fix(deps): update mend: high confidence minor and patch dependency updates#3
Conversation
|
7a23f3c to
4d6faa8
Compare
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Deserialization Of Untrusted Data In Bson
mongoose>bson
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Deserialization of Untrusted Data in bson" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "jquery": "^2.2.4", | ||
| "lodash": "4.17.4", | ||
| "marked": "0.3.5", | ||
| "lodash": "4.17.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Regular Expression Denial Of Service (Redos) In Lodash
Paths from library to vulnerable dependencies:
- lodash
- mongoose>async>lodash
- snyk>@snyk/dep-graph>graphlib>lodash
- tap>nyc>istanbul-lib-instrument>babel-generator>lodash
Severity: CRITICAL
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Regular Expression Denial of Service (ReDoS) in lodash" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Prototype Pollution In Async
Paths from library to vulnerable dependencies:
- mongoose>async
- snyk>snyk-config>nconf>async
- tap>nyc>istanbul-reports>handlebars>async
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Prototype Pollution in async" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Automattic/Mongoose Vulnerable To Prototype Pollution Via Schema.Path
mongoose
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "automattic/mongoose vulnerable to Prototype pollution via Schema.path" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Denial Of Service In Mongodb
mongoose>mongodb
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Denial of Service in mongodb" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "lodash": "4.17.4", | ||
| "marked": "0.3.5", | ||
| "lodash": "4.17.21", | ||
| "marked": "0.8.2", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Inefficient Regular Expression Complexity In Marked
marked
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "marked": "0.8.2", | |
| "marked": "15.0.6", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Inefficient Regular Expression Complexity in marked" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
4d6faa8 to
92f8f1b
Compare
package.json
Outdated
| "humanize-ms": "1.0.1", | ||
| "jquery": "^2.2.4", | ||
| "lodash": "4.17.4", | ||
| "lodash": "4.17.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Regular Expression Denial Of Service (Redos) In Lodash
Paths from library to vulnerable dependencies:
- lodash
- mongoose>async>lodash
- tap>nyc>istanbul-lib-instrument>babel-generator>lodash
Severity: CRITICAL
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Regular Expression Denial of Service (ReDoS) in lodash" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Deserialization Of Untrusted Data In Bson
mongoose>bson
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Deserialization of Untrusted Data in bson" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Prototype Pollution In Async
Paths from library to vulnerable dependencies:
- mongoose>async
- tap>nyc>istanbul-reports>handlebars>async
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Prototype Pollution in async" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Denial Of Service In Mongodb
mongoose>mongodb
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Denial of Service in mongodb" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Automattic/Mongoose Vulnerable To Prototype Pollution Via Schema.Path
mongoose
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "automattic/mongoose vulnerable to Prototype pollution via Schema.path" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
92f8f1b to
bb64f6e
Compare
package.json
Outdated
| "lodash": "4.17.4", | ||
| "marked": "0.3.5", | ||
| "lodash": "4.17.21", | ||
| "marked": "0.8.2", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Inefficient Regular Expression Complexity In Marked
marked
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "marked": "0.8.2", | |
| "marked": "15.0.6", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Inefficient Regular Expression Complexity in marked" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "jquery": "^2.2.4", | ||
| "lodash": "4.17.4", | ||
| "marked": "0.3.5", | ||
| "lodash": "4.17.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Regular Expression Denial Of Service (Redos) In Lodash
Paths from library to vulnerable dependencies:
- lodash
- mongoose>async>lodash
- tap>nyc>istanbul-lib-instrument>babel-generator>lodash
Severity: CRITICAL
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Regular Expression Denial of Service (ReDoS) in lodash" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Deserialization Of Untrusted Data In Bson
mongoose>bson
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Deserialization of Untrusted Data in bson" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Automattic/Mongoose Vulnerable To Prototype Pollution Via Schema.Path
mongoose
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "automattic/mongoose vulnerable to Prototype pollution via Schema.path" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Denial Of Service In Mongodb
mongoose>mongodb
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Denial of Service in mongodb" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Prototype Pollution In Async
Paths from library to vulnerable dependencies:
- mongoose>async
- tap>nyc>istanbul-reports>handlebars>async
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.9.5", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Prototype Pollution in async" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
bb64f6e to
d9d4cc1
Compare
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Automattic/Mongoose Vulnerable To Prototype Pollution Via Schema.Path
mongoose
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.10.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "automattic/mongoose vulnerable to Prototype pollution via Schema.path" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "humanize-ms": "1.0.1", | ||
| "jquery": "^2.2.4", | ||
| "lodash": "4.17.4", | ||
| "lodash": "4.17.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Regular Expression Denial Of Service (Redos) In Lodash
Paths from library to vulnerable dependencies:
- lodash
- mongoose>async>lodash
