[Snyk] Upgrade: bcrypt, cloudinary, dotenv, moment, mongoose, nodemon, socket.io, stripe, validator #6

KOTTAGENVH · 2024-09-21T11:58:21Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

bcrypt
from 5.0.1 to 5.1.1 | 2 versions ahead of your current version | a year ago
on 2023-08-16
cloudinary
from 1.31.0 to 1.41.3 | 20 versions ahead of your current version | 8 months ago
on 2024-01-18
dotenv
from 16.0.2 to 16.4.5 | 18 versions ahead of your current version | 7 months ago
on 2024-02-20
moment
from 2.29.4 to 2.30.1 | 2 versions ahead of your current version | 9 months ago
on 2023-12-27
mongoose
from 6.5.4 to 6.13.0 | 48 versions ahead of your current version | 3 months ago
on 2024-06-06
nodemon
from 2.0.19 to 2.0.22 | 3 versions ahead of your current version | a year ago
on 2023-03-22
socket.io
from 4.5.1 to 4.7.5 | 13 versions ahead of your current version | 6 months ago
on 2024-03-14
stripe
from 10.7.0 to 10.17.0 | 14 versions ahead of your current version | 2 years ago
on 2022-11-08
validator
from 13.7.0 to 13.12.0 | 3 versions ahead of your current version | 4 months ago
on 2024-05-09

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	589	No Known Exploit
Uncaught Exception SNYK-JS-ENGINEIO-5496331	589	No Known Exploit
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	589	Proof of Concept
Prototype Pollution SNYK-JS-MONGOOSE-5777721	589	Proof of Concept
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	589	Proof of Concept
Uncaught Exception SNYK-JS-SOCKETIO-7278048	589	No Known Exploit
Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	589	No Known Exploit
Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	589	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	589	Proof of Concept
Information Exposure SNYK-JS-MONGODB-5871303	589	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	589	Proof of Concept
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	589	Proof of Concept
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') SNYK-JS-VM2-5537079	589	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-WORDWRAP-3149973	589	Proof of Concept
Sandbox Escape SNYK-JS-VM2-5415299	589	Proof of Concept
Sandbox Escape SNYK-JS-VM2-5422057	589	Proof of Concept
Improper Handling of Exceptional Conditions SNYK-JS-VM2-5426093	589	No Known Exploit
Sandbox Bypass SNYK-JS-VM2-5537100	589	Proof of Concept
Remote Code Execution (RCE) SNYK-JS-VM2-5772823	589	Proof of Concept
Remote Code Execution (RCE) SNYK-JS-VM2-5772825	589	Mature

Release notes

Package name: bcrypt

5.1.1 - 2023-08-16
What's Changed
- Refactored example with async await by @ lpizzinidev in #894
- Fixed z/OS build issue by @ laijonathan in #968
- Update dependencies by @ recrsn in #993
New Contributors
- @ lpizzinidev made their first contribution in #894
- @ laijonathan made their first contribution in #968
Full Changelog: v5.1.0...v5.1.1
5.1.0 - 2022-10-06
What's Changed
- Update node-pre-gyp to 1.0.2 by @ feuxfollets1013 in #865
- Update README for inclusion of musl by @ arbourd in #883
- Version bump, security updates to sub dep npmlog by @ adaniels-parabol in #905
- document ESM usage (#892) by @ mariusa in #899
- fix: update travis CI Docker image repository by @ cokia in #930
- Update node versions in appveyor test matrix by @ p-kuen in #936
- chore(appveyor): not use latest npm by @ cokia in #932
- chore: update Appveyor readme badge by @ cokia in #933
- Use Github actions for CI by @ recrsn in #858
- Update dependencies by @ recrsn in #953
- Migrate tests to use Jest by @ recrsn in #958
- Pin NAPI to v3 by @ recrsn in #959
New Contributors
- @ feuxfollets1013 made their first contribution in #865
- @ arbourd made their first contribution in #883
- @ adaniels-parabol made their first contribution in #905
- @ mariusa made their first contribution in #899
- @ cokia made their first contribution in #930
- @ p-kuen made their first contribution in #936
Full Changelog: v5.0.1...v5.1.0
5.0.1 - 2021-02-26
Update node-pre-gyp to 1.0.0

from bcrypt GitHub release notes

Package name: cloudinary

1.41.3 - 2024-01-18
1.41.2 - 2024-01-08
1.41.1 - 2023-12-18
1.41.0 - 2023-09-26
1.40.0 - 2023-07-31
1.39.0 - 2023-07-24
1.38.0 - 2023-07-20
1.37.3 - 2023-06-26
1.37.2 - 2023-06-19
1.37.1 - 2023-06-09
1.37.0 - 2023-05-16
1.36.4 - 2023-05-02
1.36.3 - 2023-05-02
1.36.2 - 2023-04-24
1.36.1 - 2023-04-13
1.36.0 - 2023-04-13
1.35.0 - 2023-03-03
1.34.0 - 2023-02-13
1.33.0 - 2022-12-15
1.32.0 - 2022-09-14
1.31.0 - 2022-08-28

from cloudinary GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: moment

2.30.1 - 2023-12-27
2.30.1
2.30.0 - 2023-12-26
2.30.0
2.29.4 - 2022-07-06
2.29.4

from moment GitHub release notes

Package name: mongoose

6.13.0 - 2024-06-06
6.12.9 - 2024-05-24
6.12.8 - 2024-04-10
6.12.7 - 2024-03-01
6.12.6 - 2024-01-22
6.12.5 - 2024-01-03
6.12.4 - 2023-12-27
6.12.3 - 2023-11-07
6.12.2 - 2023-10-25
6.12.1 - 2023-10-12
6.12.0 - 2023-08-24
6.11.6 - 2023-08-21
6.11.5 - 2023-08-01
6.11.4 - 2023-07-17
6.11.3 - 2023-07-11
6.11.2 - 2023-06-08
6.11.1 - 2023-05-08
6.11.0 - 2023-05-01
6.10.5 - 2023-04-06
6.10.4 - 2023-03-21
6.10.3 - 2023-03-13
6.10.2 - 2023-03-07
6.10.1 - 2023-03-03
6.10.0 - 2023-02-22
6.9.3 - 2023-02-22
6.9.2 - 2023-02-16
6.9.1 - 2023-02-06
6.9.0 - 2023-01-25
6.8.4 - 2023-01-17
6.8.3 - 2023-01-06
6.8.2 - 2022-12-28
6.8.1 - 2022-12-19
6.8.0 - 2022-12-05
6.7.5 - 2022-11-30
6.7.4 - 2022-11-28
6.7.3 - 2022-11-22
6.7.2 - 2022-11-07
6.7.1 - 2022-11-02
6.7.0 - 2022-10-24
6.6.7 - 2022-10-21
6.6.6 - 2022-10-20
6.6.5 - 2022-10-05
6.6.4 - 2022-10-03
6.6.3 - 2022-09-30
6.6.2 - 2022-09-26
6.6.1 - 2022-09-14
6.6.0 - 2022-09-08
6.5.5 - 2022-09-07
6.5.4 - 2022-08-30

from mongoose GitHub release notes

Package name: nodemon

2.0.22 - 2023-03-22
2.0.22 (2023-03-22)

Bug Fixes
- remove ts mapping if loader present (f7816e4), closes #2083
2.0.21 - 2023-03-02
2.0.21 (2023-03-02)

Bug Fixes
- remove ts mapping if loader present (1468397), closes #2083
2.0.20 - 2022-09-16
2.0.20 (2022-09-16)

Bug Fixes
- remove postinstall script (e099e91)
2.0.19 - 2022-07-05
2.0.19 (2022-07-05)

Bug Fixes
- Replace update notifier with simplified deps (#2033) (176c4a6), closes #1961 #2028

from nodemon GitHub release notes

Package name: socket.io

4.7.5 - 2024-03-14
4.7.4 - 2024-01-12
4.7.3 - 2024-01-03
4.7.2 - 2023-08-02
4.7.1 - 2023-06-28
4.7.0 - 2023-06-22
4.6.2 - 2023-05-31
4.6.1 - 2023-02-20
4.6.0 - 2023-02-07
4.6.0-alpha1 - 2023-01-25
4.5.4 - 2022-11-22
4.5.3 - 2022-10-15
4.5.2 - 2022-09-02
4.5.1 - 2022-05-17

from socket.io GitHub release notes

Package name: stripe

10.17.0 - 2022-11-08
- #1610 API Updates
  - Add support for new values eg_tin, ph_tin, and tr_tin on enums Checkout.Session.customer_details.tax_ids[].type, Invoice.customer_tax_ids[].type, Order.tax_details.tax_ids[].type, and TaxId.type
  - Add support for new values eg_tin, ph_tin, and tr_tin on enums CustomerCreateParams.tax_id_data[].type, InvoiceUpcomingLinesParams.customer_details.tax_ids[].type, InvoiceUpcomingParams.customer_details.tax_ids[].type, OrderCreateParams.tax_details.tax_ids[].type, OrderUpdateParams.tax_details.tax_ids[].type, and TaxIdCreateParams.type
  - Add support for reason_message on Issuing.Authorization.request_history[]
  - Add support for new value webhook_error on enum Issuing.Authorization.request_history[].reason
See the changelog for more details.
10.16.0 - 2022-11-03
- #1596 API Updates
  - Add support for on_behalf_of on CheckoutSessionCreateParams.subscription_data, SubscriptionCreateParams, SubscriptionSchedule.default_settings, SubscriptionSchedule.phases[], SubscriptionScheduleCreateParams.default_settings, SubscriptionScheduleCreateParams.phases[], SubscriptionScheduleUpdateParams.default_settings, SubscriptionScheduleUpdateParams.phases[], SubscriptionUpdateParams, and Subscription
  - Add support for tax_behavior and tax_code on InvoiceItemCreateParams, InvoiceItemUpdateParams, InvoiceUpcomingLinesParams.invoice_items[], and InvoiceUpcomingParams.invoice_items[]
See the changelog for more details.
10.16.0-beta.2 - 2022-11-02
- #1598 API Updates for beta branch
  - Updated beta APIs to the latest stable version
  - Add support for cashappPayments and zipPayments on Account.
  - Add support for cashapp and zip on Charge, PaymentMethod.
  - Add support for trialSettings on SubscriptionSchedule.
See the changelog for more details.
10.16.0-beta.1 - 2022-10-22
- #1589 API Updates for beta branch
  - Updated stable APIs to the latest version
  - Add support for new value revoked on enum CapitalFinancingOfferListParams.status
  - Add support for paypal on Charge.payment_method_details and Source
  - Add support for network_data on Issuing.Transaction
  - Add support for new value paypal on enum Source.type
  - Add support for billing_cycle_anchor on SubscriptionScheduleAmendParams.amendments[]
See the changelog for more details.
10.15.0 - 2022-10-20
- #1588 API Updates
  - Add support for new values jp_trn and ke_pin on enums Checkout.Session.customer_details.tax_ids[].type, Invoice.customer_tax_ids[].type, Order.tax_details.tax_ids[].type, and TaxId.type
  - Add support for new values jp_trn and ke_pin on enums CustomerCreateParams.tax_id_data[].type, InvoiceUpcomingLinesParams.customer_details.tax_ids[].type, InvoiceUpcomingParams.customer_details.tax_ids[].type, OrderCreateParams.tax_details.tax_ids[].type, OrderUpdateParams.tax_details.tax_ids[].type, and TaxIdCreateParams.type
  - Add support for tipping on Terminal.Reader.action.process_payment_intent.process_config and TerminalReaderProcessPaymentIntentParams.process_config
- #1585 use native UUID method if available
See the changelog for more details.
10.15.0-beta.1 - 2022-10-14
- Add support for schedule_settings on SubscriptionScheduleAmendParams
- Add support for new value upcoming_invoice on enum SubscriptionScheduleAmendParams.amendments[].amendment_end.type
- Add support for new values schedule_end and upcoming_invoice on enum SubscriptionScheduleAmendParams.amendments[].amendment_start.type
See the changelog for more details.
10.14.0 - 2022-10-13
- #1582 API Updates
  - Add support for new values invalid_representative_country and verification_failed_residential_address on enums Account.future_requirements.errors[].code, Account.requirements.errors[].code, Capability.future_requirements.errors[].code, Capability.requirements.errors[].code, Person.future_requirements.errors[].code, and Person.requirements.errors[].code
  - Add support for request_log_url on StripeError objects
  - Add support for network_data on Issuing.Authorization
  - ⚠️ Remove currency, description, images, and name from Checkout.SessionCreateParams. These properties do not work on the latest API version. (fixes #1575)
See the changelog for more details.
10.14.0-beta.1 - 2022-10-07
- #1572 API Updates for beta branch
  - Updated stable APIs to the latest version
See the changelog for more details.
10.13.0 - 2022-10-06
- #1571 API Updates
  - Add support for new value invalid_dob_age_under_18 on enums Account.future_requirements.errors[].code, Account.requirements.errors[].code, Capability.future_requirements.errors[].code, Capability.requirements.errors[].code, Person.future_requirements.errors[].code, and Person.requirements.errors[].code
  - Add support for new value bank_of_china on enums Charge.payment_method_details.fpx.bank, PaymentIntentConfirmParams.payment_method_data.fpx.bank, PaymentIntentCreateParams.payment_method_data.fpx.bank, PaymentIntentUpdateParams.payment_method_data.fpx.bank, PaymentMethod.fpx.bank, PaymentMethodCreateParams.fpx.bank, SetupIntentConfirmParams.payment_method_data.fpx.bank, SetupIntentCreateParams.payment_method_data.fpx.bank, and SetupIntentUpdateParams.payment_method_data.fpx.bank
  - Add support for new values America/Nuuk, Europe/Kyiv, and Pacific/Kanton on enum ReportingReportRunCreateParams.parameters.timezone
  - Add support for klarna on SetupAttempt.payment_method_details
- #1570 Update node-fetch to 2.6.7
- #1568 Upgrade dependencies
- #1567 Fix release tag calculation
See the changelog for more details.
10.12.0 - 2022-09-29
- #1564 API Updates
  - Change type of Charge.payment_method_details.card_present.incremental_authorization_supported and Charge.payment_method_details.card_present.overcapture_supported from boolean | null to boolean
  - Add support for created on Checkout.Session
  - Add support for setup_future_usage on PaymentIntent.payment_method_options.pix, PaymentIntentConfirmParams.payment_method_options.pix, PaymentIntentCreateParams.payment_method_options.pix, and PaymentIntentUpdateParams.payment_method_options.pix
  - Deprecate CheckoutSessionCreateParams.subscription_data.items (use the line_items param instead). This will be removed in the next major version.
- #1563 Migrate other Stripe infrastructure to TS
- #1562 Restore lib after generating
- #1551 Re-introduce Typescript changes
See the changelog for more details.
10.12.0-beta.1 - 2022-09-26
10.11.0 - 2022-09-22
10.10.0 - 2022-09-15
10.8.0 - 2022-09-07
10.7.0 - 2022-08-31

from stripe GitHub release notes

Package name: validator

13.12.0 - 2024-05-09
What's Changed

New Features / Validators
- #2143 isAbaRouting @ songyuew
Fixes, New Locales and Enhancements
- #2207 isLicensePlate add Pakistani en-PK locale @ anasshakil
- #2208 isPort fix invalid leading zeros @ anasshakil
- #2224 isTaxID added Argentina es-AR locale @ estefrare
- #2257 isDate timezone offset fix @ tomaspanek
- #2265 isPassportNumber added ZA locale @ GMorris-professional
- isMobilePhone:
  - #2267 added en-MW locale @ SimranSiddiqui
  - #2140 fix am-AM locale @ AlexKrupko
- #2271 isPostalAddress fix NL locale @ RobinvanderVliet
- #2273 isISO4217 add SLE currency @ urg
- #2278 isStrongPassword fix symbolRegex to include \ @ nandavikas
- #2279 isVAT fixed KZ locale @ MatthieuLemoine
- #2285 isAlpha, isAlphanumeric added eo locale @ RobinvanderVliet
- #2320 isIBAN add Algeria DZ locale @ thibault-lr
- #2343 isVATimprove AU locale @ matthewberryman
- #2345 isUUID add support for v7 @ ruscon
- #2358 isTaxID add Ukraine uk-UA locale @ arttiger
- #2381 isDate disallow hiphen before year @ Sumit-tech-joshi
- Doc fixes and others:
New Contributors
- @ tomaspanek made their first contribution in #2257
- @ estefrare made their first contribution in #2224
- @ GMorris-professional made their first contribution in #2265
- @ SimranSiddiqui made their first contribution in #2267
- @ ZhulinskiiDanil made their first contribution in #2368
- @ devmanbud made their first contribution in #2371
- @ ruscon made their first contribution in #2345
- @ amaliacatalina made their first contribution in #2284

Snyk has created this PR to upgrade: - bcrypt from 5.0.1 to 5.1.1. See this package in npm: https://www.npmjs.com/package/bcrypt - cloudinary from 1.31.0 to 1.41.3. See this package in npm: https://www.npmjs.com/package/cloudinary - dotenv from 16.0.2 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - moment from 2.29.4 to 2.30.1. See this package in npm: https://www.npmjs.com/package/moment - mongoose from 6.5.4 to 6.13.0. See this package in npm: https://www.npmjs.com/package/mongoose - nodemon from 2.0.19 to 2.0.22. See this package in npm: https://www.npmjs.com/package/nodemon - socket.io from 4.5.1 to 4.7.5. See this package in npm: https://www.npmjs.com/package/socket.io - stripe from 10.7.0 to 10.17.0. See this package in npm: https://www.npmjs.com/package/stripe - validator from 13.7.0 to 13.12.0. See this package in npm: https://www.npmjs.com/package/validator See this project in Snyk: https://app.snyk.io/org/kottagenvh/project/1f6e4185-c6f7-40c8-9c37-6f6ec2310bdc?utm_source=github&utm_medium=referral&page=upgrade-pr

netlify · 2024-09-21T12:02:11Z

❌ Deploy Preview for polite-dragon-8754d9 failed.

Name	Link
🔨 Latest commit	`c3498f0`
🔍 Latest deploy log	https://app.netlify.com/sites/polite-dragon-8754d9/deploys/66eeb4e09946ca000872c735

netlify · 2024-09-21T12:03:38Z

❌ Deploy Preview for lustrous-crepe-2ddaec failed.

Name	Link
🔨 Latest commit	`c3498f0`
🔍 Latest deploy log	https://app.netlify.com/sites/lustrous-crepe-2ddaec/deploys/66eeb4e082dad500082a57e2

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Upgrade: bcrypt, cloudinary, dotenv, moment, mongoose, nodemon, socket.io, stripe, validator #6

[Snyk] Upgrade: bcrypt, cloudinary, dotenv, moment, mongoose, nodemon, socket.io, stripe, validator #6

Uh oh!

KOTTAGENVH commented Sep 21, 2024

What's Changed

New Contributors

What's Changed

New Contributors

2.0.22 (2023-03-22)

Bug Fixes

2.0.21 (2023-03-02)

Bug Fixes

2.0.20 (2022-09-16)

Bug Fixes

2.0.19 (2022-07-05)

Bug Fixes

What's Changed

New Features / Validators

Fixes, New Locales and Enhancements

New Contributors

Uh oh!

netlify bot commented Sep 21, 2024 •

edited

Loading

Uh oh!

netlify bot commented Sep 21, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

[Snyk] Upgrade: bcrypt, cloudinary, dotenv, moment, mongoose, nodemon, socket.io, stripe, validator #6

Are you sure you want to change the base?

[Snyk] Upgrade: bcrypt, cloudinary, dotenv, moment, mongoose, nodemon, socket.io, stripe, validator #6

Uh oh!

Conversation

KOTTAGENVH commented Sep 21, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

New Contributors

What's Changed

New Contributors

2.0.22 (2023-03-22)

Bug Fixes

2.0.21 (2023-03-02)

Bug Fixes

2.0.20 (2022-09-16)

Bug Fixes

2.0.19 (2022-07-05)

Bug Fixes

What's Changed

New Features / Validators

Fixes, New Locales and Enhancements

New Contributors

Uh oh!

netlify bot commented Sep 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for polite-dragon-8754d9 failed.

Uh oh!

netlify bot commented Sep 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for lustrous-crepe-2ddaec failed.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Sep 21, 2024 •

edited

Loading

netlify bot commented Sep 21, 2024 •

edited

Loading