Update dependency express to v4.21.1 #1

mend-for-github-com · 2024-04-16T09:37:30Z

This PR contains the following updates:

Package	Type	Update	Change
express (source)	dependencies	minor	`4.16.4` -> `4.21.1`

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	CVE	Reachability
High	7.5	CVE-2022-24999	Reachable
High	7.5	CVE-2024-45296	Reachable
High	7.5	CVE-2024-52798	Reachable
Medium	6.1	CVE-2024-29041	Reachable
Medium	5.3	CVE-2024-47764	Reachable
Medium	5.0	CVE-2024-43796	Reachable
Medium	5.0	CVE-2024-43799	Reachable
Medium	5.0	CVE-2024-43800	Reachable

Release Notes

expressjs/express (express)

==========

deps: [email protected]
- Remove link renderization in html while redirecting
deps: [email protected]
- Remove link renderization in html while redirecting
deps: [email protected]
- add depth option to customize the depth level in the parser
- IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
Remove link renderization in html while using res.redirect
deps: [email protected]
- Adds support for named matching groups in the routes using a regex
- Adds backtracking protection to parameters without regexes defined
deps: encodeurl@~2.0.0
- Removes encoding of \, |, and ^ to align better with URL spec
Deprecate passing options.maxAge and options.expires to res.clearCookie
- Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

`v4.19.2`

Compare Source

==========

Improved fix for open redirect allow list bypass

`v4.19.1`

Compare Source

==========

Allow passing non-strings to res.location with new encoding handling checks

`v4.19.0`

Compare Source

==========

Prevent open redirect allow list bypass due to encodeurl
deps: [email protected]

`v4.18.3`

Compare Source

==========

Fix routing requests without method
deps: [email protected]
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
- deps: [email protected]
deps: [email protected]
- Add partitioned option

`v4.18.2`

Compare Source

===================

Fix regression routing a large stack in a single route
deps: [email protected]
- deps: [email protected]
- perf: remove unnecessary object clone
deps: [email protected]

`v4.18.1`

Compare Source

===================

Fix hanging on large stack of sync routes

`v4.18.0`

Compare Source

===================

Add "root" option to res.download
Allow options without filename in res.download
Deprecate string and non-integer arguments to res.status
Fix behavior of null/undefined as maxAge in res.cookie
Fix handling very large stacks of sync middleware
Ignore Object.prototype values in settings through app.set/app.get
Invoke default with same arguments as types in res.format
Support proper 205 responses using res.send
Use http-errors for res.format error
deps: [email protected]
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
deps: [email protected]
- Add priority option
- Fix expires option to reject invalid dates
deps: [email protected]
- Replace internal eval usage with Function constructor
- Use instance methods on process to check for listeners
deps: [email protected]
- Remove set content headers that break response
- deps: [email protected]
- deps: [email protected]
deps: [email protected]
- Prevent loss of async hooks context
deps: [email protected]
deps: [email protected]
- Fix emitted 416 error missing headers property
- Limit the headers removed for 304 response
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
deps: [email protected]
- deps: [email protected]
deps: [email protected]
- Remove code 306
- Rename 425 Unordered Collection to standard 425 Too Early

`v4.17.3`

Compare Source

===================

deps: accepts@~1.3.8
- deps: mime-types@~2.1.34
- deps: [email protected]
deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
deps: [email protected]
deps: [email protected]
- Fix handling of __proto__ keys
pref: remove unnecessary regexp for trust proxy

`v4.17.2`

Compare Source

===================

Fix handling of undefined in res.jsonp
Fix handling of undefined when "json escape" is enabled
Fix incorrect middleware execution with unanchored RegExps
Fix res.jsonp(obj, status) deprecation message
Fix typo in res.is JSDoc
deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: type-is@~1.6.18
deps: [email protected]
- deps: [email protected]
deps: [email protected]
- Fix maxAge option to reject invalid values
deps: proxy-addr@~2.0.7
- Use req.socket over deprecated req.connection
- deps: [email protected]
- deps: [email protected]
deps: [email protected]
deps: [email protected]
deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- pref: ignore empty http tokens
deps: [email protected]
- deps: [email protected]
deps: [email protected]

