express
from 4.16.4 to 4.19.2 | 11 versions ahead of your current version | 5 months ago
on 2024-03-25
express-session
from 1.17.3 to 1.18.0 | 1 version ahead of your current version | 7 months ago
on 2024-01-28
express-validator
from 7.0.1 to 7.2.0 | 2 versions ahead of your current version | a month ago
on 2024-08-11
jsonwebtoken
from 9.0.1 to 9.0.2 | 1 version ahead of your current version | a year ago
on 2023-08-30
mongoose
from 7.2.1 to 7.8.0 | 35 versions ahead of your current version | a month ago
on 2024-07-23
morgan
from 1.9.1 to 1.10.0 | 1 version ahead of your current version | 4 years ago
on 2020-03-20
nodemailer
from 6.9.3 to 6.9.14 | 11 versions ahead of your current version | 3 months ago
on 2024-06-19
nodemon
from 3.0.1 to 3.1.4 | 7 versions ahead of your current version | 3 months ago
on 2024-06-20
socket.io
from 4.7.1 to 4.7.5 | 4 versions ahead of your current version | 6 months ago
on 2024-03-14

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	519	Proof of Concept
Prototype Pollution SNYK-JS-MONGOOSE-5777721	519	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	519	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	519	Proof of Concept
Open Redirect SNYK-JS-EXPRESS-6474509	519	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	519	Proof of Concept
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	519	Proof of Concept
Information Exposure SNYK-JS-MONGODB-5871303	519	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-NODEMAILER-6219989	519	Proof of Concept

Release notes

Package name: sweetalert2

11.12.4 - 2024-08-01
11.12.4 (2024-08-01)

Bug Fixes
- upgrade to eslint 9 (#2748) (6696b81)
11.12.3 - 2024-07-19
11.12.3 (2024-07-19)

Bug Fixes
- strict types renderInput.js and getTemplateParams.js (df6d0ed)
11.12.2 - 2024-07-05
11.12.2 (2024-07-05)

Bug Fixes
- customClass for buttons (#2741) (87201a0)
11.12.1 - 2024-06-28
11.12.1 (2024-06-28)

Bug Fixes
- strict types domUtils.js (42720b4)
11.12.0 - 2024-06-18
11.12.0 (2024-06-18)

Bug Fixes
- styles: :focus -> :focus-visible for buttons (#2733) (9be8249)
Features
- focus [autofocus] element in a popup (#2736) (52fedf3)
11.11.1 - 2024-06-05
11.11.1 (2024-06-05)

Bug Fixes
- types: getSwalImage() (e0e5e4c)
11.11.0 - 2024-05-11
11.11.0 (2024-05-11)

Features
- types: allow undefined as options (#2728) (0d6f0ec)
11.10.8 - 2024-04-17
11.10.8 (2024-04-17)

Bug Fixes
- prevent popup content from being selected on double click on the container (#2722) (7910325)
11.10.7 - 2024-03-22
11.10.7 (2024-03-22)

Bug Fixes
- improve performance by pulling querySelector out of the loop (#2719) (9f94517)
11.10.6 - 2024-03-05
11.10.6 (2024-03-05)

Bug Fixes
- allow single quotes in default email validator (#2717) (e4b7a3a)
11.10.5 - 2024-02-05
11.10.4 - 2024-01-23
11.10.3 - 2024-01-11
11.10.2 - 2023-12-27
11.10.1 - 2023-11-19
11.10.0 - 2023-11-14
11.9.1 - 2023-11-14
11.9.0 - 2023-10-30
11.8.0 - 2023-10-28
11.7.32 - 2023-10-06
11.7.31 - 2023-09-26
11.7.30 - 2023-09-26
11.7.29 - 2023-09-25
11.7.28 - 2023-09-14
11.7.27 - 2023-08-20
11.7.26 - 2023-08-19
11.7.25 - 2023-08-18
11.7.24 - 2023-08-18
11.7.23 - 2023-08-15
11.7.22 - 2023-08-10
11.7.21 - 2023-08-09
11.7.20 - 2023-07-23
11.7.19 - 2023-07-22
11.7.18 - 2023-07-15
11.7.17 - 2023-07-15
11.7.16 - 2023-07-11
11.7.15 - 2023-07-11
11.7.14 - 2023-07-11
11.7.13 - 2023-07-11
11.7.12 - 2023-06-09

from sweetalert2 GitHub release notes

Package name: bcrypt

5.1.1 - 2023-08-16
What's Changed
- Refactored example with async await by @ lpizzinidev in #894
- Fixed z/OS build issue by @ laijonathan in #968
- Update dependencies by @ recrsn in #993
New Contributors
- @ lpizzinidev made their first contribution in #894
- @ laijonathan made their first contribution in #968
Full Changelog: v5.1.0...v5.1.1
5.1.0 - 2022-10-06
What's Changed
- Update node-pre-gyp to 1.0.2 by @ feuxfollets1013 in #865
- Update README for inclusion of musl by @ arbourd in #883
- Version bump, security updates to sub dep npmlog by @ adaniels-parabol in #905
- document ESM usage (#892) by @ mariusa in #899
- fix: update travis CI Docker image repository by @ cokia in #930
- Update node versions in appveyor test matrix by @ p-kuen in #936
- chore(appveyor): not use latest npm by @ cokia in #932
- chore: update Appveyor readme badge by @ cokia in #933
- Use Github actions for CI by @ recrsn in #858
- Update dependencies by @ recrsn in #953
- Migrate tests to use Jest by @ recrsn in #958
- Pin NAPI to v3 by @ recrsn in #959
New Contributors
- @ feuxfollets1013 made their first contribution in #865
- @ arbourd made their first contribution in #883
- @ adaniels-parabol made their first contribution in #905
- @ mariusa made their first contribution in #899
- @ cokia made their first contribution in #930
- @ p-kuen made their first contribution in #936
Full Changelog: v5.0.1...v5.1.0

from bcrypt GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: ejs

2.7.4 - 2019-11-19
Bug fixes
- Fixed Node 4 support, which broke in v2.7.3 (5e42d6c, @ mde)
2.7.3 - 2019-11-19
Bug fixes
- Made the post-install message more discreet by following the example of opencollective-postinstall (228d8e4, @ mde)
2.7.2 - 2019-11-13
Features
- Added support for destructuring locals (#452, @ ExE-Boss)
- Added support for disabling legacy include directives (#458, #459, @ ExE-Boss)
- Compiled functions are now shown in the debugger (#456, @ S2-)
- function.name is now set to the file base name in environments that support this (#466, @ ExE-Boss)
Bug Fixes
- The error message when async != true now correctly mention the existence of the async option (#460, @ ExE-Boss)
- Improved performance of HTML output generation (#470, @ nwoltman)
2.7.1 - 2019-09-02
Deprecated:
- Added deprecation notice for use of require.extensions (@ mde)
2.6.2 - 2019-06-15
- Correctly pass custom escape function to includes (@ alecgibson)
- Fixes for rmWhitespace (@ nwoltman)
- Examples for client-side EJS compiled with Express middleware (@ mjgs)
- Make Template constructor public (@ ThisNameWasTaken)
- Added remove function to cache (@ S2-)
- Recognize both 'Nix and Windows absolute paths (@ mde)

from ejs GitHub release notes

Package name: http-errors

1.8.1 - 2021-11-14
1.8.1
1.8.0 - 2020-06-29
1.8.0
1.7.3 - 2019-06-24
1.7.3
1.7.2 - 2019-02-18
1.7.2
1.7.1 - 2018-09-08
1.7.1
1.7.0 - 2018-07-30
1.7.0
1.6.3 - 2018-03-29
1.6.3

from http-errors GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: body-parser@1.20.2
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: raw-body@2.5.2
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: Node.js@16.18 and Node.js@18.12 by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add Node.js@19.7 by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: body-parser@1.20.1
  - deps: qs@6.11.0
  - perf: remove unnecessary object clone
- deps: qs@6.11.0
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: body-parser@1.20.0
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: depd@2.0.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: qs@6.10.3
  - deps: raw-body@2.5.1
- deps: cookie@0.5.0
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners

Snyk has created this PR to upgrade: - sweetalert2 from 11.7.12 to 11.12.4. See this package in npm: https://www.npmjs.com/package/sweetalert2 - bcrypt from 5.1.0 to 5.1.1. See this package in npm: https://www.npmjs.com/package/bcrypt - dotenv from 16.1.4 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - ejs from 2.6.2 to 2.7.4. See this package in npm: https://www.npmjs.com/package/ejs - http-errors from 1.6.3 to 1.8.1. See this package in npm: https://www.npmjs.com/package/http-errors - express from 4.16.4 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - express-session from 1.17.3 to 1.18.0. See this package in npm: https://www.npmjs.com/package/express-session - express-validator from 7.0.1 to 7.2.0. See this package in npm: https://www.npmjs.com/package/express-validator - jsonwebtoken from 9.0.1 to 9.0.2. See this package in npm: https://www.npmjs.com/package/jsonwebtoken - mongoose from 7.2.1 to 7.8.0. See this package in npm: https://www.npmjs.com/package/mongoose - morgan from 1.9.1 to 1.10.0. See this package in npm: https://www.npmjs.com/package/morgan - nodemailer from 6.9.3 to 6.9.14. See this package in npm: https://www.npmjs.com/package/nodemailer - nodemon from 3.0.1 to 3.1.4. See this package in npm: https://www.npmjs.com/package/nodemon - socket.io from 4.7.1 to 4.7.5. See this package in npm: https://www.npmjs.com/package/socket.io See this project in Snyk: https://app.snyk.io/org/vux142857/project/b9c9974d-6454-4104-b4a5-a7523ef08372?utm_source=github&utm_medium=referral&page=upgrade-pr

Vux142857 self-assigned this Sep 7, 2024

[Snyk] Upgrade: sweetalert2, bcrypt, dotenv, ejs, http-errors, express, express-session, express-validator, jsonwebtoken, mongoose, morgan, nodemailer, nodemon, socket.io #58

Are you sure you want to change the base?

[Snyk] Upgrade: sweetalert2, bcrypt, dotenv, ejs, http-errors, express, express-session, express-validator, jsonwebtoken, mongoose, morgan, nodemailer, nodemon, socket.io #58

Conversation

Vux142857 commented Sep 7, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

11.12.4 (2024-08-01)

Bug Fixes

11.12.3 (2024-07-19)

Bug Fixes

11.12.2 (2024-07-05)

Bug Fixes

11.12.1 (2024-06-28)

Bug Fixes

11.12.0 (2024-06-18)

Bug Fixes

Features

11.11.1 (2024-06-05)

Bug Fixes

11.11.0 (2024-05-11)

Features

11.10.8 (2024-04-17)

Bug Fixes

11.10.7 (2024-03-22)

Bug Fixes

11.10.6 (2024-03-05)

Bug Fixes

What's Changed

New Contributors

What's Changed

New Contributors

Bug fixes

Bug fixes

Features

Bug Fixes

Deprecated:

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors