[Snyk] Fix for 1 vulnerabilities
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
Changes included in this Merge Request
- Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json
Vulnerabilities that will be fixed
With an upgrade:
Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity |
---|---|---|---|---|
768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5 |
Prototype Pollution SNYK-JS-QS-3153490 |
No | Proof of Concept |
(*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: body-parser
The new version differs by 16 commits.- 424dadd 1.19.2
- 11248a2 deps: raw-body@2.4.3
- 7a088eb build: Node.js@14.19
- ecedf31 build: Node.js@16.14
- b6bfabd build: Node.js@17.5
- badd6b2 build: fix code coverage aggregate upload
- 96b448a build: Node.js@17.4
- 70560b1 build: mocha@9.2.0
- 548a06f build: supertest@6.2.2
- 3b00678 deps: bytes@3.1.2
- d5acb61 build: mocha@9.1.4
- 82c8a7c tests: add limit + inflate tests
- b356758 deps: qs@6.9.7
- c631b58 build: supertest@6.2.1
- c81a8e2 build: eslint-plugin-import@2.25.4
- 3c4dcb8 build: Node.js@17.3
Package name: express
The new version differs by 30 commits.- 3d7fce5 4.17.3
- f906371 build: update example dependencies
- 6381bc6 deps: qs@6.9.7
- a007863 deps: body-parser@1.19.2
- e98f584 Revert "build: use minimatch@3.0.4 for Node.js < 4"
- a659137 tests: use strict mode
- a39e409 tests: prevent leaking changes to NODE_ENV
- 82de4de examples: fix path traversal in downloads example
- 12310c5 build: use nyc for test coverage
- 884657d examples: remove bitwise syntax for includes check
- 7511d08 build: use minimatch@3.0.4 for Node.js < 4
- 2585f20 tests: fix test missing assertion
- 9d09762 build: supertest@6.2.2
- 43cc56e build: clean up gitignore
- 1c7bbcc build: Node.js@14.19
- 9cbbc8a deps: cookie@0.4.2
- 6fbc269 pref: remove unnecessary regexp for trust proxy
- 2bc734a deps: accepts@~1.3.8
- 89bb531 docs: fix typo in res.download jsdoc
- 744564f tests: add test for multiple ips in "trust proxy"
- da6cb0e tests: add range tests to res.download
- 00ad5be tests: add more tests for app.request & app.response
- 141914e tests: fix tests that did not bubble errors
- bd4fdfe tests: remove global dependency on should
Check the changes in this Merge Request to ensure they won't cause issues with your project.
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information: 🧐 View latest project report
Learn how to fix vulnerabilities with free interactive lessons: