[Snyk] Upgrade express from 4.13.4 to 4.17.1 #33

snyk-bot · 2021-08-04T23:10:23Z

Snyk has created this PR to upgrade express from 4.13.4 to 4.17.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 15 versions ahead of your current version.
The recommended version was released 2 years ago, on 2019-05-26.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Prototype Override Protection Bypass npm:qs:20170213	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:negotiator:20160616	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:fresh:20170908	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:ms:20170412	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:mime:20170907	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: express

4.17.1 - 2019-05-26
- Revert "Improve error message for null/undefined to res.status"
4.17.0 - 2019-05-17
- Add express.raw to parse bodies into Buffer
- Add express.text to parse bodies into string
- Improve error message for non-strings to res.sendFile
- Improve error message for null/undefined to res.status
- Support multiple hosts in X-Forwarded-Host
- deps: accepts@~1.3.7
- deps: [email protected]
  - Add encoding MIK
  - Add petabyte (pb) support
  - Fix parsing array brackets after index
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.17
- deps: [email protected]
- deps: [email protected]
  - Add SameSite=None support
- deps: finalhandler@~1.1.2
  - Set stricter Content-Security-Policy header
  - deps: parseurl@~1.3.3
  - deps: statuses@~1.5.0
- deps: parseurl@~1.3.3
- deps: proxy-addr@~2.0.5
  - deps: [email protected]
- deps: [email protected]
  - Fix parsing array brackets after index
- deps: range-parser@~1.2.1
- deps: [email protected]
  - Set stricter CSP header in redirect & error responses
  - deps: http-errors@~1.7.2
  - deps: [email protected]
  - deps: [email protected]
  - deps: range-parser@~1.2.1
  - deps: statuses@~1.5.0
  - perf: remove redundant path.normalize call
- deps: [email protected]
  - Set stricter CSP header in redirect response
  - deps: parseurl@~1.3.3
  - deps: [email protected]
- deps: [email protected]
- deps: statuses@~1.5.0
  - Add 103 Early Hints
- deps: type-is@~1.6.18
  - deps: mime-types@~2.1.24
  - perf: prevent internal throw on invalid type
4.16.4 - 2018-10-11
- Fix issue where "Request aborted" may be logged in res.sendfile
- Fix JSDoc for Router constructor
- deps: [email protected]
  - Fix deprecation warnings on Node.js 10+
  - Fix stack trace for strict json parse error
  - deps: depd@~1.1.2
  - deps: http-errors@~1.6.3
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.16
- deps: proxy-addr@~2.0.4
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
4.16.3 - 2018-03-12
- deps: accepts@~1.3.5
  - deps: mime-types@~2.1.18
- deps: depd@~1.1.2
  - perf: remove argument reassignment
- deps: encodeurl@~1.0.2
  - Fix encoding % as last character
- deps: [email protected]
  - Fix 404 output for bad / missing pathnames
  - deps: encodeurl@~1.0.2
  - deps: statuses@~1.4.0
- deps: proxy-addr@~2.0.3
  - deps: [email protected]
- deps: [email protected]
  - Fix incorrect end tag in default error & redirects
  - deps: depd@~1.1.2
  - deps: encodeurl@~1.0.2
  - deps: statuses@~1.4.0
- deps: [email protected]
  - Fix incorrect end tag in redirects
  - deps: encodeurl@~1.0.2
  - deps: [email protected]
- deps: statuses@~1.4.0
- deps: type-is@~1.6.16
  - deps: mime-types@~2.1.18
4.16.2 - 2017-10-10
- Fix TypeError in res.send when given Buffer and ETag header set
- perf: skip parsing of entire X-Forwarded-Proto header
4.16.1 - 2017-09-29
- deps: [email protected]
- deps: [email protected]
  - Fix regression when root is incorrectly set to a file
  - deps: [email protected]
4.16.0 - 2017-09-28
- Add "json escape" setting for res.json and res.jsonp
- Add express.json and express.urlencoded to parse bodies
- Add options argument to res.download
- Improve error message when autoloading invalid view engine
- Improve error messages when non-function provided as middleware
- Skip Buffer encoding when not generating ETag for small response
- Use safe-buffer for improved Buffer API
- deps: accepts@~1.3.4
  - deps: mime-types@~2.1.16
- deps: content-type@~1.0.4
  - perf: remove argument reassignment
  - perf: skip parameter parsing when no parameters
- deps: etag@~1.8.1
  - perf: replace regular expression with substring
- deps: [email protected]
  - Use res.headersSent when available
- deps: parseurl@~1.3.2
  - perf: reduce overhead for full URLs
  - perf: unroll the "fast-path" RegExp
- deps: proxy-addr@~2.0.2
  - Fix trimming leading / trailing OWS in X-Forwarded-For
  - deps: forwarded@~0.1.2
  - deps: [email protected]
  - perf: reduce overhead when no X-Forwarded-For header
- deps: [email protected]
  - Fix parsing & compacting very deep objects
- deps: [email protected]
  - Add 70 new types for file extensions
  - Add immutable option
  - Fix missing </html> in default error & redirects
  - Set charset as "UTF-8" for .js and .json
  - Use instance methods on steam to check for listeners
  - deps: [email protected]
  - perf: improve path validation speed
- deps: [email protected]
  - Add 70 new types for file extensions
  - Add immutable option
  - Set charset as "UTF-8" for .js and .json
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: vary@~1.1.2
  - perf: improve header token parsing speed
- perf: re-use options object when generating ETags
- perf: remove dead .charset set in res.jsonp
4.15.5 - 2017-09-25
4.15.4 - 2017-08-07
4.15.3 - 2017-05-17
4.15.2 - 2017-03-06
4.15.1 - 2017-03-06
4.15.0 - 2017-03-01
4.14.1 - 2017-01-28
4.14.0 - 2016-06-16
4.13.4 - 2016-01-22