[Snyk] Upgrade: , , , bcrypt, dotenv, express, joi, mongodb, passport, passport-jwt, pug #32

JMR-Mejia · 2024-09-13T10:21:17Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@hapi/boom
from 9.1.2 to 9.1.4 | 2 versions ahead of your current version | 3 years ago
on 2021-08-20
@sentry/tracing
from 6.3.5 to 6.19.7 | 61 versions ahead of your current version | 2 years ago
on 2022-04-26
@sentry/node
from 6.3.5 to 6.19.7 | 61 versions ahead of your current version | 2 years ago
on 2022-04-26
bcrypt
from 5.0.1 to 5.1.1 | 2 versions ahead of your current version | a year ago
on 2023-08-16
dotenv
from 9.0.0 to 9.0.2 | 2 versions ahead of your current version | 3 years ago
on 2021-05-10
express
from 4.17.1 to 4.19.2 | 9 versions ahead of your current version | 6 months ago
on 2024-03-25
joi
from 17.4.0 to 17.13.3 | 32 versions ahead of your current version | 3 months ago
on 2024-06-19
mongodb
from 3.6.6 to 3.7.4 | 11 versions ahead of your current version | a year ago
on 2023-06-21
passport
from 0.4.1 to 0.7.0 | 6 versions ahead of your current version | 10 months ago
on 2023-11-27
passport-jwt
from 4.0.0 to 4.0.1 | 1 version ahead of your current version | 2 years ago
on 2022-12-24
pug
from 3.0.2 to 3.0.3 | 2 versions ahead of your current version | 4 months ago
on 2024-05-24

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Improper Control of Generation of Code ('Code Injection') SNYK-JS-PUGCODEGEN-7086056	519	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	519	Proof of Concept
Arbitrary File Overwrite SNYK-JS-TAR-1536528	519	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	519	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	519	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	519	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	519	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	519	No Known Exploit
Information Exposure SNYK-JS-MONGODB-5871303	519	No Known Exploit
Information Exposure SNYK-JS-NODEFETCH-2342118	519	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-SIDEWAYFORMULA-3317169	519	No Known Exploit
Session Fixation SNYK-JS-PASSPORT-2840631	519	No Known Exploit
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	519	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	519	No Known Exploit

Release notes

Package name: @hapi/boom

9.1.4 - 2021-08-20
9.1.4
9.1.3 - 2021-07-02
9.1.3
9.1.2 - 2021-03-16
9.1.2

from @hapi/boom GitHub release notes

Package name: @sentry/tracing

6.19.7 - 2022-04-26
6.19.6 - 2022-04-07
6.19.5 - 2022-04-07
6.19.4 - 2022-04-05
6.19.3 - 2022-03-30
6.19.2 - 2022-03-23
6.19.1 - 2022-03-21
6.19.0 - 2022-03-21
6.18.2 - 2022-03-08
6.18.1 - 2022-02-28
6.18.1-beta.0 - 2022-03-01
6.18.0 - 2022-02-24
6.17.9 - 2022-02-16
6.17.8 - 2022-02-15
6.17.8-beta.0 - 2022-02-11
6.17.7 - 2022-02-11
6.17.6 - 2022-02-08
6.17.5 - 2022-02-07
6.17.4 - 2022-02-02
6.17.3 - 2022-01-28
6.17.2 - 2022-01-25
6.17.1 - 2022-01-24
6.17.0 - 2022-01-24
6.17.0-beta.0 - 2022-01-10
6.16.1 - 2021-12-10
6.16.0 - 2021-12-07
6.15.0 - 2021-11-16
6.14.3 - 2021-11-11
6.14.2 - 2021-11-11
6.14.1 - 2021-11-05
6.14.0 - 2021-11-03
6.13.3 - 2021-10-06
6.13.2 - 2021-09-21
6.13.1 - 2021-09-20
6.13.0 - 2021-09-20
6.13.0-beta.3 - 2021-09-16
6.13.0-beta.2 - 2021-09-15
6.13.0-beta.1 - 2021-09-15
6.13.0-beta.0 - 2021-09-01
6.12.0 - 2021-08-31
6.12.0-beta.2 - 2021-08-26
6.12.0-beta.1 - 2021-08-24
6.11.0 - 2021-08-06
6.10.0 - 2021-07-22
6.10.0-beta.3 - 2021-07-21
6.10.0-beta.2 - 2021-07-19
6.10.0-beta - 2021-07-16
6.9.0 - 2021-07-12
6.8.0 - 2021-06-28
6.7.2 - 2021-06-21
6.7.1 - 2021-06-15
6.7.0 - 2021-06-14
6.6.0 - 2021-06-10
6.5.1 - 2021-06-02
6.5.0 - 2021-05-31
6.5.0-beta.2 - 2021-05-28
6.5.0-beta.1 - 2021-05-25
6.5.0-beta.0 - 2021-05-21
6.4.1 - 2021-05-19
6.4.0 - 2021-05-17
6.3.6 - 2021-05-10
6.3.5 - 2021-04-30

from @sentry/tracing GitHub release notes

Package name: @sentry/node

6.19.7 - 2022-04-26
6.19.6 - 2022-04-07
6.19.5 - 2022-04-07
6.19.4 - 2022-04-05
6.19.3 - 2022-03-30
6.19.2 - 2022-03-23
6.19.1 - 2022-03-21
6.19.0 - 2022-03-21
6.18.2 - 2022-03-08
6.18.1 - 2022-02-28
6.18.1-beta.0 - 2022-03-01
6.18.0 - 2022-02-24
6.17.9 - 2022-02-16
6.17.8 - 2022-02-15
6.17.8-beta.0 - 2022-02-11
6.17.7 - 2022-02-11
6.17.6 - 2022-02-08
6.17.5 - 2022-02-07
6.17.4 - 2022-02-02
6.17.3 - 2022-01-28
6.17.2 - 2022-01-25
6.17.1 - 2022-01-24
6.17.0 - 2022-01-24
6.17.0-beta.0 - 2022-01-10
6.16.1 - 2021-12-10
6.16.0 - 2021-12-07
6.15.0 - 2021-11-16
6.14.3 - 2021-11-11
6.14.2 - 2021-11-11
6.14.1 - 2021-11-05
6.14.0 - 2021-11-03
6.13.3 - 2021-10-06
6.13.2 - 2021-09-21
6.13.1 - 2021-09-20
6.13.0 - 2021-09-20
6.13.0-beta.3 - 2021-09-16
6.13.0-beta.2 - 2021-09-15
6.13.0-beta.1 - 2021-09-15
6.13.0-beta.0 - 2021-09-01
6.12.0 - 2021-08-31
6.12.0-beta.2 - 2021-08-26
6.12.0-beta.1 - 2021-08-24
6.11.0 - 2021-08-06
6.10.0 - 2021-07-22
6.10.0-beta.3 - 2021-07-21
6.10.0-beta.2 - 2021-07-19
6.10.0-beta - 2021-07-16
6.9.0 - 2021-07-12
6.8.0 - 2021-06-28
6.7.2 - 2021-06-21
6.7.1 - 2021-06-15
6.7.0 - 2021-06-14
6.6.0 - 2021-06-10
6.5.1 - 2021-06-02
6.5.0 - 2021-05-31
6.5.0-beta.2 - 2021-05-28
6.5.0-beta.1 - 2021-05-25
6.5.0-beta.0 - 2021-05-21
6.4.1 - 2021-05-19
6.4.0 - 2021-05-17
6.3.6 - 2021-05-10
6.3.5 - 2021-04-30

from @sentry/node GitHub release notes

Package name: bcrypt

5.1.1 - 2023-08-16
What's Changed
- Refactored example with async await by @ lpizzinidev in #894
- Fixed z/OS build issue by @ laijonathan in #968
- Update dependencies by @ recrsn in #993
New Contributors
- @ lpizzinidev made their first contribution in #894
- @ laijonathan made their first contribution in #968
Full Changelog: v5.1.0...v5.1.1
5.1.0 - 2022-10-06
What's Changed
- Update node-pre-gyp to 1.0.2 by @ feuxfollets1013 in #865
- Update README for inclusion of musl by @ arbourd in #883
- Version bump, security updates to sub dep npmlog by @ adaniels-parabol in #905
- document ESM usage (#892) by @ mariusa in #899
- fix: update travis CI Docker image repository by @ cokia in #930
- Update node versions in appveyor test matrix by @ p-kuen in #936
- chore(appveyor): not use latest npm by @ cokia in #932
- chore: update Appveyor readme badge by @ cokia in #933
- Use Github actions for CI by @ recrsn in #858
- Update dependencies by @ recrsn in #953
- Migrate tests to use Jest by @ recrsn in #958
- Pin NAPI to v3 by @ recrsn in #959
New Contributors
- @ feuxfollets1013 made their first contribution in #865
- @ arbourd made their first contribution in #883
- @ adaniels-parabol made their first contribution in #905
- @ mariusa made their first contribution in #899
- @ cokia made their first contribution in #930
- @ p-kuen made their first contribution in #936
Full Changelog: v5.0.1...v5.1.0
5.0.1 - 2021-02-26
Update node-pre-gyp to 1.0.0

from bcrypt GitHub release notes

Package name: dotenv

9.0.2 - 2021-05-10
Bump 9.0.2
9.0.1 - 2021-05-09
Update CHANGELOG
9.0.0 - 2021-05-05
Version bump 9.0.0

from dotenv GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: body-parser@1.20.2
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: raw-body@2.5.2
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: Node.js@16.18 and Node.js@18.12 by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add Node.js@19.7 by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: body-parser@1.20.1
  - deps: qs@6.11.0
  - perf: remove unnecessary object clone
- deps: qs@6.11.0
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: body-parser@1.20.0
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: depd@2.0.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: qs@6.10.3
  - deps: raw-body@2.5.1
- deps: cookie@0.5.0
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: depd@2.0.0
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: finalhandler@1.2.0
  - Remove set content headers that break response
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: on-finished@2.4.1
  - Prevent loss of async hooks context
- deps: qs@6.10.3
- deps: send@0.18.0
  - Fix emitted 416 error missing headers property
  - Limit the headers removed for 304 response
  - deps: depd@2.0.0
  - deps: destroy@1.2.0
  - deps: http-errors@2.0.0
  - deps: on-finished@2.4.1
  - deps: statuses@2.0.1
- deps: serve-static@1.15.0
  - deps: send@0.18.0
- deps: statuses@2.0.1
  - Remove code 306
  - Rename 425 Unordered Collection to standard 425 Too Early
4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
  - deps: mime-types@~2.1.34
  - deps: negotiator@0.6.3
- deps: body-parser@1.19.2
  - deps: bytes@3.1.2
  - deps: qs@6.9.7
  - deps: raw-body@2.4.3
- deps: cookie@0.4.2
- deps: qs@6.9.7
  - Fix handling of __proto__ keys
- pref: remove unnecessary regexp for trust proxy
4.17.2 - 2021-12-17
- Fix handling of undefined in res.jsonp
- Fix handling of undefined when "json escape" is enabled
- Fix incorrect middleware execution with unanchored RegExps
- Fix res.jsonp(obj, status) deprecation message
- Fix typo in res.is JSDoc
- deps: body-parser@1.19.1
  - deps: bytes@3.1.1
  - deps: http-errors@1.8.1
  - deps: qs@6.9.6
  - deps: raw-body@2.4.2
  - deps: safe-buffer@5.2.1
  - deps: type-is@~1.6.18
- deps: content-disposition@0.5.4
  - deps: safe-buffer@5.2.1
- deps: cookie@0.4.1
  - Fix maxAge option to reject invalid values
- deps: proxy-addr@~2.0.7
  - Use req.socket over deprecated req.connection
  - deps: forwarded@0.2.0
  - deps: ipaddr.js@1.9.1
- deps: qs@6.9.6
- deps: safe-buffer@5.2.1
- deps: send@0.17.2
  - deps: http-errors@1.8.1
  - deps: ms@2.1.3
  - pref: ignore empty http tokens
- deps: serve-static@1.14.2
  - deps: send@0.17.2
- deps: setprototypeof@1.2.0
4.17.1 - 2019-05-26

from express GitHub release notes

Package name: joi

from joi GitHub release notes

Package name: mongodb

3.7.4 - 2023-06-21
The MongoDB Node.js team is pleased to announce version 3.7.4 of the mongodb package!

