[Snyk] Fix for 1 vulnerabilities #654

Closed
opened 2026-04-05 16:21:45 +02:00 by MrUnknownDE · 0 comments
Owner

Originally created by @simlarsen on 10/15/2024

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • Common/package.json
    • Common/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 601/1000
Why? Recently disclosed, Has a fix available, CVSS 6.3
Cross-site Scripting (XSS)
SNYK-JS-COOKIE-8163060
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: cookie-parser The new version differs by 12 commits.

See the full diff

Package name: express The new version differs by 53 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)

*Originally created by @simlarsen on 10/15/2024* <h3>Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.</h3> #### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - Common/package.json - Common/package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **601/1000** <br/> **Why?** Recently disclosed, Has a fix available, CVSS 6.3 | Cross-site Scripting (XSS) <br/>[SNYK-JS-COOKIE-8163060](https://snyk.io/vuln/SNYK-JS-COOKIE-8163060) | Yes | No Known Exploit (*) Note that the real score may have changed since the PR was raised. <details> <summary><b>Commit messages</b></summary> </br> <details> <summary>Package name: <b>cookie-parser</b></summary> The new version differs by 12 commits.</br> <ul> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/5d61e1e2f3f18efe8f94e5fad2886b48864d6c78">5d61e1e</a> 1.4.7</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/ccf1f5408cabda18a185eef1e8c0f843c9ce6df2">ccf1f54</a> deps: cookie@0.7.2 (#116)</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/429cfd4bcfa66f6578af890d83d5c88be1144245">429cfd4</a> ci: Use GITHUB_OUTPUT envvar instead of set-output command (#100)</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/ca4c97e7247172d8b52e9ecb888ca32857a11d8d">ca4c97e</a> ci: fix errors in ci pipeline for node 8 and 9 (#104)</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/97bdf39d177cd3f9990a512dc7a7de89f1fca7fc">97bdf39</a> ci: add support for OSSF scorecard reporting (#103)</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/e5862bdb0c1130450a5b50bc07719becf0ab8c81">e5862bd</a> build: Node.js@17.6</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/f0688d23a238ccb2cc5320786f3e4dac47fb3b2b">f0688d2</a> build: Node.js@14.19</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/44ec541accdc7fe4d6e7d1e5675c3dae101300ee">44ec541</a> build: Node.js@16.14</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/695435aa1af55a35ecc5e7d1fffafb7bc9f7f442">695435a</a> deps: cookie@0.4.2</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/f66e7e12fffd611fff2dee41bd9847ef999ec75b">f66e7e1</a> build: mocha@9.2.1</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/05e40b1afc0a8a9c636e27d7674c32e3f821b259">05e40b1</a> build: Node.js@17.3</li> <li><a href="https://snyk.io/redirect/github/expressjs/cookie-parser/commit/bc1d5012059c6aafe938d8e9579ed3146d49d353">bc1d501</a> build: use supertest@3.4.2 for Node.js 6.x</li> </ul> <a href="https://snyk.io/redirect/github/expressjs/cookie-parser/compare/dda4c5be5a97fbf4552ff54889715581c1c93128...5d61e1e2f3f18efe8f94e5fad2886b48864d6c78">See the full diff</a> </details> <details> <summary>Package name: <b>express</b></summary> The new version differs by 53 commits.</br> <ul> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/8e229f92752ad51462c868b99f6e6c2e559801b0">8e229f9</a> 4.21.1</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/a024c8a7b658a178cbdb9bde33030b7500172815">a024c8a</a> fix(deps): cookie@0.7.1</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/7e562c6d8daddff4604f8efaaf9db2cf98c6dcff">7e562c6</a> 4.21.0</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/1bcde96bc87c4704df9a704271d1167064ab56bb">1bcde96</a> fix(deps): qs@6.13.0 (#5946)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/7d364775688be98aaa973302e066d0da9f438997">7d36477</a> fix(deps): serve-static@1.16.2 (#5951)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/40d2d8f2c882712a0f2e4603c38d166c79676b2b">40d2d8f</a> fix(deps): finalhandler@1.3.1</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/77ada906dba57fd6e308f0d750e01653dbeaddfc">77ada90</a> Deprecate &#x60;&quot;back&quot;&#x60; magic string in redirects (#5935)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/21df421ebc7a5249bb31101da666bbf22adc3f18">21df421</a> 4.20.0</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/4c9ddc1c47bf579e55c2fe837d76a952e9fd8959">4c9ddc1</a> feat: upgrade to serve-static@0.16.0</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/9ebe5d500d22cbb2b8aaa73446866b084c747971">9ebe5d5</a> feat: upgrade to send@0.19.0 (#5928)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/ec4a01b6b8814d7b007f36a3023f4dbafdbc3d09">ec4a01b</a> feat: upgrade to body-parser@1.20.3 (#5926)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553">54271f6</a> fix: don&#x27;t render redirect values in anchor href</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/125bb742a38cd97938a3932b47cc301e41c31f5d">125bb74</a> path-to-regexp@0.1.10 (#5902)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/2a980ad16052e53b398c9953fea50e3daa0b495c">2a980ad</a> merge-descriptors@1.0.3 (#5781)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/a3e7e05e0a435b7b4be25bd38d8d0ca19a773ca9">a3e7e05</a> docs: specify new instructions for &#x60;question&#x60; and &#x60;discuss&#x60;</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/c5addb9a17c5b4c9fccdd2c04153a30595e03385">c5addb9</a> deps: path-to-regexp@0.1.8 (#5603)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/e35380a39d94937e3d0f7119e0efbc7cd69d003f">e35380a</a> docs: add @ IamLizu to the triage team (#5836)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/f5b6e67aed1d8e81c30bd5be7bb88dbbfabfeb64">f5b6e67</a> docs: update scorecard link (#5814)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/2177f67f5439494f7a29a8d04f744cc20fb9f201">2177f67</a> docs: add OSSF Scorecard badge (#5436)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/f4bd86ed361ea9710ed0f7b4634e66c8e3b88b40">f4bd86e</a> Replace Appveyor windows testing with GHA (#5599)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/2ec589c1133e2eec29a951b4976c50db638f7dd5">2ec589c</a> Fix Contributor Covenant link definition reference in attribution section (#5762)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/4cf7eed927d3ccd3f1d0c9a14d562ec0a1635e86">4cf7eed</a> remove minor version pinning from ci (#5722)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/6d084715ba6ca5301e9ac1efe4309e555973b364">6d08471</a> 📝 update people, add ctcpip to TC (#5683)</li> <li><a href="https://snyk.io/redirect/github/expressjs/express/commit/61421a8c0c2abf011868d90df93813992e3c7563">61421a8</a> skip QUERY tests for Node 21 only, still not supported (#5695)</li> </ul> <a href="https://snyk.io/redirect/github/expressjs/express/compare/b28db2c12c3bd9cd763316824446f79bf81e0686...8e229f92752ad51462c868b99f6e6c2e559801b0">See the full diff</a> </details> </details> Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiI4ZDVlOWRiMC00ZmE2LTQzZTUtYjRhZi1kYTUzYTBkNGE3NzMiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjhkNWU5ZGIwLTRmYTYtNDNlNS1iNGFmLWRhNTNhMGQ0YTc3MyJ9fQ==" width="0" height="0"/> 🧐 [View latest project report](https://app.snyk.io/org/oneuptime-RsC2nshvQ2Vnr35jHvMnMP/project/f6446ec8-d441-487e-b58f-38373430e213?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/oneuptime-RsC2nshvQ2Vnr35jHvMnMP/project/f6446ec8-d441-487e-b58f-38373430e213?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"8d5e9db0-4fa6-43e5-b4af-da53a0d4a773","prPublicId":"8d5e9db0-4fa6-43e5-b4af-da53a0d4a773","dependencies":[{"name":"cookie-parser","from":"1.4.6","to":"1.4.7"},{"name":"express","from":"4.19.2","to":"4.21.1"},{"name":"universal-cookie","from":"4.0.4","to":"7.2.1"}],"packageManager":"npm","projectPublicId":"f6446ec8-d441-487e-b58f-38373430e213","projectUrl":"https://app.snyk.io/org/oneuptime-RsC2nshvQ2Vnr35jHvMnMP/project/f6446ec8-d441-487e-b58f-38373430e213?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-COOKIE-8163060"],"upgrade":["SNYK-JS-COOKIE-8163060"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[601],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Cross-site Scripting (XSS)](https://learn.snyk.io/lesson/dom-based-xss/?loc&#x3D;fix-pr)
Sign in to join this conversation.
No Label
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github/oneuptime#654