[Snyk] Upgrade: bcrypt, cloudinary, dotenv, express, moment, mongoose, nodemon, socket.io, socket.io-client, stripe, validator #1

KOTTAGENVH · 2024-09-15T10:26:32Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

bcrypt
from 5.0.1 to 5.1.1 | 2 versions ahead of your current version | a year ago
on 2023-08-16
cloudinary
from 1.31.0 to 1.41.3 | 20 versions ahead of your current version | 8 months ago
on 2024-01-18
dotenv
from 16.0.2 to 16.4.5 | 18 versions ahead of your current version | 7 months ago
on 2024-02-20
express
from 4.18.1 to 4.19.2 | 5 versions ahead of your current version | 6 months ago
on 2024-03-25
moment
from 2.29.4 to 2.30.1 | 2 versions ahead of your current version | 9 months ago
on 2023-12-27
mongoose
from 6.5.4 to 6.13.0 | 48 versions ahead of your current version | 3 months ago
on 2024-06-06
nodemon
from 2.0.19 to 2.0.22 | 3 versions ahead of your current version | a year ago
on 2023-03-22
socket.io
from 4.5.1 to 4.7.5 | 13 versions ahead of your current version | 6 months ago
on 2024-03-14
socket.io-client
from 4.5.3 to 4.7.5 | 12 versions ahead of your current version | 6 months ago
on 2024-03-14
stripe
from 10.7.0 to 10.17.0 | 14 versions ahead of your current version | 2 years ago
on 2022-11-08
validator
from 13.7.0 to 13.12.0 | 3 versions ahead of your current version | 4 months ago
on 2024-05-09

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Prototype Pollution SNYK-JS-MONGOOSE-5777721	646	Proof of Concept
Uncaught Exception SNYK-JS-SOCKETIO-7278048	646	No Known Exploit
Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	646	No Known Exploit
Denial of Service (DoS) SNYK-JS-WS-7266574	646	Proof of Concept
Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	646	No Known Exploit
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	646	Proof of Concept
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	646	Proof of Concept
Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	646	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	646	Proof of Concept
Information Exposure SNYK-JS-MONGODB-5871303	646	No Known Exploit
Remote Code Execution (RCE) SNYK-JS-VM2-5772825	646	Mature
Uncaught Exception SNYK-JS-ENGINEIO-5496331	646	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	646	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	646	Proof of Concept
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	646	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-WORDWRAP-3149973	646	Proof of Concept
Sandbox Escape SNYK-JS-VM2-5415299	646	Proof of Concept
Sandbox Escape SNYK-JS-VM2-5422057	646	Proof of Concept
Improper Handling of Exceptional Conditions SNYK-JS-VM2-5426093	646	No Known Exploit
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') SNYK-JS-VM2-5537079	646	Proof of Concept
Sandbox Bypass SNYK-JS-VM2-5537100	646	Proof of Concept
Remote Code Execution (RCE) SNYK-JS-VM2-5772823	646	Proof of Concept

Release notes

Package name: bcrypt

5.1.1 - 2023-08-16
What's Changed
- Refactored example with async await by @ lpizzinidev in #894
- Fixed z/OS build issue by @ laijonathan in #968
- Update dependencies by @ recrsn in #993
New Contributors
- @ lpizzinidev made their first contribution in #894
- @ laijonathan made their first contribution in #968
Full Changelog: v5.1.0...v5.1.1
5.1.0 - 2022-10-06
What's Changed
- Update node-pre-gyp to 1.0.2 by @ feuxfollets1013 in #865
- Update README for inclusion of musl by @ arbourd in #883
- Version bump, security updates to sub dep npmlog by @ adaniels-parabol in #905
- document ESM usage (#892) by @ mariusa in #899
- fix: update travis CI Docker image repository by @ cokia in #930
- Update node versions in appveyor test matrix by @ p-kuen in #936
- chore(appveyor): not use latest npm by @ cokia in #932
- chore: update Appveyor readme badge by @ cokia in #933
- Use Github actions for CI by @ recrsn in #858
- Update dependencies by @ recrsn in #953
- Migrate tests to use Jest by @ recrsn in #958
- Pin NAPI to v3 by @ recrsn in #959
New Contributors
- @ feuxfollets1013 made their first contribution in #865
- @ arbourd made their first contribution in #883
- @ adaniels-parabol made their first contribution in #905
- @ mariusa made their first contribution in #899
- @ cokia made their first contribution in #930
- @ p-kuen made their first contribution in #936
Full Changelog: v5.0.1...v5.1.0
5.0.1 - 2021-02-26
Update node-pre-gyp to 1.0.0

from bcrypt GitHub release notes

Package name: cloudinary

1.41.3 - 2024-01-18
1.41.2 - 2024-01-08
1.41.1 - 2023-12-18
1.41.0 - 2023-09-26
1.40.0 - 2023-07-31
1.39.0 - 2023-07-24
1.38.0 - 2023-07-20
1.37.3 - 2023-06-26
1.37.2 - 2023-06-19
1.37.1 - 2023-06-09
1.37.0 - 2023-05-16
1.36.4 - 2023-05-02
1.36.3 - 2023-05-02
1.36.2 - 2023-04-24
1.36.1 - 2023-04-13
1.36.0 - 2023-04-13
1.35.0 - 2023-03-03
1.34.0 - 2023-02-13
1.33.0 - 2022-12-15
1.32.0 - 2022-09-14
1.31.0 - 2022-08-28

from cloudinary GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: [email protected]
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: [email protected]
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: [email protected] and [email protected] by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add [email protected] by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: [email protected]
  - deps: [email protected]
  - perf: remove unnecessary object clone
- deps: [email protected]
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes

from express GitHub release notes

Package name: moment

2.30.1 - 2023-12-27
2.30.1
2.30.0 - 2023-12-26
2.30.0
2.29.4 - 2022-07-06
2.29.4

from moment GitHub release notes

Package name: mongoose

6.13.0 - 2024-06-06
6.12.9 - 2024-05-24
6.12.8 - 2024-04-10
6.12.7 - 2024-03-01
6.12.6 - 2024-01-22
6.12.5 - 2024-01-03
6.12.4 - 2023-12-27
6.12.3 - 2023-11-07
6.12.2 - 2023-10-25
6.12.1 - 2023-10-12
6.12.0 - 2023-08-24
6.11.6 - 2023-08-21
6.11.5 - 2023-08-01
6.11.4 - 2023-07-17
6.11.3 - 2023-07-11
6.11.2 - 2023-06-08
6.11.1 - 2023-05-08
6.11.0 - 2023-05-01
6.10.5 - 2023-04-06
6.10.4 - 2023-03-21
6.10.3 - 2023-03-13
6.10.2 - 2023-03-07
6.10.1 - 2023-03-03
6.10.0 - 2023-02-22
6.9.3 - 2023-02-22
6.9.2 - 2023-02-16
6.9.1 - 2023-02-06
6.9.0 - 2023-01-25
6.8.4 - 2023-01-17
6.8.3 - 2023-01-06
6.8.2 - 2022-12-28
6.8.1 - 2022-12-19
6.8.0 - 2022-12-05
6.7.5 - 2022-11-30
6.7.4 - 2022-11-28
6.7.3 - 2022-11-22
6.7.2 - 2022-11-07
6.7.1 - 2022-11-02
6.7.0 - 2022-10-24
6.6.7 - 2022-10-21
6.6.6 - 2022-10-20
6.6.5 - 2022-10-05
6.6.4 - 2022-10-03
6.6.3 - 2022-09-30
6.6.2 - 2022-09-26
6.6.1 - 2022-09-14
6.6.0 - 2022-09-08
6.5.5 - 2022-09-07
6.5.4 - 2022-08-30

from mongoose GitHub release notes

Package name: nodemon

2.0.22 - 2023-03-22
2.0.22 (2023-03-22)

Bug Fixes
- remove ts mapping if loader present (f7816e4), closes #2083
2.0.21 - 2023-03-02
2.0.21 (2023-03-02)

Bug Fixes
- remove ts mapping if loader present (1468397), closes #2083
2.0.20 - 2022-09-16
2.0.20 (2022-09-16)

Bug Fixes
- remove postinstall script (e099e91)
2.0.19 - 2022-07-05
2.0.19 (2022-07-05)

Bug Fixes
- Replace update notifier with simplified deps (#2033) (176c4a6), closes #1961 #2028

from nodemon GitHub release notes

Package name: socket.io

4.7.5 - 2024-03-14
Bug Fixes
- close the adapters when the server is closed (bf64870)
- remove duplicate pipeline when serving bundle (e426f3e)
Links
- Diff: 4.7.4...4.7.5
- Client release: 4.7.5
- engine.io@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.4 - 2024-01-12
Bug Fixes
- typings: calling io.emit with no arguments incorrectly errored (cb6d2e0), closes #4914
Links
- Diff: 4.7.3...4.7.4
- Client release: 4.7.4
- engine.io@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.3 - 2024-01-03
Bug Fixes
- return the first response when broadcasting to a single socket (#4878) (df8e70f)
- typings: allow to bind to a non-secure Http2Server (#4853) (8c9ebc3)
Links
- Diff: 4.7.2...4.7.3
- Client release: 4.7.3
- engine.io@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.2 - 2023-08-02
Bug Fixes
- clean up child namespace when client is rejected in middleware (#4773) (0731c0d)
- webtransport: properly handle WebTransport-only connections (3468a19)
- webtransport: add proper framing (a306db0)
Links
- Diff: 4.7.1...4.7.2
- Client release: 4.7.2
- engine.io@~6.5.2 (diff)
- ws@~8.11.0 (no change)
4.7.1 - 2023-06-28
The client bundle contains a few fixes regarding the WebTransport support.