- tap>nyc>istanbul-lib-instrument>babel-generator>lodash
Severity: CRITICAL
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Regular Expression Denial of Service (ReDoS) in lodash" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Prototype Pollution In Async
Paths from library to vulnerable dependencies:
- mongoose>async
- tap>nyc>istanbul-reports>handlebars>async
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.10.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Prototype Pollution in async" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Denial Of Service In Mongodb
mongoose>mongodb
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.10.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Denial of Service in mongodb" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Deserialization Of Untrusted Data In Bson
mongoose>bson
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.10.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Deserialization of Untrusted Data in bson" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
d9d4cc1 to
c29cb81
Compare
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Prototype Pollution In Async
Paths from library to vulnerable dependencies:
- mongoose>async
- tap>nyc>istanbul-reports>handlebars>async
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.11.0", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Prototype Pollution in async" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "humanize-ms": "1.0.1", | ||
| "jquery": "^2.2.4", | ||
| "lodash": "4.17.4", | ||
| "lodash": "4.17.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Regular Expression Denial Of Service (Redos) In Lodash
Paths from library to vulnerable dependencies:
- lodash
- mongoose>async>lodash
- tap>nyc>istanbul-lib-instrument>babel-generator>lodash
Severity: CRITICAL
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Regular Expression Denial of Service (ReDoS) in lodash" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Automattic/Mongoose Vulnerable To Prototype Pollution Via Schema.Path
mongoose
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.11.0", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "automattic/mongoose vulnerable to Prototype pollution via Schema.path" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Deserialization Of Untrusted Data In Bson
mongoose>bson
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.11.0", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Deserialization of Untrusted Data in bson" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Denial Of Service In Mongodb
mongoose>mongodb
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.11.0", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Denial of Service in mongodb" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
c29cb81 to
2d750dc
Compare
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Prototype Pollution In Async
Paths from library to vulnerable dependencies:
- mongoose>async
- tap>nyc>istanbul-reports>handlebars>async
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.12.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Prototype Pollution in async" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "humanize-ms": "1.0.1", | ||
| "jquery": "^2.2.4", | ||
| "lodash": "4.17.4", | ||
| "lodash": "4.17.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Regular Expression Denial Of Service (Redos) In Lodash
Paths from library to vulnerable dependencies:
- lodash
- mongoose>async>lodash
- tap>nyc>istanbul-lib-instrument>babel-generator>lodash
Severity: CRITICAL
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Regular Expression Denial of Service (ReDoS) in lodash" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Automattic/Mongoose Vulnerable To Prototype Pollution Via Schema.Path
mongoose
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.12.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "automattic/mongoose vulnerable to Prototype pollution via Schema.path" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Denial Of Service In Mongodb
mongoose>mongodb
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.12.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Denial of Service in mongodb" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Deserialization Of Untrusted Data In Bson
mongoose>bson
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.12.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Deserialization of Untrusted Data in bson" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
2d750dc to
1f7a6e2
Compare
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Deserialization Of Untrusted Data In Bson
mongoose>bson
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.13.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Deserialization of Untrusted Data in bson" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Prototype Pollution In Async
Paths from library to vulnerable dependencies:
- mongoose>async
- snyk>snyk-config>nconf>async
- tap>nyc>istanbul-reports>handlebars>async
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.13.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Prototype Pollution in async" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Automattic/Mongoose Vulnerable To Prototype Pollution Via Schema.Path
mongoose
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.13.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "automattic/mongoose vulnerable to Prototype pollution via Schema.path" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| "moment": "2.15.1", | ||
| "mongoose": "4.2.4", | ||
| "moment": "2.30.1", | ||
| "mongoose": "4.13.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Denial Of Service In Mongodb
mongoose>mongodb
Severity: CRITICAL
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "mongoose": "4.13.21", | |
| "mongoose": "8.13.1", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Denial of Service in mongodb" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "lodash": "4.17.4", | ||
| "marked": "0.3.5", | ||
| "lodash": "4.17.21", | ||
| "marked": "0.8.2", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Inefficient Regular Expression Complexity In Marked
marked
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
Update each outdated library in your code.
Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.
| "marked": "0.8.2", | |
| "marked": "15.0.7", |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Inefficient Regular Expression Complexity in marked" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "jquery": "^2.2.4", | ||
| "lodash": "4.17.4", | ||
| "marked": "0.3.5", | ||
| "lodash": "4.17.21", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Regular Expression Denial Of Service (Redos) In Lodash
Paths from library to vulnerable dependencies:
- lodash
- mongoose>async>lodash
- snyk>@snyk/dep-graph>graphlib>lodash
- tap>nyc>istanbul-lib-instrument>babel-generator>lodash
Severity: CRITICAL
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Regular Expression Denial of Service (ReDoS) in lodash" in package.json; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
1f7a6e2 to
98588e1
Compare
98588e1 to
96e6a76
Compare
9b0a399 to
d191fe5
Compare
7b49252 to
ae5679b
Compare
ae5679b to
ca6c70a
Compare
dea6e4d to
eb43923
Compare
eb43923 to
86b8923
Compare
86b8923 to
d80f725
Compare
d80f725 to
e740632
Compare
e740632 to
a6b0cbc
Compare
a6b0cbc to
f4108b4
Compare
f4108b4 to
27f7d24
Compare
d998bbb to
2541667
Compare
3c30335 to
99034c2
Compare
4afcf0f to
eda6137
Compare
82990df to
9d13ef0
Compare
3f71403 to
0c7b772
Compare
0c7b772 to
b227fb9
Compare
b227fb9 to
d1a3085
Compare
d1a3085 to
7bc2f73
Compare
20e9933 to
7f7ef38
Compare
7f7ef38 to
bb96741
Compare
bb96741 to
c9efd79
Compare
c9efd79 to
88c6374
Compare
This PR contains the following updates:
0.4.11→0.5.171.9.0→1.20.41.3.3→1.4.74.12.4→4.22.12.15.1→2.30.14.2.4→4.13.213.0.2→3.0.3Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
cthackers/adm-zip (adm-zip)
v0.5.17Compare Source
What's Changed
New Contributors
Full Changelog: cthackers/adm-zip@v0.5.16...v0.5.17
v0.5.16Compare Source
What's Changed
New Contributors
Full Changelog: cthackers/adm-zip@v0.5.15...v0.5.16
v0.5.15Compare Source
What's Changed
New Contributors
Full Changelog: cthackers/adm-zip@v0.5.14...v0.5.15
v0.5.14Compare Source
Fixed an issue introduced on version 0.5.13 requiring a new mandatory parameter on the inflater on nodejs version >= 15
v0.5.13Compare Source
v0.5.12Compare Source
Fixed extraction error
v0.5.11Compare Source
v0.5.10Compare Source
v0.5.9Compare Source
v0.5.8Compare Source
v0.5.7Compare Source
v0.5.6: .Compare Source
v0.5.5Compare Source
v0.5.4Compare Source
==================
v0.5.3Compare Source
==================
v0.5.2Compare Source
==================
v0.5.1Compare Source
==================
v0.5.0Compare Source
==================
v0.4.16Compare Source
===================
v0.4.14Compare Source
===================
v0.4.13Compare Source
===================
expressjs/body-parser (body-parser)
v1.20.4Compare Source
===================
v1.20.3Compare Source
===================
depthoption to customize the depth level in the parserdepthlevel for parsing URL-encoded data is now32(previously wasInfinity)v1.20.2Compare Source
===================
v1.20.1Compare Source
===================
v1.20.0Compare Source
===================
strictevalusage withFunctionconstructorprocessto check for listenersv1.19.2Compare Source
===================
__proto__keysv1.19.1Compare Source
===================
v1.19.0Compare Source
===================
pb) supportthrowon invalid typev1.18.3Compare Source
===================
v1.18.2Compare Source
===================
v1.18.1Compare Source
===================
v1.18.0Compare Source
===================
bodyproperty on verify errorstypeproperty on all generated errorshttp-errorsto set status code on errorsBufferloadinghttp-errorsfor standard emitted errorsthrowwhen missing charsetv1.17.2Compare Source
===================
DEBUG_MAX_ARRAY_LENGTHv1.17.1Compare Source
===================
[v1.17.0Compare Source
===================
messageproperty enumerable forHttpErrorsv1.16.1Compare Source
===================
DEBUG_FDset to1or2v1.16.0Compare Source
===================
DEBUG_FDenvironment variablev1.15.2Compare Source
===================
setprototypeofmodule to replace__proto__settingv1.15.1Compare Source
