[Snyk] Fix for 11 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	526/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.1	Arbitrary Code Injection SNYK-JS-EJS-1049328	Yes	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-EJS-2803307	Yes	Proof of Concept
	489/1000 Why? Has a fix available, CVSS 5.5	Information Exposure SNYK-JS-LOG4JS-2348757	Yes	No Known Exploit
	661/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.8	Arbitrary Code Injection SNYK-JS-MORGAN-72579	No	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:fresh:20170908	No	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:negotiator:20160616	No	No Known Exploit
	801/1000 Why? Mature exploit, Has a fix available, CVSS 8.3	Arbitrary Code Execution npm:pg:20170813	Yes	Mature
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Override Protection Bypass npm:qs:20170213	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: body-parser

The new version differs by 162 commits.

• b2659a7 1.18.2
• 6339bf7 perf: remove argument reassignment
• d5f9a4a deps: [email protected]
• d041563 1.18.1
• 9efa9ab deps: content-type@~1.0.4
• f1ef6cc deps: [email protected]
• e438db5 deps: [email protected]
• 15c3585 deps: [email protected]
• adfa01c 1.18.0
• 0632e2f Include the "type" property on all generated errors
• b8f97cd Include the "body" property on verify errors
• c659e8a tests: add test for err.body on json parse error
• 4e15325 tests: reorganize json error tests
• 5bd7ed5 tests: reorganize json strict option tests
• 3cb380b tests: store server on mocha context instead of variable shadowing
• 29c8cd0 docs: document too many parameters error
• 7b9cb14 Use http-errors to set status code on errors
• 29a27f1 docs: fix typo in jsdoc comment
• 448dc57 Fix JSON strict violation error to match native parse error
• 87df7e6 tests: add leading whitespace strict json test
• 1841248 deps: [email protected]
• e666dbe deps: http-errors@~1.6.2
• c2a110a deps: [email protected]
• a1a2e31 build: [email protected]

See the full diff

Package name: debug

The new version differs by 154 commits.

• 13abeae Release 2.6.9
• f53962e remove ReDoS regexp in %o formatter (#504)
• 52e1f21 Release 2.6.8
• 2482e08 Check for undefined on browser globals (#462)
• 6bb07f7 release 2.6.7
• 15850cb Fix Regular Expression Denial of Service (ReDoS)
• 4a6c85c update "debug" to v1.0.0 (#454)
• b68dbf8 Fix typo (#455)
• 1351d2f Inline extend function in node implementation (#452)
• c211947 update version for component
• 14df14c release 2.6.5
• cae07b7 cleanup browser tests and fix null reference check on window.documentElement.style.WebkitAppearance (#447)
• f311b10 release 2.6.4
• 1f01b70 Fix bug that would occure if process.env.DEBUG is a non-string value. (#444)
• 2f3ebf4 Update CHANGELOG.md
• f5ae332 Update CHANGELOG.md
• 9742c5f chore(): ignore bower.json in npm installations. (#437)
• 27d93a3 update "debug" to v0.7.3
• 9dc30f8 release 2.6.3
• 0fb8ea4 LocalStorage returns undefined for any key not present (#431)
• ce4d93e changelog fix
• 017a9d6 release 2.6.2
• 23bc780 fix DEBUG_MAX_ARRAY_LENGTH
• 065cbfb Add backers and sponsors from Open Collective (#422)

See the full diff

Package name: express

The new version differs by 218 commits.

• f974d22 4.16.0
• 8d4ceb6 docs: add more information to installation
• c0136d8 Add express.json and express.urlencoded to parse bodies
• 86f5df0 deps: [email protected]
• 4196458 deps: [email protected]
• ddeb713 tests: add maxAge option tests for res.sendFile
• 7154014 Add "escape json" setting for res.json and res.jsonp
• 628438d deps: update example dependencies
• a24fd0c Add options to res.download
• 95fb5cc perf: remove dead .charset set in res.jsonp
• 44591fe deps: vary@~1.1.2
• 2df1ad2 Improve error messages when non-function provided as middleware
• 12c3712 Use safe-buffer for improved Buffer API
• fa272ed docs: fix typo in jsdoc comment
• d9d09b8 perf: re-use options object when generating ETags
• 02a9d5f deps: proxy-addr@~2.0.2
• c2f4fb5 deps: [email protected]
• 673d51f deps: [email protected]
• 5cc761c deps: parseurl@~1.3.2
• ad7d96d deps: [email protected]
• e62bb8b deps: etag@~1.8.1
• 70589c3 deps: content-type@~1.0.4
• 9a99c15 deps: accepts@~1.3.4
• 550043c deps: [email protected]

See the full diff

Package name: log4js

The new version differs by 250 commits.

• 9fdbed5 6.4.0
• 788c7a8 Merge pull request #1150 from log4js-node/update-changelog
• 7fdb141 chore: updated changelog for 6.4.0
• e6bd888 Merge pull request #1151 from log4js-node/feat-zero-backup
• ac599e4 allow for zero backup - in sync with https://github.com/fix: allow for zero backups and zero daysToKeep log4js-node/streamroller#74
• 53248cd Merge pull request #1149 from log4js-node/migrate-daysToKeep-to-numBackups
• 436d9b4 Merge pull request #1148 from log4js-node/update-docs
• d6b017e chore(docs): updated fileSync.md and misc comments
• d4617a7 chore(deps): migrated from daysToKeep to numBackups due to streamroller@^3.0.0
• 0ad0133 Merge pull request #1147 from log4js-node/update-deps
• 773962b Merge pull request #1146 from log4js-node/update-deps
• 823bb46 Merge pull request #1145 from log4js-node/update-deps
• 6cc0035 chore(deps): bump streamroller from 3.0.1 to 3.0.2
• 0f39859 chore(deps): bump date-format from 4.0.2 to 4.0.3
• 85ac31e chore(deps-dev): bump eslint from from 8.6.0 to 8.7.0
• acd41ef Merge pull request #1144 from log4js-node/refactor
• 4c4bbe8 chore(refactor): using writer.writable instead of alive for checking
• e86a809 Merge pull request #1097 from 4eb0da/datefile-error-handling
• 34ab3b2 Merge pull request #1143 from log4js-node/update-test
• 8cba85f chore(test): renamed tap.teardown() to tap.tearDown() for consistency (while both works, only tap.tearDown() is documented)
• a0baec2 chore(test): fixed teardown() causing tests to fail due to fs errors on removal
• 51ac865 Merge pull request #1103 from polo-language/recording-typescript
• 653a20f Merge pull request #1028 from techmunk/master
• 43a2199 chore(test): Changed default TAP test suite timeout from 30s to 45s because Windows takes a long time

See the full diff

Package name: morgan

The new version differs by 114 commits.

• 572dd93 1.9.1
• e02de38 lint: apply standard 12 style
• e329663 Fix using special characters in format
• eb1968a tests: use strict equality checks
• 310b206 build: use yaml eslint configuration
• 5810937 build: [email protected]
• f60afd5 build: [email protected]
• 5295b0c build: [email protected]
• 178daaf build: [email protected]
• 7b08641 build: [email protected]
• 73cb666 build: [email protected]
• edc95aa build: [email protected]
• ace86c3 build: [email protected]
• 4dd1180 lint: apply standard 11 style
• 60c31e8 build: [email protected]
• 05e382f build: [email protected]
• 1a5be20 build: [email protected]
• cf9565f docs: remove gratipay badge
• b66251d build: [email protected]
• 0113732 build: [email protected]
• 47659a9 deps: depd@~1.1.2
• 695f659 build: support Node.js 9.x
• f4c51e9 build: [email protected]
• 4f15f36 build: [email protected]

See the full diff

Package name: pg-promise

The new version differs by 245 commits.

• 5621e09 Upgrading ESLint to v.4.0.0, and refactoring regEx for compliance.
• 70dd783 refactoring distribution.
• 1831bd0 copying refactored code from 6.x
• 4ebb654 docs.
• 5dafe6e docs + tests.
• de02bb1 adding tests.
• bcd71ff typescript update.
• 44795e0 docs = tests.
• cc493fd extending query-formatting engine.
• fa2e00f updating typescript.
• 576d237 Adding Node 8 support.
• 3cd7c5d Merge pull request #293 from akdor1154/errorsDecl
• 40edbb3 Merge branch 'master' into errorsDecl
• 7e8d002 docs.
• 1af6810 improving coverage.
• fd387b2 cleaning up tests.
• 9d0b4cd restoring pg dependency.
• 259aaf1 restoring the branch.
• 7e1e2db merging
• 7e058dc resetting changes.
• 6392865 update
• b887705 restoring the branch.
• c32a9bb Merge branch '6.x' into master
• 6af656b refactoring for ES6 syntax.

See the full diff

Package name: serve-favicon

The new version differs by 50 commits.

• 68b34f5 2.4.5
• 930b0a0 deps: [email protected]
• 8105b88 deps: etag@~1.8.1
• c050d26 2.4.4
• d36c44e deps: [email protected]
• c33f25e deps: parseurl@~1.3.2
• 878c248 tests: use mocha context for server
• e24fa4b deps: [email protected]
• 998dcb5 build: [email protected]
• a5cff5d build: [email protected]
• c2e05e8 build: support Node.js 8.x
• 52cb604 build: [email protected]
• 44c4c6e build: [email protected]
• 9293f89 2.4.3
• 53a3778 deps: [email protected]
• b5b9412 build: [email protected]
• df97c51 build: [email protected]
• dcf75b3 build: [email protected]
• 11108e1 Use safe-buffer for improved Buffer API
• 08135aa tests: use temp-path for paths
• ca3ce4e build: [email protected]
• b450452 2.4.2
• 0b0bf0a build: [email protected]
• 4e083b7 build: [email protected]

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Arbitrary Code Injection
🦉 Remote Code Execution (RCE)
🦉 Arbitrary Code Injection
🦉 More lessons are available in Snyk Learn