[Snyk] Upgrade express from 4.5.1 to 4.18.2 #1

anantshri · 2023-02-26T00:33:40Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade express from 4.5.1 to 4.18.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 67 versions ahead of your current version.
The recommended version was released 5 months ago, on 2022-10-08.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Regular Expression Denial of Service (ReDoS) npm:negotiator:20160616	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:ms:20151024	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Directory Traversal npm:send:20140912	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Root Path Disclosure npm:send:20151103	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Directory Traversal npm:send:20140912	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Root Path Disclosure npm:send:20151103	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:debug:20170905	589/1000 Why? Has a fix available, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) npm:ms:20170412	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) npm:debug:20170905	589/1000 Why? Has a fix available, CVSS 7.5	Proof of Concept
Open Redirect npm:serve-static:20150113	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: express

4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: [email protected]
  - deps: [email protected]
  - perf: remove unnecessary object clone
- deps: [email protected]
4.18.1 - 2022-04-29
- Fix hanging on large stack of sync routes
4.18.0 - 2022-04-25
- Add "root" option to res.download
- Allow options without filename in res.download
- Deprecate string and non-integer arguments to res.status
- Fix behavior of null/undefined as maxAge in res.cookie
- Fix handling very large stacks of sync middleware
- Ignore Object.prototype values in settings through app.set/app.get
- Invoke default with same arguments as types in res.format
- Support proper 205 responses using res.send
- Use http-errors for res.format error
- deps: [email protected]
  - Fix error message for json parse whitespace in strict
  - Fix internal error when inflated body exceeds limit
  - Prevent loss of async hooks context
  - Prevent hanging when request already read
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Add priority option
  - Fix expires option to reject invalid dates
- deps: [email protected]
  - Replace internal eval usage with Function constructor
  - Use instance methods on process to check for listeners
- deps: [email protected]
  - Remove set content headers that break response
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Prevent loss of async hooks context
- deps: [email protected]
- deps: [email protected]
  - Fix emitted 416 error missing headers property
  - Limit the headers removed for 304 response
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Remove code 306
  - Rename 425 Unordered Collection to standard 425 Too Early
4.17.3 - 2022-02-17
- deps: accepts@~1.3.8
  - deps: mime-types@~2.1.34
  - deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - Fix handling of __proto__ keys
- pref: remove unnecessary regexp for trust proxy
4.17.2 - 2021-12-17
- Fix handling of undefined in res.jsonp
- Fix handling of undefined when "json escape" is enabled
- Fix incorrect middleware execution with unanchored RegExps
- Fix res.jsonp(obj, status) deprecation message
- Fix typo in res.is JSDoc
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.18
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
  - Fix maxAge option to reject invalid values
- deps: proxy-addr@~2.0.7
  - Use req.socket over deprecated req.connection
  - deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - pref: ignore empty http tokens
- deps: [email protected]
  - deps: [email protected]
- deps: [email protected]
4.17.1 - 2019-05-26
- Revert "Improve error message for null/undefined to res.status"
4.17.0 - 2019-05-17
- Add express.raw to parse bodies into Buffer
- Add express.text to parse bodies into string
- Improve error message for non-strings to res.sendFile
- Improve error message for null/undefined to res.status
- Support multiple hosts in X-Forwarded-Host
- deps: accepts@~1.3.7
- deps: [email protected]
  - Add encoding MIK
  - Add petabyte (pb) support
  - Fix parsing array brackets after index
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.17
- deps: [email protected]
- deps: [email protected]
  - Add SameSite=None support
- deps: finalhandler@~1.1.2
  - Set stricter Content-Security-Policy header
  - deps: parseurl@~1.3.3
  - deps: statuses@~1.5.0
- deps: parseurl@~1.3.3
- deps: proxy-addr@~2.0.5
  - deps: [email protected]
- deps: [email protected]
  - Fix parsing array brackets after index
- deps: range-parser@~1.2.1
- deps: [email protected]
  - Set stricter CSP header in redirect & error responses
  - deps: http-errors@~1.7.2
  - deps: [email protected]
  - deps: [email protected]
  - deps: range-parser@~1.2.1
  - deps: statuses@~1.5.0
  - perf: remove redundant path.normalize call
- deps: [email protected]
  - Set stricter CSP header in redirect response
  - deps: parseurl@~1.3.3
  - deps: [email protected]
- deps: [email protected]
- deps: statuses@~1.5.0
  - Add 103 Early Hints
- deps: type-is@~1.6.18
  - deps: mime-types@~2.1.24
  - perf: prevent internal throw on invalid type
4.16.4 - 2018-10-11
4.16.3 - 2018-03-12
4.16.2 - 2017-10-10
4.16.1 - 2017-09-29
4.16.0 - 2017-09-28
4.15.5 - 2017-09-25
4.15.4 - 2017-08-07
4.15.3 - 2017-05-17
4.15.2 - 2017-03-06
4.15.1 - 2017-03-06
4.15.0 - 2017-03-01
4.14.1 - 2017-01-28
4.14.0 - 2016-06-16
4.13.4 - 2016-01-22
4.13.3 - 2015-08-03
4.13.2 - 2015-07-31
4.13.1 - 2015-07-06
4.13.0 - 2015-06-21
4.12.4 - 2015-05-18
4.12.3 - 2015-03-17
4.12.2 - 2015-03-03
4.12.1 - 2015-03-02
4.12.0 - 2015-02-23
4.11.2 - 2015-02-01
4.11.1 - 2015-01-21
4.11.0 - 2015-01-14
4.10.8 - 2015-01-13
4.10.7 - 2015-01-05
4.10.6 - 2014-12-13
4.10.5 - 2014-12-11
4.10.4 - 2014-11-25
4.10.3 - 2014-11-24
4.10.2 - 2014-11-10
4.10.1 - 2014-10-29
4.10.0 - 2014-10-24
4.9.8 - 2014-10-18
4.9.7 - 2014-10-10
4.9.6 - 2014-10-09
4.9.5 - 2014-09-25
4.9.4 - 2014-09-20
4.9.3 - 2014-09-18
4.9.2 - 2014-09-18
4.9.1 - 2014-09-17
4.9.0 - 2014-09-09
4.8.8 - 2014-09-05
4.8.7 - 2014-08-30
4.8.6 - 2014-08-28
4.8.5 - 2014-08-19
4.8.4 - 2014-08-15
4.8.3 - 2014-08-11
4.8.2 - 2014-08-07
4.8.1 - 2014-08-06
4.8.0 - 2014-08-06
4.7.4 - 2014-08-04
4.7.3 - 2014-08-04
4.7.2 - 2014-07-27
4.7.1 - 2014-07-26
4.7.0 - 2014-07-26
4.6.1 - 2014-07-13
4.6.0 - 2014-07-12
4.5.1 - 2014-07-06