[Snyk] Upgrade express from 4.17.1 to 5.0.0 by snyk-io[bot] · Pull Request #24 · hashim21223445/eventsource

snyk-io · 2025-01-17T20:25:50Z

Snyk has created this PR to upgrade express from 4.17.1 to 5.0.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

The recommended version is 25 versions ahead of your current version.
The recommended version was released 4 months ago.

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Prototype Pollution SNYK-JS-SETVALUE-1540541	134	Proof of Concept
Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	134	Proof of Concept
Remote Code Execution (RCE) SNYK-JS-HANDLEBARS-1056767	134	Proof of Concept
Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-8172694	134	No Known Exploit
Prototype Pollution SNYK-JS-LOADERUTILS-3043105	134	No Known Exploit
Prototype Pollution SNYK-JS-HANDLEBARS-173692	134	No Known Exploit
Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-8187303	134	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ES5EXT-6095076	134	Proof of Concept
Prototype Pollution SNYK-JS-HANDLEBARS-174183	134	No Known Exploit
Prototype Pollution SNYK-JS-HANDLEBARS-469063	134	No Known Exploit
Code Injection SNYK-JS-LODASH-1040724	134	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-450202	134	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-567746	134	Proof of Concept
Denial of Service (DoS) SNYK-JS-HANDLEBARS-480388	134	No Known Exploit
Prototype Pollution SNYK-JS-LODASH-608086	134	Proof of Concept
Arbitrary Code Execution SNYK-JS-HANDLEBARS-534478	134	Proof of Concept
Prototype Pollution SNYK-JS-MIXINDEEP-450212	134	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-73638	134	Proof of Concept
Prototype Pollution SNYK-JS-SETVALUE-450213	134	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	134	Proof of Concept
Prototype Pollution SNYK-JS-Y18N-1021887	134	Proof of Concept
Prototype Pollution SNYK-JS-SETVALUE-1540541	134	Proof of Concept
Prototype Pollution SNYK-JS-SETVALUE-450213	134	Proof of Concept
Prototype Pollution SNYK-JS-ASYNC-2441827	134	Proof of Concept
Asymmetric Resource Consumption (Amplification) SNYK-JS-BODYPARSER-7926860	134	No Known Exploit
Improper Verification of Cryptographic Signature SNYK-JS-BROWSERIFYSIGN-6037026	134	No Known Exploit
Prototype Pollution SNYK-JS-HANDLEBARS-567742	134	Proof of Concept
Cross-site Scripting SNYK-JS-EXPRESS-7926867	134	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	134	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-8482416	134	Proof of Concept
Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-7577916	134	Proof of Concept
Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-7577917	134	Proof of Concept
Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-7577918	134	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-6139239	134	Proof of Concept
Prototype Pollution SNYK-JS-HANDLEBARS-1279029	134	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3105943	134	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	134	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	134	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	134	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	134	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	134	Proof of Concept
Reverse Tabnabbing SNYK-JS-ISTANBULREPORTS-2328088	134	No Known Exploit
Prototype Pollution SNYK-JS-HANDLEBARS-534988	134	No Known Exploit
Prototype Pollution SNYK-JS-JSONPOINTER-1577288	134	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	134	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	134	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	134	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3042992	134	No Known Exploit
Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	134	No Known Exploit
Validation Bypass SNYK-JS-KINDOF-537849	134	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-WORDWRAP-3149973	134	Proof of Concept
Cross-site Scripting SNYK-JS-SEND-7926862	134	No Known Exploit
Cross-site Scripting SNYK-JS-SERVESTATIC-7926865	134	No Known Exploit
Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962463	134	Proof of Concept

Release notes

Package name: express

5.0.0 - 2024-09-10
Express v5.0.0

🎉 Express v5 is finally here! 🎉

After years of development, the long-awaited Express v5 has been officially released. This version focuses on simplifying the codebase, improving security, and dropping support for older Node.js versions to enable better performance and maintainability.

