[Snyk] Upgrade express from 4.0.0 to 4.17.3 #5

snyk-bot · 2022-04-13T08:24:47Z

Snyk has created this PR to upgrade express from 4.0.0 to 4.17.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 79 versions ahead of your current version.
The recommended version was released 2 months ago, on 2022-02-17.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Prototype Override Protection Bypass npm:qs:20170213	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) npm:qs:20140806	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:negotiator:20160616	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:fresh:20170908	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:fresh:20170908	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Root Path Disclosure npm:send:20151103	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Directory Traversal npm:send:20140912	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Root Path Disclosure npm:send:20151103	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Directory Traversal npm:send:20140912	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) npm:qs:20140806-1	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Cross-site Scripting (XSS) npm:express:20140912	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Non-Constant Time String Comparison npm:cookie-signature:20160804	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Open Redirect npm:serve-static:20150113	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:mime:20170907	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: express

4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
  - deps: mime-types@~2.1.34
  - deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - Fix handling of __proto__ keys
- pref: remove unnecessary regexp for trust proxy
4.17.2 - 2021-12-17
- Fix handling of undefined in res.jsonp
- Fix handling of undefined when "json escape" is enabled
- Fix incorrect middleware execution with unanchored RegExps
- Fix res.jsonp(obj, status) deprecation message
- Fix typo in res.is JSDoc
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.18
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Fix maxAge option to reject invalid values
- deps: proxy-addr@~2.0.7
  - Use req.socket over deprecated req.connection
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - pref: ignore empty http tokens
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
4.17.1 - 2019-05-26
- Revert "Improve error message for null/undefined to res.status"
4.17.0 - 2019-05-17
- Add express.raw to parse bodies into Buffer
- Add express.text to parse bodies into string
- Improve error message for non-strings to res.sendFile
- Improve error message for null/undefined to res.status
- Support multiple hosts in X-Forwarded-Host
- deps: accepts@~1.3.7
- deps: [email protected]
  - Add encoding MIK
  - Add petabyte (pb) support
  - Fix parsing array brackets after index
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.17
- deps: [email protected]
- deps: [email protected]
  - Add SameSite=None support
- deps: finalhandler@~1.1.2
  - Set stricter Content-Security-Policy header
  - deps: parseurl@~1.3.3
  - deps: statuses@~1.5.0
- deps: parseurl@~1.3.3
- deps: proxy-addr@~2.0.5
  - deps: [email protected]
- deps: [email protected]
  - Fix parsing array brackets after index
- deps: range-parser@~1.2.1
- deps: [email protected]
  - Set stricter CSP header in redirect & error responses
  - deps: http-errors@~1.7.2
  - deps: [email protected]
  - deps: [email protected]
  - deps: range-parser@~1.2.1
  - deps: statuses@~1.5.0
  - perf: remove redundant path.normalize call
- deps: [email protected]
  - Set stricter CSP header in redirect response
  - deps: parseurl@~1.3.3
  - deps: [email protected]
- deps: [email protected]
- deps: statuses@~1.5.0
  - Add 103 Early Hints
- deps: type-is@~1.6.18
  - deps: mime-types@~2.1.24
  - perf: prevent internal throw on invalid type
4.16.4 - 2018-10-11
- Fix issue where "Request aborted" may be logged in res.sendfile
- Fix JSDoc for Router constructor
- deps: [email protected]
  - Fix deprecation warnings on Node.js 10+
  - Fix stack trace for strict json parse error
  - deps: depd@~1.1.2
  - deps: http-errors@~1.6.3
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.16
- deps: proxy-addr@~2.0.4
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
4.16.3 - 2018-03-12
- deps: accepts@~1.3.5
  - deps: mime-types@~2.1.18
- deps: depd@~1.1.2
  - perf: remove argument reassignment
- deps: encodeurl@~1.0.2
  - Fix encoding % as last character
- deps: [email protected]
  - Fix 404 output for bad / missing pathnames
  - deps: encodeurl@~1.0.2
  - deps: statuses@~1.4.0
- deps: proxy-addr@~2.0.3
  - deps: [email protected]
- deps: [email protected]
  - Fix incorrect end tag in default error & redirects
  - deps: depd@~1.1.2
  - deps: encodeurl@~1.0.2
  - deps: statuses@~1.4.0
- deps: [email protected]
  - Fix incorrect end tag in redirects
  - deps: encodeurl@~1.0.2
  - deps: [email protected]
- deps: statuses@~1.4.0
- deps: type-is@~1.6.16
  - deps: mime-types@~2.1.18
4.16.2 - 2017-10-10
- Fix TypeError in res.send when given Buffer and ETag header set
- perf: skip parsing of entire X-Forwarded-Proto header
4.16.1 - 2017-09-29
4.16.0 - 2017-09-28
4.15.5 - 2017-09-25
4.15.4 - 2017-08-07
4.15.3 - 2017-05-17
4.15.2 - 2017-03-06
4.15.1 - 2017-03-06
4.15.0 - 2017-03-01
4.14.1 - 2017-01-28
4.14.0 - 2016-06-16
4.13.4 - 2016-01-22
4.13.3 - 2015-08-03
4.13.2 - 2015-07-31
4.13.1 - 2015-07-06
4.13.0 - 2015-06-21
4.12.4 - 2015-05-18
4.12.3 - 2015-03-17
4.12.2 - 2015-03-03
4.12.1 - 2015-03-02
4.12.0 - 2015-02-23
4.11.2 - 2015-02-01
4.11.1 - 2015-01-21
4.11.0 - 2015-01-14
4.10.8 - 2015-01-13
4.10.7 - 2015-01-05
4.10.6 - 2014-12-13
4.10.5 - 2014-12-11
4.10.4 - 2014-11-25
4.10.3 - 2014-11-24
4.10.2 - 2014-11-10
4.10.1 - 2014-10-29
4.10.0 - 2014-10-24
4.9.8 - 2014-10-18
4.9.7 - 2014-10-10
4.9.6 - 2014-10-09
4.9.5 - 2014-09-25
4.9.4 - 2014-09-20
4.9.3 - 2014-09-18
4.9.2 - 2014-09-18
4.9.1 - 2014-09-17
4.9.0 - 2014-09-09
4.8.8 - 2014-09-05
4.8.7 - 2014-08-30
4.8.6 - 2014-08-28
4.8.5 - 2014-08-19
4.8.4 - 2014-08-15
4.8.3 - 2014-08-11
4.8.2 - 2014-08-07
4.8.1 - 2014-08-06
4.8.0 - 2014-08-06
4.7.4 - 2014-08-04
4.7.3 - 2014-08-04
4.7.2 - 2014-07-27
4.7.1 - 2014-07-26
4.7.0 - 2014-07-26
4.6.1 - 2014-07-13
4.6.0 - 2014-07-12
4.5.1 - 2014-07-06
4.5.0 - 2014-07-05
4.4.5 - 2014-06-27
4.4.4 - 2014-06-20
4.4.3 - 2014-06-12
4.4.2 - 2014-06-10
4.4.1 - 2014-06-03
4.4.0 - 2014-05-31
4.3.2 - 2014-05-29
4.3.1 - 2014-05-23
4.3.0 - 2014-05-21
4.2.0 - 2014-05-12
4.1.2 - 2014-05-08
4.1.1 - 2014-04-27
4.1.0 - 2014-04-24
4.0.0 - 2014-04-09