Release Highlights

This release fixes a bug that throws a type error when SCRAM-SHA-256 is used with saslprep in a webpacked environment.

3.7.4 (2023-06-21)

Bug Fixes
- NODE-3711: retry txn end on retryable write (#3047) (1595140)
- NODE-5355: prevent error when saslprep is not a function (#3733) (152425a)
Documentation
- Reference
- API
- Changelog
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
3.7.3 - 2021-10-20
3.7.2 - 2021-10-05
3.7.1 - 2021-09-14
3.7.0 - 2021-08-31
3.6.12 - 2021-08-30
3.6.11 - 2021-08-05
3.6.10 - 2021-07-06
3.6.9 - 2021-05-26
3.6.8 - 2021-05-21
3.6.7 - 2021-05-18
3.6.6 - 2021-04-06

from mongodb GitHub release notes

Package name: passport

0.7.0 -

Snyk has created this PR to upgrade: - @hapi/boom from 9.1.2 to 9.1.4. See this package in npm: https://www.npmjs.com/package/@hapi/boom - @sentry/tracing from 6.3.5 to 6.19.7. See this package in npm: https://www.npmjs.com/package/@sentry/tracing - @sentry/node from 6.3.5 to 6.19.7. See this package in npm: https://www.npmjs.com/package/@sentry/node - bcrypt from 5.0.1 to 5.1.1. See this package in npm: https://www.npmjs.com/package/bcrypt - dotenv from 9.0.0 to 9.0.2. See this package in npm: https://www.npmjs.com/package/dotenv - express from 4.17.1 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - joi from 17.4.0 to 17.13.3. See this package in npm: https://www.npmjs.com/package/joi - mongodb from 3.6.6 to 3.7.4. See this package in npm: https://www.npmjs.com/package/mongodb - passport from 0.4.1 to 0.7.0. See this package in npm: https://www.npmjs.com/package/passport - passport-jwt from 4.0.0 to 4.0.1. See this package in npm: https://www.npmjs.com/package/passport-jwt - pug from 3.0.2 to 3.0.3. See this package in npm: https://www.npmjs.com/package/pug See this project in Snyk: https://app.snyk.io/org/jmr-mejia/project/b5fda450-a914-4ec3-82ba-caea1f44935d?utm_source=github&utm_medium=referral&page=upgrade-pr

vercel · 2024-09-13T10:21:18Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
octolionshop	❌ Failed (Inspect)			Sep 13, 2024 10:21am

JMR-Mejia self-assigned this Sep 13, 2024

vercel bot had a problem deploying to Preview September 13, 2024 10:21 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: , , , bcrypt, dotenv, express, joi, mongodb, passport, passport-jwt, pug #32

[Snyk] Upgrade: , , , bcrypt, dotenv, express, joi, mongodb, passport, passport-jwt, pug #32

JMR-Mejia commented Sep 13, 2024

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Release Highlights

3.7.4 (2023-06-21)

Bug Fixes

Documentation

vercel bot commented Sep 13, 2024 •

edited

Loading

[Snyk] Upgrade: , , , bcrypt, dotenv, express, joi, mongodb, passport, passport-jwt, pug #32

Are you sure you want to change the base?

[Snyk] Upgrade: , , , bcrypt, dotenv, express, joi, mongodb, passport, passport-jwt, pug #32

Conversation

JMR-Mejia commented Sep 13, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Release Highlights

3.7.4 (2023-06-21)

Bug Fixes

Documentation

vercel bot commented Sep 13, 2024 • edited Loading

vercel bot commented Sep 13, 2024 •

edited

Loading