===================
v1.15.0Compare Source
===================
HttpErrorexport, forerr instanceof createError.HttpErrorv1.14.2Compare Source
===================
v1.14.1Compare Source
===================
verifyusediconv-litev1.14.0Compare Source
===================
requireanalysis inurlencodedparserv1.13.3Compare Source
===================
v1.13.2Compare Source
===================
hasOwnPropertymakeErrorv1.13.1Compare Source
===================
v1.13.0Compare Source
===================
statusCodeproperty onErrors, in addition tostatustypedefault toapplication/jsonfor JSON parsertypedefault toapplication/x-www-form-urlencodedfor urlencoded parserrequireanalysishttp-errorsmodule to generate errorsCONNECTrequestsUpgraderequestshasOwnPropertynullprototypeunpipemodule for unpiping requestsv1.12.4Compare Source
===================
constructorv1.12.3Compare Source
===================
v1.12.2Compare Source
===================
hasOwnPropertyis presentv1.12.1Compare Source
===================
v1.12.0Compare Source
===================
debugmessagestypeoptioncontent-typeto parseContent-TypeheadersObject.prototypehasBodyTransfer-Encodingcheck*/*)v1.11.0Compare Source
===================
extended: truedepth limit infinityv1.10.2Compare Source
===================
v1.10.1Compare Source
===================
v1.10.0Compare Source
===================
extended: truearray limit dynamicv1.9.3Compare Source
==================
arrayLimitbehaviorv1.9.2Compare Source
==================
v1.9.1Compare Source
==================
expressjs/cookie-parser (cookie-parser)
v1.4.7Compare Source
==========
hasOwnPropertyserializewithout options, useobj.hasOwnPropertywhen parsingmaintopackage.jsonfor rspackpartitionedoptionpriorityoptionexpiresoption to reject invalid datesv1.4.6Compare Source
==================
v1.4.5Compare Source
==================
v1.4.4Compare Source
==================
secretargument only oncev1.4.3Compare Source
==================
v1.4.2Compare Source
==================
v1.4.1Compare Source
==================
v1.4.0Compare Source
==================
JSONCookieto returnundefinedfor non-string argumentssignedCookieto returnundefinedfor non-string argumentsv1.3.5Compare Source
==================
v1.3.4Compare Source
==================
expressjs/express (express)
v4.22.1Compare Source
What's Changed
Full Changelog: expressjs/express@4.22.0...v4.22.1
v4.22.0Compare Source
Important: Security
What's Changed
npm isteps to fix ci for older node versions by @Phillip9587 in #6336qsby @Phillip9587 in #6919Full Changelog: expressjs/express@4.21.2...4.22.0
v4.21.2Compare Source
What's Changed
Full Changelog: expressjs/express@4.21.1...4.21.2
v4.21.1Compare Source
What's Changed
Full Changelog: expressjs/express@4.21.0...4.21.1
v4.21.0Compare Source
What's Changed
"back"magic string in redirects by @blakeembrey in #5935New Contributors
Full Changelog: expressjs/express@4.20.0...4.21.0
v4.20.0Compare Source
==========
depthoption to customize the depth level in the parserdepthlevel for parsing URL-encoded data is now32(previously wasInfinity)res.redirect\,|, and^to align better with URL specoptions.maxAgeandoptions.expirestores.clearCookiev4.19.2Compare Source
==========
v4.19.1Compare Source
==========
v4.19.0Compare Source
==========
v4.18.3Compare Source
==========
partitionedoptionv4.18.2Compare Source
===================
v4.18.1Compare Source
===================
v4.18.0Compare Source
===================
res.downloadoptionswithoutfilenameinres.downloadres.statusnull/undefinedasmaxAgeinres.cookieObject.prototypevalues in settings throughapp.set/app.getdefaultwith same arguments as types inres.formatres.sendhttp-errorsforres.formaterrorstrictpriorityoptionexpiresoption to reject invalid datesevalusage withFunctionconstructorprocessto check for listeners425 Unordered Collectionto standard425 Too Earlyv4.17.3Compare Source
===================
__proto__keysv4.17.2Compare Source
===================
undefinedinres.jsonpundefinedwhen"json escape"is enabledRegExpsres.jsonp(obj, status)deprecation messageres.isJSDocConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.