search

apavlidi / IT_API

The Internet services of the IT department of Alexander Technological Education Institute of Thessaloniki
http://api.it.teithe.gr/
MIT License
14 stars 5 forks source link

[Snyk] Security upgrade express-fileupload from 0.3.0 to 1.4.0 #161

Open apavlidi opened 11 months ago

apavlidi commented 11 months ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **761/1000**
**Why?** Mature exploit, Has a fix available, CVSS 7.5 | Denial of Service (DoS)
[SNYK-JS-DICER-2311764](https://snyk.io/vuln/SNYK-JS-DICER-2311764) | Yes | Mature (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: express-fileupload The new version differs by 250 commits.
  • 4f81fc8 1.4.0
  • 78a66c1 Merge pull request #315 from duterte/master
  • 310a382 Merge branch 'richardgirges:master' into master
  • f57198b fix linting error
  • ce713c2 add workflow job filters
  • e47cc7d trigger ci
  • 74a0830 Refactor: upgrade to busboy 1.6.0
  • d1d6c66 Refactor busboy is no longer a constructor, its a function
  • 30d8535 Merge pull request #310 from richardgirges/dependabot/npm_and_yarn/minimist-1.2.6
  • e6948f9 Bump minimist from 1.2.5 to 1.2.6
  • c9c7d83 Create SECURITY.md
  • f9237aa help wanted readme update
  • 651421b help wanted readme update
  • 290f3cc 1.3.1
  • ab3d252 node 12+ support
  • 4afa5a1 1.3.0
  • fe0ce3f circleci status badge
  • 26f4a92 comment out console logs
  • edd91ce Merge pull request #301 from zwade/master
  • 47bc50c Merge remote-tracking branch 'origin/master'
  • 3ba7d94 Merge pull request #302 from zwade/zw-fix-tests
  • ddf5530 support node 12+. fix security vulnerabilities re: npm audit
  • 3cfbc7f Have promiseCallback make callbacks and promises behave the same
  • 5e83249 Refactor prototype pollution check to be more comprehensive
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/noomados/project/50c336ef-8a10-41dd-98ac-c157e9534430?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/noomados/project/50c336ef-8a10-41dd-98ac-c157e9534430?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"6cfbf4c1-f699-48f2-b80b-7f2840a1f206","prPublicId":"6cfbf4c1-f699-48f2-b80b-7f2840a1f206","dependencies":[{"name":"express-fileupload","from":"0.3.0","to":"1.4.0"}],"packageManager":"npm","projectPublicId":"50c336ef-8a10-41dd-98ac-c157e9534430","projectUrl":"https://app.snyk.io/org/noomados/project/50c336ef-8a10-41dd-98ac-c157e9534430?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-DICER-2311764"],"upgrade":["SNYK-JS-DICER-2311764"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[761],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Denial of Service (DoS)](https://learn.snyk.io/lesson/redos/?loc=fix-pr)