Links
- Diff: 4.7.0...4.7.1
- Client release: 4.7.1
- engine.io@~6.5.0 (no change)
- ws@~8.11.0 (no change)
4.7.0 - 2023-06-22
Bug Fixes
- remove the Partial modifier from the socket.data type (#4740) (e5c62ca)
Features

Support for WebTransport

The Socket.IO server can now use WebTransport as the underlying transport.

WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

References:
Until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:

https://w3c.github.io/webtransport/#custom-certificate-requirements)
const cert = readFileS...

Snyk has created this PR to upgrade: - bcrypt from 5.0.1 to 5.1.1. See this package in npm: https://www.npmjs.com/package/bcrypt - cloudinary from 1.31.0 to 1.41.3. See this package in npm: https://www.npmjs.com/package/cloudinary - dotenv from 16.0.2 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - express from 4.18.1 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - moment from 2.29.4 to 2.30.1. See this package in npm: https://www.npmjs.com/package/moment - mongoose from 6.5.4 to 6.13.0. See this package in npm: https://www.npmjs.com/package/mongoose - nodemon from 2.0.19 to 2.0.22. See this package in npm: https://www.npmjs.com/package/nodemon - socket.io from 4.5.1 to 4.7.5. See this package in npm: https://www.npmjs.com/package/socket.io - socket.io-client from 4.5.3 to 4.7.5. See this package in npm: https://www.npmjs.com/package/socket.io-client - stripe from 10.7.0 to 10.17.0. See this package in npm: https://www.npmjs.com/package/stripe - validator from 13.7.0 to 13.12.0. See this package in npm: https://www.npmjs.com/package/validator See this project in Snyk: https://app.snyk.io/org/kottagenvh/project/1f6e4185-c6f7-40c8-9c37-6f6ec2310bdc?utm_source=github&utm_medium=referral&page=upgrade-pr

netlify · 2024-09-15T10:26:51Z

❌ Deploy Preview for polite-dragon-8754d9 failed.

Name	Link
🔨 Latest commit	`d078b09`
🔍 Latest deploy log	https://app.netlify.com/sites/polite-dragon-8754d9/deploys/66e6b65b994b0a000895fe5a

netlify · 2024-09-15T10:28:24Z

❌ Deploy Preview for lustrous-crepe-2ddaec failed.

Name	Link
🔨 Latest commit	`d078b09`
🔍 Latest deploy log	https://app.netlify.com/sites/lustrous-crepe-2ddaec/deploys/66e6b65bfb67f90008a88c6b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: bcrypt, cloudinary, dotenv, express, moment, mongoose, nodemon, socket.io, socket.io-client, stripe, validator #1

[Snyk] Upgrade: bcrypt, cloudinary, dotenv, express, moment, mongoose, nodemon, socket.io, socket.io-client, stripe, validator #1

KOTTAGENVH commented Sep 15, 2024

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

2.0.22 (2023-03-22)

Bug Fixes

2.0.21 (2023-03-02)

Bug Fixes

2.0.20 (2022-09-16)

Bug Fixes

2.0.19 (2022-07-05)

Bug Fixes

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Links

Links

Bug Fixes

Features

Support for WebTransport

netlify bot commented Sep 15, 2024 •

edited

Loading

netlify bot commented Sep 15, 2024 •

edited

Loading

[Snyk] Upgrade: bcrypt, cloudinary, dotenv, express, moment, mongoose, nodemon, socket.io, socket.io-client, stripe, validator #1

Are you sure you want to change the base?

[Snyk] Upgrade: bcrypt, cloudinary, dotenv, express, moment, mongoose, nodemon, socket.io, socket.io-client, stripe, validator #1

Conversation

KOTTAGENVH commented Sep 15, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

2.0.22 (2023-03-22)

Bug Fixes

2.0.21 (2023-03-02)

Bug Fixes

2.0.20 (2022-09-16)

Bug Fixes

2.0.19 (2022-07-05)

Bug Fixes

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Links

Links

Bug Fixes

Features

Support for WebTransport

netlify bot commented Sep 15, 2024 • edited Loading

❌ Deploy Preview for polite-dragon-8754d9 failed.

netlify bot commented Sep 15, 2024 • edited Loading

❌ Deploy Preview for lustrous-crepe-2ddaec failed.

netlify bot commented Sep 15, 2024 •

edited

Loading

netlify bot commented Sep 15, 2024 •

edited

Loading