Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(dev-dependency): update express #374

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

rolandsusans
Copy link

chore(dev-dependency): update express

This pull request updates the express dependency in the package.json file to ensure compatibility with the latest features and security patches.

Dependency updates:

  • package.json: Updated express from version ^4.19.2 to ^4.21.0.

@IlmariKu
Copy link

IlmariKu commented Sep 16, 2024

Yep, please merge this @scottie1984. There's 3 high security vulnerabilities with the express-dependency.

body-parser  <1.20.3
Severity: high
body-parser vulnerable to denial of service when url encoding is enabled - https://github.com/advisories/GHSA-qwcr-r2fm-qrc7

body-parser@1.20.2
node_modules/body-parser
  body-parser@"1.20.2" from express@4.19.2
  node_modules/express
    express@"^4.19.2" from the root project
    peer express@">=4.0.0 || >=5.0.0-beta" from swagger-ui-express@5.0.0
    node_modules/swagger-ui-express
      swagger-ui-express@"^5.0.0" from the root project

@@ -29,7 +29,7 @@
},
"devDependencies": {
"es6-shim": "0.35.8",
"express": "^4.19.2",
"express": "^4.21.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Express 4.21.1 was released on 2024-10-08 to address an issue with a vulnerability on the cookie npm
expressjs/express#6026

@Edwin-WB-Li
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants