[Snyk] Upgrade express from 4.13.4 to 4.17.1 #16

snyk-bot · 2020-04-28T05:01:53Z

Snyk has created this PR to upgrade express from 4.13.4 to 4.17.1.

✨What is Merge Advice?

We check thousands of dependency upgrade pull requests and CI tests every day to see which upgrades were successfully merged. After crunching this data, we give a recommendation on how safe we think the change is for you to merge without causing issues. Learn more, and share your feedback to help improve this feature. 🙏

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 15 versions ahead of your current version.
The recommended version was released a year ago, on 2019-05-26.

The recommended version fixes:

Severity	Issue	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) npm:negotiator:20160616	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:fresh:20170908	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No Known Exploit
	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	No Known Exploit

Release notes

Package name: express

4.17.1 - 2019-05-26
- Revert "Improve error message for null/undefined to res.status"
4.17.0 - 2019-05-17
- Add express.raw to parse bodies into Buffer
- Add express.text to parse bodies into string
- Improve error message for non-strings to res.sendFile
- Improve error message for null/undefined to res.status
- Support multiple hosts in X-Forwarded-Host
- deps: accepts@~1.3.7
- deps: [email protected]
  - Add encoding MIK
  - Add petabyte (pb) support
  - Fix parsing array brackets after index
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.17
- deps: [email protected]
- deps: [email protected]
  - Add SameSite=None support
- deps: finalhandler@~1.1.2
  - Set stricter Content-Security-Policy header
  - deps: parseurl@~1.3.3
  - deps: statuses@~1.5.0
- deps: parseurl@~1.3.3
- deps: proxy-addr@~2.0.5
  - deps: [email protected]
- deps: [email protected]
  - Fix parsing array brackets after index
- deps: range-parser@~1.2.1
- deps: [email protected]
  - Set stricter CSP header in redirect & error responses
  - deps: http-errors@~1.7.2
  - deps: [email protected]
  - deps: [email protected]
  - deps: range-parser@~1.2.1
  - deps: statuses@~1.5.0
  - perf: remove redundant path.normalize call
- deps: [email protected]
  - Set stricter CSP header in redirect response
  - deps: parseurl@~1.3.3
  - deps: [email protected]
- deps: [email protected]
- deps: statuses@~1.5.0
  - Add 103 Early Hints
- deps: type-is@~1.6.18
  - deps: mime-types@~2.1.24
  - perf: prevent internal throw on invalid type
4.16.4 - 2018-10-11
- Fix issue where "Request aborted" may be logged in res.sendfile
- Fix JSDoc for Router constructor
- deps: [email protected]
  - Fix deprecation warnings on Node.js 10+
  - Fix stack trace for strict json parse error
  - deps: depd@~1.1.2
  - deps: http-errors@~1.6.3
  - deps: [email protected]
  - deps: [email protected]
  - deps: [email protected]
  - deps: type-is@~1.6.16
- deps: proxy-addr@~2.0.4
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
4.16.3 - 2018-03-12
- deps: accepts@~1.3.5
  - deps: mime-types@~2.1.18
- deps: depd@~1.1.2
  - perf: remove argument reassignment
- deps: encodeurl@~1.0.2
  - Fix encoding % as last character
- deps: [email protected]
  - Fix 404 output for bad / missing pathnames
  - deps: encodeurl@~1.0.2
  - deps: statuses@~1.4.0
- deps: proxy-addr@~2.0.3
  - deps: [email protected]
- deps: [email protected]
  - Fix incorrect end tag in default error & redirects
  - deps: depd@~1.1.2
  - deps: encodeurl@~1.0.2
  - deps: statuses@~1.4.0
- deps: [email protected]
  - Fix incorrect end tag in redirects
  - deps: encodeurl@~1.0.2
  - deps: [email protected]
- deps: statuses@~1.4.0
- deps: type-is@~1.6.16
  - deps: mime-types@~2.1.18
4.16.2 - 2017-10-10
- Fix TypeError in res.send when given Buffer and ETag header set
- perf: skip parsing of entire X-Forwarded-Proto header
4.16.1 - 2017-09-29
- deps: [email protected]
- deps: [email protected]
  - Fix regression when root is incorrectly set to a file
  - deps: [email protected]
4.16.0 - 2017-09-28
- Add "json escape" setting for res.json and res.jsonp
- Add express.json and express.urlencoded to parse bodies
- Add options argument to res.download
- Improve error message when autoloading invalid view engine
- Improve error messages when non-function provided as middleware
- Skip Buffer encoding when not generating ETag for small response
- Use safe-buffer for improved Buffer API
- deps: accepts@~1.3.4
  - deps: mime-types@~2.1.16
- deps: content-type@~1.0.4
  - perf: remove argument reassignment
  - perf: skip parameter parsing when no parameters
- deps: etag@~1.8.1
  - perf: replace regular expression with substring
- deps: [email protected]
  - Use res.headersSent when available
- deps: parseurl@~1.3.2
  - perf: reduce overhead for full URLs
  - perf: unroll the "fast-path" RegExp
- deps: proxy-addr@~2.0.2
  - Fix trimming leading / trailing OWS in X-Forwarded-For
  - deps: forwarded@~0.1.2
  - deps: [email protected]
  - perf: reduce overhead when no X-Forwarded-For header
- deps: [email protected]
  - Fix parsing & compacting very deep objects
- deps: [email protected]
  - Add 70 new types for file extensions
  - Add immutable option
  - Fix missing </html> in default error & redirects
  - Set charset as "UTF-8" for .js and .json
  - Use instance methods on steam to check for listeners
  - deps: [email protected]
  - perf: improve path validation speed
- deps: [email protected]
  - Add 70 new types for file extensions
  - Add immutable option
  - Set charset as "UTF-8" for .js and .json
  - deps: [email protected]
- deps: [email protected]
- deps: [email protected]
- deps: vary@~1.1.2
  - perf: improve header token parsing speed
- perf: re-use options object when generating ETags
- perf: remove dead .charset set in res.jsonp
4.15.5 - 2017-09-25
4.15.4 - 2017-08-07
4.15.3 - 2017-05-17
4.15.2 - 2017-03-06
4.15.1 - 2017-03-06
4.15.0 - 2017-03-01
4.14.1 - 2017-01-28
4.14.0 - 2016-06-16
4.13.4 - 2016-01-22