`v4.17.1`

Compare Source

===================

Revert "Improve error message for null/undefined to res.status"

`v4.17.0`

Compare Source

===================

Add express.raw to parse bodies into Buffer
Add express.text to parse bodies into string
Improve error message for non-strings to res.sendFile
Improve error message for null/undefined to res.status
Support multiple hosts in X-Forwarded-Host
deps: accepts@~1.3.7
deps: [email protected]
- Add encoding MIK
- Add petabyte (pb) support
- Fix parsing array brackets after index
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: type-is@~1.6.17
deps: [email protected]
deps: [email protected]
- Add SameSite=None support
deps: finalhandler@~1.1.2
- Set stricter Content-Security-Policy header
- deps: parseurl@~1.3.3
- deps: statuses@~1.5.0
deps: parseurl@~1.3.3
deps: proxy-addr@~2.0.5
- deps: [email protected]
deps: [email protected]
- Fix parsing array brackets after index
deps: range-parser@~1.2.1
deps: [email protected]
- Set stricter CSP header in redirect & error responses
- deps: http-errors@~1.7.2
- deps: [email protected]
- deps: [email protected]
- deps: range-parser@~1.2.1
- deps: statuses@~1.5.0
- perf: remove redundant path.normalize call
deps: [email protected]
- Set stricter CSP header in redirect response
- deps: parseurl@~1.3.3
- deps: [email protected]
deps: [email protected]
deps: statuses@~1.5.0
- Add 103 Early Hints
deps: type-is@~1.6.18
- deps: mime-types@~2.1.24
- perf: prevent internal throw on invalid type

If you want to rebase/retry this PR, check this box

mend-for-github-com · 2025-03-08T13:27:29Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: NodeGoat/package-lock.json

mend-for-github-com bot added the security fix Security fix generated by Mend label Apr 16, 2024

mend-for-github-com bot changed the title ~~Update dependency express to v4.19.0~~ Update dependency express to v4.20.0 Sep 25, 2024

mend-for-github-com bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from 7134ff8 to 8509ee8 Compare September 25, 2024 00:53

mend-for-github-com bot changed the title ~~Update dependency express to v4.20.0~~ Update dependency express to v4.21.2 Dec 6, 2024

mend-for-github-com bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from 8509ee8 to 8cfb5d0 Compare December 6, 2024 20:28

mend-for-github-com bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from 8cfb5d0 to 66246d4 Compare January 27, 2025 05:07

mend-for-github-com bot force-pushed the whitesource-remediate/express-4.x-lockfile branch 2 times, most recently from 5bec850 to 69bc83c Compare February 13, 2025 09:36

mend-for-github-com bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from 69bc83c to 640bea6 Compare February 23, 2025 09:55

mend-for-github-com bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from 640bea6 to bf57c7f Compare March 4, 2025 09:03

Update dependency express to v4.21.1

b9c704c

mend-for-github-com bot force-pushed the whitesource-remediate/express-4.x-lockfile branch from bf57c7f to b9c704c Compare March 5, 2025 15:44

mend-for-github-com bot changed the title ~~Update dependency express to v4.21.2~~ Update dependency express to v4.21.1 Mar 5, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency express to v4.21.1 #1

Update dependency express to v4.21.1 #1

mend-for-github-com bot commented Apr 16, 2024 •

edited

Loading

mend-for-github-com bot commented Mar 8, 2025

Update dependency express to v4.21.1 #1

Are you sure you want to change the base?

Update dependency express to v4.21.1 #1

Conversation

mend-for-github-com bot commented Apr 16, 2024 • edited Loading

Release Notes

What's Changed

What's Changed

New Contributors

mend-for-github-com bot commented Mar 8, 2025

⚠️ Artifact update problem

File name: NodeGoat/package-lock.json

mend-for-github-com bot commented Apr 16, 2024 •

edited

Loading