[Snyk] Upgrade express from 4.10.8 to 4.17.1 #1

snyk-bot · 2019-10-26T07:23:58Z

Snyk has created this PR to upgrade express from 4.10.8 to 4.17.1.

The recommended version is 43 versions ahead of your current version.
The recommended version was released 5 months ago, on 2019-05-26.

The recommended version fixes:

Severity	Title	Issue ID
	Regular Expression Denial of Service (ReDoS)	npm:fresh:20170908
	Regular Expression Denial of Service (DoS)	npm:negotiator:20160616
	Prototype Override Protection Bypass	npm:qs:20170213
	Root Path Disclosure	npm:send:20151103
	Regular Expression Denial of Service (ReDoS)	npm:mime:20170907

Release notes

Package name: express
- 4.17.1 - 2019-05-26
 - Revert "Improve error message for null/undefined to res.status"
- 4.17.0 - 2019-05-17
 - Add express.raw to parse bodies into Buffer
 - Add express.text to parse bodies into string
 - Improve error message for non-strings to res.sendFile
 - Improve error message for null/undefined to res.status
 - Support multiple hosts in X-Forwarded-Host
 - deps: accepts@~1.3.7
 - deps: body-parser@1.19.0
 - Add encoding MIK
 - Add petabyte (pb) support
 - Fix parsing array brackets after index
 - deps: bytes@3.1.0
 - deps: http-errors@1.7.2
 - deps: iconv-lite@0.4.24
 - deps: qs@6.7.0
 - deps: raw-body@2.4.0
 - deps: type-is@~1.6.17
 - deps: content-disposition@0.5.3
 - deps: cookie@0.4.0
 - Add SameSite=None support
 - deps: finalhandler@~1.1.2
 - Set stricter Content-Security-Policy header
 - deps: parseurl@~1.3.3
 - deps: statuses@~1.5.0
 - deps: parseurl@~1.3.3
 - deps: proxy-addr@~2.0.5
 - deps: ipaddr.js@1.9.0
 - deps: qs@6.7.0
 - Fix parsing array brackets after index
 - deps: range-parser@~1.2.1
 - deps: send@0.17.1
 - Set stricter CSP header in redirect & error responses
 - deps: http-errors@~1.7.2
 - deps: mime@1.6.0
 - deps: ms@2.1.1
 - deps: range-parser@~1.2.1
 - deps: statuses@~1.5.0
 - perf: remove redundant path.normalize call
 - deps: serve-static@1.14.1
 - Set stricter CSP header in redirect response
 - deps: parseurl@~1.3.3
 - deps: send@0.17.1
 - deps: setprototypeof@1.1.1
 - deps: statuses@~1.5.0
 - Add 103 Early Hints
 - deps: type-is@~1.6.18
 - deps: mime-types@~2.1.24
 - perf: prevent internal throw on invalid type
- 4.16.4 - 2018-10-11
 - Fix issue where "Request aborted" may be logged in res.sendfile
 - Fix JSDoc for Router constructor
 - deps: body-parser@1.18.3
 - Fix deprecation warnings on Node.js 10+
 - Fix stack trace for strict json parse error
 - deps: depd@~1.1.2
 - deps: http-errors@~1.6.3
 - deps: iconv-lite@0.4.23
 - deps: qs@6.5.2
 - deps: raw-body@2.3.3
 - deps: type-is@~1.6.16
 - deps: proxy-addr@~2.0.4
 - deps: ipaddr.js@1.8.0
 - deps: qs@6.5.2
 - deps: safe-buffer@5.1.2
- 4.16.3 - 2018-03-12
 - deps: accepts@~1.3.5
 - deps: mime-types@~2.1.18
 - deps: depd@~1.1.2
 - perf: remove argument reassignment
 - deps: encodeurl@~1.0.2
 - Fix encoding % as last character
 - deps: finalhandler@1.1.1
 - Fix 404 output for bad / missing pathnames
 - deps: encodeurl@~1.0.2
 - deps: statuses@~1.4.0
 - deps: proxy-addr@~2.0.3
 - deps: ipaddr.js@1.6.0
 - deps: send@0.16.2
 - Fix incorrect end tag in default error & redirects
 - deps: depd@~1.1.2
 - deps: encodeurl@~1.0.2
 - deps: statuses@~1.4.0
 - deps: serve-static@1.13.2
 - Fix incorrect end tag in redirects
 - deps: encodeurl@~1.0.2
 - deps: send@0.16.2
 - deps: statuses@~1.4.0
 - deps: type-is@~1.6.16
 - deps: mime-types@~2.1.18
- 4.16.2 - 2017-10-10
 - Fix TypeError in res.send when given Buffer and ETag header set
 - perf: skip parsing of entire X-Forwarded-Proto header
- 4.16.1 - 2017-09-29
 - deps: send@0.16.1
 - deps: serve-static@1.13.1
 - Fix regression when root is incorrectly set to a file
 - deps: send@0.16.1
- 4.16.0 - 2017-09-28
 - Add "json escape" setting for res.json and res.jsonp
 - Add express.json and express.urlencoded to parse bodies
 - Add options argument to res.download
 - Improve error message when autoloading invalid view engine
 - Improve error messages when non-function provided as middleware
 - Skip Buffer encoding when not generating ETag for small response
 - Use safe-buffer for improved Buffer API
 - deps: accepts@~1.3.4
 - deps: mime-types@~2.1.16
 - deps: content-type@~1.0.4
 - perf: remove argument reassignment
 - perf: skip parameter parsing when no parameters
 - deps: etag@~1.8.1
 - perf: replace regular expression with substring
 - deps: finalhandler@1.1.0
 - Use res.headersSent when available
 - deps: parseurl@~1.3.2
 - perf: reduce overhead for full URLs
 - perf: unroll the "fast-path" RegExp
 - deps: proxy-addr@~2.0.2
 - Fix trimming leading / trailing OWS in X-Forwarded-For
 - deps: forwarded@~0.1.2
 - deps: ipaddr.js@1.5.2
 - perf: reduce overhead when no X-Forwarded-For header
 - deps: qs@6.5.1
 - Fix parsing & compacting very deep objects
 - deps: send@0.16.0
 - Add 70 new types for file extensions
 - Add immutable option
 - Fix missing </html> in default error & redirects
 - Set charset as "UTF-8" for .js and .json
 - Use instance methods on steam to check for listeners
 - deps: mime@1.4.1
 - perf: improve path validation speed
 - deps: serve-static@1.13.0
 - Add 70 new types for file extensions
 - Add immutable option
 - Set charset as "UTF-8" for .js and .json
 - deps: send@0.16.0
 - deps: setprototypeof@1.1.0
 - deps: utils-merge@1.0.1
 - deps: vary@~1.1.2
 - perf: improve header token parsing speed
 - perf: re-use options object when generating ETags
 - perf: remove dead .charset set in res.jsonp
- 4.15.5 - 2017-09-25
 - deps: debug@2.6.9
 - deps: finalhandler@~1.0.6
 - deps: debug@2.6.9
 - deps: parseurl@~1.3.2
 - deps: fresh@0.5.2
 - Fix handling of modified headers with invalid dates
 - perf: improve ETag match loop
 - perf: improve If-None-Match token parsing
 - deps: send@0.15.6
 - Fix handling of modified headers with invalid dates
 - deps: debug@2.6.9
 - deps: etag@~1.8.1
 - deps: fresh@0.5.2
 - perf: improve If-Match token parsing
 - deps: serve-static@1.12.6
 - deps: parseurl@~1.3.2
 - deps: send@0.15.6
 - perf: improve slash collapsing
- 4.15.4 - 2017-08-07
```
 </li>
 <li>
 4.15.3 - <a href="">2017-05-17</a>
 
 </li>
 <li>
 4.15.2 - <a href="">2017-03-06</a>
 
 </li>
 <li>
 4.15.1 - <a href="">2017-03-06</a>
 
 </li>
 <li>
 4.15.0 - <a href="">2017-03-01</a>
 
 </li>
 <li>
 4.14.1 - <a href="">2017-01-28</a>
 
 </li>
 <li>
 4.14.0 - <a href="">2016-06-16</a>
 
 </li>
 <li>
 4.13.4 - <a href="">2016-01-22</a>
 
 </li>
 <li>
 4.13.3 - <a href="">2015-08-03</a>
 
 </li>
 <li>
 4.13.2 - <a href="">2015-07-31</a>
 
 </li>
 <li>
 4.13.1 - <a href="">2015-07-06</a>
 
 </li>
 <li>
 4.13.0 - <a href="">2015-06-21</a>
 
 </li>
 <li>
 4.12.4 - <a href="">2015-05-18</a>
 
 </li>
 <li>
 4.12.3 - <a href="">2015-03-17</a>
 
 </li>
 <li>
 4.12.2 - <a href="">2015-03-03</a>
 
 </li>
 <li>
 4.12.1 - <a href="">2015-03-02</a>
 
 </li>
 <li>
 4.12.0 - <a href="">2015-02-23</a>
 
 </li>
 <li>
 4.11.2 - <a href="">2015-02-01</a>
 
 </li>
 <li>
 4.11.1 - <a href="">2015-01-21</a>
 
 </li>
 <li>
 4.11.0 - <a href="">2015-01-14</a>
 
 </li>
 <li>
 4.10.8 - <a href="">2015-01-13</a>
 
 </li>
</ul>
```

------------

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade express from 4.10.8 to 4.17.1. See this package in NPM: https://www.npmjs.com/package/express See this project in Snyk: https://app.snyk.io/org/ajesse11x/project/3a1b20c7-61b4-4b2c-a2f0-f168ec8dd464?utm_source=github&utm_medium=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade express from 4.10.8 to 4.17.1 #1

[Snyk] Upgrade express from 4.10.8 to 4.17.1 #1

snyk-bot commented Oct 26, 2019

[Snyk] Upgrade express from 4.10.8 to 4.17.1 #1

Are you sure you want to change the base?

[Snyk] Upgrade express from 4.10.8 to 4.17.1 #1

Conversation

snyk-bot commented Oct 26, 2019