For detailed information, please check out the official Express v5 release blog post.

Most relevant details

Major Changes in v5
- Node.js version support: Dropped support for Node.js versions before v18.
- Routing changes: Updated to path-to-regexp@8.x, removing sub-expression regex patterns for security reasons (ReDoS mitigation).
- Promise support: Middleware can now return rejected promises, caught by the router as errors.
- body-parser changes: Several improvements including the ability to customize urlencoded body depth and defaulting extended to false.
- Deprecated API methods removed: Removed old, deprecated API method signatures from Express v3/v4.
For a complete list of breaking changes and API deprecations, see the migration guide.

Security Updates

This release includes important security fixes, including improvements to prevent ReDoS attacks and mitigation for CVE-2024-45590. Full details can be found in the security release notes.

Migration

Be sure to check out our migration guide for instructions on how to update your applications from Express v4 to v5.

Security Guidance

For best practices, we recommend reviewing the Threat Model which outlines Express' approach to securing your applications, including tips for user input validation and other critical aspects.

What's Changed
- 4.19.2 Staging by @ wesleytodd in #5561
- remove duplicate location test for data uri by @ wesleytodd in #5562
- feat: document beta releases expectations by @ marco-ippolito in #5565
- Cut down on duplicated CI runs by @ jonchurch in #5564
- Add a Threat Model by @ UlisesGascon in #5526
- Assign captain of encodeurl by @ blakeembrey in #5579
- Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @ jonchurch in #5587
- docs: update Security.md by @ inigomarquinez in #5590
- docs: update triage nomination policy by @ UlisesGascon in #5600
- Add CodeQL (SAST) by @ UlisesGascon in #5433
- docs: add UlisesGascon as triage initiative captain by @ UlisesGascon in #5605
- Use object with null prototype for various app properties by @ EvanHahn in #4861
- deps: encodeurl@~2.0.0 by @ blakeembrey in #5569
- skip QUERY method test by @ jonchurch in #5628
- ignore ETAG query test on 21 and 22, reuse skip util by @ jonchurch in #5639
- add support Node.js@22 in the CI by @ mertcanaltin in #5627
- doc: add table of contents, tc/triager lists to readme by @ mertcanaltin in #5619
- List and sort all projects, add captains by @ blakeembrey in #5653
- Call callback once on listen error by @ wesleytodd in #3216
- docs: add @ UlisesGascon as captain for cookie-parser by @ UlisesGascon in #5666
- ✨ bring back query tests for node 21 by @ ctcpip in #5690
- [v4] Deprecate res.clearCookie accepting options.maxAge and options.expires by @ jonchurch in #5672
- skip QUERY tests for Node 21 only, still not supported by @ jonchurch in #5695
- 📝 update people, add ctcpip to TC by @ ctcpip in #5683
- remove minor version pinning from ci by @ jonchurch in #5722
- Fix link variable use in attribution section of CODE OF CONDUCT by @ IamLizu in #5762
- Replace Appveyor windows testing with GHA by @ jonchurch in #5599
- Add OSSF Scorecard badge by @ UlisesGascon in #5436
- Throw on invalid status codes by @ jonchurch in #4212
- Use Array.flat instead of array-flatten by @ almic in #5677
- Adopt Node@18 as the minimum supported version by @ UlisesGascon in #5803
- Ignore expires and maxAge in res.clearCookie() by @ jonchurch in #5792
- send@1.0.0 by @ wesleytodd in #5786
- chore: upgrade debug dep from 3.10 to 4.3.6 by @ carpasse in #5829
- refactor: replace 'path-is-absolute' dep with node:path isAbsolute method by @ carpasse in #5830
- update scorecard link by @ bjohansebas in #5814
- Nominate @ IamLizu to the triage team by @ UlisesGascon in #5836
- deps: path-to-regexp@0.1.8 by @ blakeembrey in #5603
- docs: specify new instructions for question and discuss by @ IamLizu in #5835
- 5.x: Upgrading merge-descriptors with allowing minors by @ RobinTail in #5782
- 4.x: Upgrade merge-descriptors dependency by @ RobinTail in #5781
- WIP: serve-static@2 by @ wesleytodd in #5790
- chore: upgrade qs dp from 6.11.0 to 6.13.0 by @ carpasse in #5847
- Upgrade cookie signature by @ IamLizu in #5833
- accepts@2 by @ wesleytodd in #5881
- mime-types@3 by @ wesleytodd in #5882
- type-is@^2.0.0 by @ wesleytodd in #5883
- content-disposition@^1.0.0 by @ wesleytodd in #5884
- fix(deps): finalhandler@^2.0.0 by @ wesleytodd in #5899
- path-to-regexp@0.1.10 by @ blakeembrey in #5902
- update to fresh@^2.0.0 by @ jonchurch in #5916
- router@^2.0.0 by @ wesleytodd in #5885
- Adopt Node@18 as the minimum supported version by @ UlisesGascon in #5595
- master -> 5.0 by @ ctcpip in #5785
- 🔧 update CI, remove unsupported versions, clean up by @ ctcpip in #5931
- Delete back as a magic string by @ blakeembrey in #5933
- Release 5.0 by @ dougwilson in #2237
New Contributors
- @ marco-ippolito made their first contribution in #5565
- @ inigomarquinez made their first contribution in #5590
- @ mertcanaltin made their first contribution in #5627
- @ ctcpip made their first contribution in #5690
- @ IamLizu made their first contribution in #5762
- @ almic made their first contribution in #5677
- @ carpasse made their first contribution in #5829
- @ bjohansebas made their first contribution in #5814
- @ RobinTail made their first contribution in #5782
Full Changelog: v5.0.0-beta.3...v5.0.0
5.0.0-beta.3 - 2024-03-25
Full Changelog: 5.0.0-beta.2...v5.0.0-beta.3
5.0.0-beta.2 - 2024-03-21
What's Changed
- lib: fix typo ocurred -> occurred by @ caioagiani in #4805
- examples: defend from privilege elevation by @ KoyamaSohei in #4120
- replace "replaces" with "replacer" in jsdoc by @ apeltop in #4843
- Add install size badge to README by @ styfle in #3710
- Replace deprecated String.prototype.substr() by

Snyk has created this PR to upgrade express from 4.17.1 to 5.0.0. See this package in npm: express See this project in Snyk: https://app.snyk.io/org/hashimmohammad881-TrGTrpdUyGorMuF38nmW8P/project/e6715d82-c41b-4ec4-9520-3b5ae1a13f2e?utm_source=github-cloud-app&utm_medium=referral&page=upgrade-pr

semanticdiff-com · 2025-01-17T20:25:53Z

Review changes with

Changed Files

File	Status
package.json	37% smaller

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade express from 4.17.1 to 5.0.0#24

[Snyk] Upgrade express from 4.17.1 to 5.0.0#24
snyk-io[bot] wants to merge 1 commit into
masterfrom
snyk-upgrade-47cd525dafba7fc38e12cdc210d5fb9a

snyk-io Bot commented Jan 17, 2025

Express v5.0.0

Most relevant details

Major Changes in v5

Security Updates

Migration

Security Guidance

What's Changed

New Contributors

What's Changed

Uh oh!

semanticdiff-com Bot commented Jan 17, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

snyk-io Bot commented Jan 17, 2025

Snyk has created this PR to upgrade express from 4.17.1 to 5.0.0.

Issues fixed by the recommended upgrade:

Express v5.0.0

Most relevant details

Major Changes in v5

Security Updates

Migration

Security Guidance

What's Changed

New Contributors

What's Changed

Uh oh!

semanticdiff-com Bot commented Jan 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

semanticdiff-com Bot commented Jan 17, 2025 •

edited

Loading