CLAassistant
commented
1 year ago
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------  | **768/1000****Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5 | Prototype Pollution
[SNYK-JS-QS-3153490](https://snyk.io/vuln/SNYK-JS-QS-3153490) | No | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: body-parser
The new version differs by 101 commits.- 424dadd 1.19.2
- 11248a2 deps: raw-body@2.4.3
- 7a088eb build: Node.js@14.19
- ecedf31 build: Node.js@16.14
- b6bfabd build: Node.js@17.5
- badd6b2 build: fix code coverage aggregate upload
- 96b448a build: Node.js@17.4
- 70560b1 build: mocha@9.2.0
- 548a06f build: supertest@6.2.2
- 3b00678 deps: bytes@3.1.2
- d5acb61 build: mocha@9.1.4
- 82c8a7c tests: add limit + inflate tests
- b356758 deps: qs@6.9.7
- c631b58 build: supertest@6.2.1
- c81a8e2 build: eslint-plugin-import@2.25.4
- 3c4dcb8 build: Node.js@17.3
- d0a214b 1.19.1
- fb172d4 build: eslint-plugin-promise@5.2.0
- c5e63cb build: Node.js@17.2
- c6d43bd build: eslint-plugin-import@2.25.3
- 313ed6d build: eslint-plugin-promise@5.1.1
- 8389b51 deps: bytes@3.1.1
- aae94b2 deps: http-errors@1.8.1
- 7f84d4f deps: raw-body@2.4.2
See the full diffPackage name: express
The new version differs by 117 commits.- 3d7fce5 4.17.3
- f906371 build: update example dependencies
- 6381bc6 deps: qs@6.9.7
- a007863 deps: body-parser@1.19.2
- e98f584 Revert "build: use minimatch@3.0.4 for Node.js < 4"
- a659137 tests: use strict mode
- a39e409 tests: prevent leaking changes to NODE_ENV
- 82de4de examples: fix path traversal in downloads example
- 12310c5 build: use nyc for test coverage
- 884657d examples: remove bitwise syntax for includes check
- 7511d08 build: use minimatch@3.0.4 for Node.js < 4
- 2585f20 tests: fix test missing assertion
- 9d09762 build: supertest@6.2.2
- 43cc56e build: clean up gitignore
- 1c7bbcc build: Node.js@14.19
- 9cbbc8a deps: cookie@0.4.2
- 6fbc269 pref: remove unnecessary regexp for trust proxy
- 2bc734a deps: accepts@~1.3.8
- 89bb531 docs: fix typo in res.download jsdoc
- 744564f tests: add test for multiple ips in "trust proxy"
- da6cb0e tests: add range tests to res.download
- 00ad5be tests: add more tests for app.request & app.response
- 141914e tests: fix tests that did not bubble errors
- bd4fdfe tests: remove global dependency on should
See the full diff