[Snyk] Upgrade express from 4.21.2 to 5.0.1 #322
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade express from 4.21.2 to 5.0.1. See this package in npm: express See this project in Snyk: https://app.snyk.io/org/reisene/project/55e114f8-489e-4f14-b900-20574b041e59?utm_source=github-cloud-app&utm_medium=referral&page=upgrade-pr
|
Aviator Changeset actions:
|
Current Aviator status
This PR was merged using Aviator.
See the real-time status of this PR on the
Aviator webapp.
Use the Aviator Chrome Extension
to see the status of your PR within GitHub.
|
|
Review changes with |
|
Please follow naming conventions! 😿 |
|
Click here to review and test in web IDE: |
Przewodnik Recenzenta od SourceryTo żądanie pull aktualizuje zależność express z wersji 4.21.2 do 5.0.1 poprzez modyfikację plików package.json i package-lock.json. Brak wygenerowanych diagramów, ponieważ zmiany wydają się proste i nie wymagają wizualnej reprezentacji. Zmiany na Poziomie Pliku
Porady i poleceniaInterakcja z Sourcery
Dostosowywanie Twojego DoświadczeniaUzyskaj dostęp do swojego panelu, aby:
Uzyskiwanie Pomocy
Original review guide in EnglishReviewer's Guide by SourceryThis pull request upgrades the express dependency from version 4.21.2 to 5.0.1 by modifying the package.json and package-lock.json files. No diagrams generated as the changes look simple and do not need a visual representation. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF ScorecardScorecard details
Scanned Files
|
🎉 Snyk checks have passed. No issues have been found so far.✅ security/snyk check is complete. No issues have been found. (View Details) |
There was a problem hiding this comment.
Pominęliśmy przeglądanie tego żądaniaPull Request. Oto dlaczego:
- Wygląda na to, że został stworzony przez bota (hej, snyk-io[bot]!). Zakładamy, że wie, co robi!
- Wygląda na to, że został stworzony przez bota („[Snyk]” znaleziono w tytule). Zakładamy, że wie, co robi!
Original comment in English
We have skipped reviewing this pull request. Here's why:
- It seems to have been created by a bot (hey, snyk-io[bot]!). We assume it knows what it's doing!
- It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
|
|
Skipping bot pull request creation because the queue is empty and this pull request is up to date with |
|
Here's the code health analysis summary for commits Analysis Summary
|
Merge ProtectionsYour pull request matches the following merge protections and will not be merged until they are valid. 🟢 Do not merge outdated PRsWonderful, this rule succeeded.Make sure PRs are almost up to date before merging
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade express from 4.21.2 to 5.0.1.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 13 versions ahead of your current version.
The recommended version was released 6 months ago.
Release notes
Package name: express
What's Changed
cookiesemver lock to address CVE-2024-47764 by @ joshbuker in #6017Full Changelog: v5.0.0...5.0.1
Express v5.0.0
🎉 Express v5 is finally here! 🎉
After years of development, the long-awaited Express v5 has been officially released. This version focuses on simplifying the codebase, improving security, and dropping support for older Node.js versions to enable better performance and maintainability.
For detailed information, please check out the official Express v5 release blog post.
Most relevant details
Major Changes in v5
path-to-regexp@8.x, removing sub-expression regex patterns for security reasons (ReDoS mitigation).body-parserchanges: Several improvements including the ability to customizeurlencodedbody depth and defaultingextendedtofalse.For a complete list of breaking changes and API deprecations, see the migration guide.
Security Updates
This release includes important security fixes, including improvements to prevent ReDoS attacks and mitigation for CVE-2024-45590. Full details can be found in the security release notes.
Migration
Be sure to check out our migration guide for instructions on how to update your applications from Express v4 to v5.
Security Guidance
For best practices, we recommend reviewing the Threat Model which outlines Express' approach to securing your applications, including tips for user input validation and other critical aspects.
What's Changed
http-errors,expressjs.com,morgan,cors,body-parserby @ jonchurch in #5587res.clearCookieacceptingoptions.maxAgeandoptions.expiresby @ jonchurch in #5672expiresandmaxAgeinres.clearCookie()by @ jonchurch in #5792debugdep from 3.10 to 4.3.6 by @ carpasse in #5829questionanddiscussby @ IamLizu in #5835merge-descriptorswith allowing minors by @ RobinTail in #5782merge-descriptorsdependency by @ RobinTail in #5781fresh@^2.0.0by @ jonchurch in #5916backas a magic string by @ blakeembrey in #5933New Contributors
Full Changelog: v5.0.0-beta.3...v5.0.0
Full Changelog: 5.0.0-beta.2...v5.0.0-beta.3
What's Changed
objas the context by @ shesek in #3587maxAgeappropriateness before use by @ cjbarth in #3936Original summary in English
Summary by Sourcery
Upgrade Express.js from version 4.21.2 to 5.0.1, which is a major version upgrade with significant changes and improvements
New Features:
Enhancements: