chore(deps): [security] bump express from 2.5.11 to 4.17.1 in /tests/apps/dockerfile-procfile #3746

dependabot-preview · 2019-10-21T07:20:39Z

Bumps express from 2.5.11 to 4.17.1. This update includes a security fix.

Vulnerabilities fixed

Sourced from The Node Security Working Group.

No Charset in Content-Type Header
Vulnerable versions of express do not specify a charset field in the content-type header while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standard encodings, like UTF-7.

Affected versions: <3.11 || >= 4 <4.5

Release notes

Sourced from express's releases.

4.17.1

Revert "Improve error message for null/undefined to res.status"

4.17.0

Add express.raw to parse bodies into Buffer

Add express.text to parse bodies into string

Improve error message for non-strings to res.sendFile

Improve error message for null/undefined to res.status

Support multiple hosts in X-Forwarded-Host

deps: accepts@~1.3.7

deps: body-parser@1.19.0

Add encoding MIK

Add petabyte (pb) support

Fix parsing array brackets after index

deps: bytes@3.1.0

deps: http-errors@1.7.2

deps: iconv-lite@0.4.24

deps: qs@6.7.0

deps: raw-body@2.4.0

deps: type-is@~1.6.17

deps: content-disposition@0.5.3

deps: cookie@0.4.0

Add SameSite=None support

deps: finalhandler@~1.1.2

Set stricter Content-Security-Policy header

deps: parseurl@~1.3.3

deps: statuses@~1.5.0

deps: parseurl@~1.3.3

deps: proxy-addr@~2.0.5

deps: ipaddr.js@1.9.0

deps: qs@6.7.0

Fix parsing array brackets after index

deps: range-parser@~1.2.1

deps: send@0.17.1

Set stricter CSP header in redirect & error responses

deps: http-errors@~1.7.2

deps: mime@1.6.0

deps: ms@2.1.1

deps: range-parser@~1.2.1

deps: statuses@~1.5.0

perf: remove redundant path.normalize call

deps: serve-static@1.14.1

Set stricter CSP header in redirect response

deps: parseurl@~1.3.3

deps: send@0.17.1

deps: setprototypeof@1.1.1

deps: statuses@~1.5.0

Add 103 Early Hints

deps: type-is@~1.6.18

deps: mime-types@~2.1.24

... (truncated)

Changelog

Sourced from express's changelog.

4.17.1 / 2019-05-25

Revert "Improve error message for null/undefined to res.status"

4.17.0 / 2019-05-16

Add express.raw to parse bodies into Buffer

Add express.text to parse bodies into string

Improve error message for non-strings to res.sendFile

Improve error message for null/undefined to res.status

Support multiple hosts in X-Forwarded-Host

deps: accepts@~1.3.7

deps: body-parser@1.19.0

Add encoding MIK

Add petabyte (pb) support

Fix parsing array brackets after index

deps: bytes@3.1.0

deps: http-errors@1.7.2

deps: iconv-lite@0.4.24

deps: qs@6.7.0

deps: raw-body@2.4.0

deps: type-is@~1.6.17

deps: content-disposition@0.5.3

deps: cookie@0.4.0

Add SameSite=None support

deps: finalhandler@~1.1.2

Set stricter Content-Security-Policy header

deps: parseurl@~1.3.3

deps: statuses@~1.5.0

deps: parseurl@~1.3.3

deps: proxy-addr@~2.0.5

deps: ipaddr.js@1.9.0

deps: qs@6.7.0

Fix parsing array brackets after index

deps: range-parser@~1.2.1

deps: send@0.17.1

Set stricter CSP header in redirect & error responses

deps: http-errors@~1.7.2

deps: mime@1.6.0

deps: ms@2.1.1

deps: range-parser@~1.2.1

deps: statuses@~1.5.0

perf: remove redundant path.normalize call

deps: serve-static@1.14.1

Set stricter CSP header in redirect response

deps: parseurl@~1.3.3

deps: send@0.17.1

deps: setprototypeof@1.1.1

... (truncated)

Commits

e1b45eb 4.17.1
0a48e18 Revert "Improve error message for null/undefined to res.status"
eed05a1 build: Node.js@12.3
10c7756 4.17.0
9dadca2 docs: remove Gratipay links
b8e5056 tests: ignore unreachable line
94e48a1 build: update example dependencies
efcb17d deps: cookie@0.4.0
b9ecb9a build: support Node.js 12.x
5266f3a build: test against Node.js 13.x nightly
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by dougwilson, a new releaser for express since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Note: This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking Bump now in your Dependabot dashboard.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)
Pull request limits (per update run and/or open at any time)
Out-of-range updates (receive only lockfile updates, if desired)
Security updates (receive only security updates, if desired)

Bumps [express](https://github.com/expressjs/express) from 2.5.11 to 4.17.1. **This update includes a security fix.** - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@2.5.11...4.17.1) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

The logger middleware was moved to the `morgan` package in newer versions of express.

@josegonzalez

# History ## 0.19.10 Install/update via the bootstrap script: ```shell wget https://raw.githubusercontent.com/dokku/dokku/v0.19.10/bootstrap.sh sudo DOKKU_TAG=v0.19.10 bash bootstrap.sh ``` ### Bug Fixes - #3784: @josegonzalez Ensure checks attempts are tracked per-check instead of globally ### New Features - #3793: @josegonzalez Omit DWARF symbol table and debug information from go binaries - #3792: @josegonzalez Unify property function implementations ### Documentation - #3712: @fruitl00p Added new plugin ### Other - #3790: @dependabot-preview[bot] chore(deps): bump gunicorn from 20.0.3 to 20.0.4 in /tests/apps/python-flask - #3791: @dependabot-preview[bot] chore(deps): bump gunicorn from 20.0.3 to 20.0.4 in /tests/apps/multi - #3787: @dependabot-preview[bot] chore(deps): bump gunicorn from 20.0.2 to 20.0.3 in /tests/apps/multi - #3788: @dependabot-preview[bot] chore(deps): bump gunicorn from 20.0.2 to 20.0.3 in /tests/apps/python-flask - #3785: @dependabot-preview[bot] chore(deps): bump gunicorn from 20.0.0 to 20.0.2 in /tests/apps/python-flask - #3786: @dependabot-preview[bot] chore(deps): bump gunicorn from 20.0.0 to 20.0.2 in /tests/apps/multi - #3748: @dependabot-preview[bot] chore(deps): [security] bump express from 2.5.11 to 4.17.1 in /tests/apps/dockerfile-dokku-scale - #3749: @dependabot-preview[bot] chore(deps): [security] bump express from 2.5.11 to 4.17.1 in /tests/apps/nodejs-express-noappjson - #3747: @dependabot-preview[bot] chore(deps): [security] bump express from 2.5.11 to 4.17.1 in /tests/apps/config - #3746: @dependabot-preview[bot] chore(deps): [security] bump express from 2.5.11 to 4.17.1 in /tests/apps/dockerfile-procfile - #3741: @dependabot-preview[bot] chore(deps): [security] bump express from 2.5.11 to 4.17.1 in /tests/apps/nodejs-express - #3783: @dependabot-preview[bot] chore(deps): bump jetty-servlet from 9.4.23.v20191118 to 9.4.24.v20191120 in /tests/apps/java - #3777: @dependabot-preview[bot] chore(deps): [security] bump symfony/http-kernel from 3.4.32 to 3.4.35 in /tests/apps/php - #3774: @dependabot-preview[bot] chore(deps): bump gunicorn from 19.9.0 to 20.0.0 in /tests/apps/python-flask - #3779: @dependabot-preview[bot] chore(deps): bump monolog/monolog from 1.25.1 to 1.25.2 in /tests/apps/php - #3782: @dependabot-preview[bot] chore(deps): bump jetty-servlet from 9.4.22.v20191022 to 9.4.23.v20191118 in /tests/apps/java

dependabot-preview bot added type: dependencies Pull requests that update a dependency file javascript security Pull requests that address a security vulnerability labels Oct 21, 2019

dependabot-preview bot force-pushed the dependabot/npm_and_yarn/tests/apps/dockerfile-procfile/express-4.17.1 branch 4 times, most recently from a19abb6 to 5b0706d Compare October 22, 2019 04:26

dependabot-preview bot force-pushed the dependabot/npm_and_yarn/tests/apps/dockerfile-procfile/express-4.17.1 branch from 5b0706d to 10385e9 Compare October 29, 2019 16:34

feat: remove unnecessary logger from test app

a35798e

The logger middleware was moved to the `morgan` package in newer versions of express.

josegonzalez merged commit 52cd280 into master Nov 23, 2019

josegonzalez deleted the dependabot/npm_and_yarn/tests/apps/dockerfile-procfile/express-4.17.1 branch November 23, 2019 20:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): [security] bump express from 2.5.11 to 4.17.1 in /tests/apps/dockerfile-procfile #3746

chore(deps): [security] bump express from 2.5.11 to 4.17.1 in /tests/apps/dockerfile-procfile #3746

Uh oh!

dependabot-preview bot commented Oct 21, 2019 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

chore(deps): [security] bump express from 2.5.11 to 4.17.1 in /tests/apps/dockerfile-procfile #3746

chore(deps): [security] bump express from 2.5.11 to 4.17.1 in /tests/apps/dockerfile-procfile #3746

Uh oh!

Conversation

dependabot-preview bot commented Oct 21, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

4.17.1

4.17.0

4.17.1 / 2019-05-25

4.17.0 / 2019-05-16

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot-preview bot commented Oct 21, 2019 •

edited

Loading