Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency express to v4.21.1 #2

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update dependency express to v4.21.1 #2

wants to merge 1 commit into from

Conversation

mend-for-jackfan.us.kg[bot]
Copy link

@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot commented Aug 12, 2024 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
express (source) dependencies minor 4.18.1 -> 4.21.1

By merging this PR, the issue #8 will be automatically resolved and closed:

Severity CVSS Score CVE Reachability
Medium Medium 6.1 CVE-2024-29041

Reachable
Medium Medium 5.3 CVE-2024-47764

Reachable
Medium Medium 5.0 CVE-2024-43796

Reachable
Medium Medium 5.0 CVE-2024-43800

Reachable

Release Notes

expressjs/express (express)

v4.21.1

Compare Source

What's Changed

Full Changelog: expressjs/express@4.21.0...4.21.1

v4.21.0

Compare Source

What's Changed

New Contributors

Full Changelog: expressjs/express@4.20.0...4.21.0

v4.20.0

Compare Source

==========

  • deps: [email protected]
    • Remove link renderization in html while redirecting
  • deps: [email protected]
    • Remove link renderization in html while redirecting
  • deps: [email protected]
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: [email protected]
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

v4.19.2

Compare Source

==========

  • Improved fix for open redirect allow list bypass

v4.19.1

Compare Source

==========

  • Allow passing non-strings to res.location with new encoding handling checks

v4.19.0

Compare Source

==========

v4.18.3

Compare Source

==========

v4.18.2

Compare Source

===================

  • If you want to rebase/retry this PR, check this box

@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot added the security fix Security fix generated by Mend label Aug 12, 2024
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from 0dc2ce1 to 67119e8 Compare August 12, 2024 17:33
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 5 times, most recently from 1cb5768 to 6d1bac8 Compare August 28, 2024 06:19
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 2 times, most recently from 69056df to 5beb21b Compare September 3, 2024 06:20
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 3 times, most recently from 5e69e10 to ef73728 Compare September 12, 2024 21:18
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 2 times, most recently from 1ff8fd6 to c4b0169 Compare September 17, 2024 07:37
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from c4b0169 to 7d22c9d Compare September 25, 2024 05:24
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot changed the title Update dependency express to v4.19.0 Update dependency express to v4.20.0 Sep 30, 2024
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 3 times, most recently from 955efe5 to 551a6c2 Compare October 6, 2024 00:53
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 2 times, most recently from c67fce9 to 598490b Compare October 10, 2024 06:05
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 3 times, most recently from 20d140c to 7c7b8fe Compare October 23, 2024 05:47
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 3 times, most recently from af96be7 to b20e940 Compare October 31, 2024 11:21
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from b20e940 to b928aa8 Compare November 9, 2024 08:37
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from b928aa8 to 65d3177 Compare November 19, 2024 13:31
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from 65d3177 to 67e5d02 Compare November 30, 2024 06:10
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 5 times, most recently from 9783708 to a1b929d Compare December 6, 2024 05:17
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot changed the title Update dependency express to v4.20.0 Update dependency express to v4.21.2 Dec 6, 2024
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 3 times, most recently from 1bb19e6 to d717ee1 Compare January 31, 2025 05:10
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 3 times, most recently from b4c2644 to b7bb1cf Compare February 6, 2025 09:53
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 3 times, most recently from e99c71e to 7d648fa Compare February 18, 2025 19:05
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 3 times, most recently from 4eebff5 to 095eb39 Compare February 26, 2025 09:44
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot changed the title Update dependency express to v4.21.2 Update dependency express to v4.21.1 Mar 3, 2025
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from 095eb39 to 542a5b0 Compare March 3, 2025 18:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
security fix Security fix generated by Mend
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants