[Snyk] Upgrade express-slow-down from 1.4.0 to 1.6.0 #289

MaximKing1 · 2024-10-16T02:26:03Z

Snyk has created this PR to upgrade express-slow-down from 1.4.0 to 1.6.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 4 versions ahead of your current version.
The recommended version was released 2 years ago, on 2023-03-18.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Prototype Pollution SNYK-JS-MONGOOSE-5777721	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Proof of Concept
Asymmetric Resource Consumption (Amplification) SNYK-JS-BODYPARSER-7926860	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	No Known Exploit
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Proof of Concept
Arbitrary Code Execution SNYK-JS-SQLITE3-3358947	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	No Known Exploit
Cross-site Scripting SNYK-JS-EXPRESS-7926867	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Proof of Concept
Information Exposure SNYK-JS-MONGODB-5871303	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Proof of Concept
Cross-site Scripting SNYK-JS-SEND-7926862	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	No Known Exploit
Cross-site Scripting SNYK-JS-SERVESTATIC-7926865	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: express-slow-down

1.6.0 - 2023-03-18
1.5.0 - 2022-09-23
1.5.0
1.4.2 - 2022-09-22
1.4.2
1.4.1 - 2022-09-07
1.4.1
1.4.0 - 2020-12-10
1.4.0

from express-slow-down GitHub release notes

Commit messages

Package name: express-slow-down

c70c381 1.6.0
e3f598e Add support for modern promise-based Store API (PR [Snyk] Upgrade mongoose from 5.11.16 to 5.12.6 #38)
2f06055 Make it compatible with latest rate-limit-redis
308a4a6 Merge pull request [Snyk] Upgrade mongoose from 5.11.16 to 5.12.5 #37 from express-rate-limit/dependabot/npm_and_yarn/cookiejar-2.1.4
b65961b Merge pull request [Snyk] Upgrade helmet from 4.4.1 to 4.5.0 #34 from express-rate-limit/dependabot/npm_and_yarn/minimatch-3.1.2
9ae0654 Bump cookiejar from 2.1.3 to 2.1.4
01fcbdc Merge pull request [Snyk] Upgrade mongoose from 5.11.16 to 5.12.5 #36 from express-rate-limit/dependabot/npm_and_yarn/json5-2.2.3
ec00f38 Bump json5 from 2.2.1 to 2.2.3
3577883 Merge pull request Bump lodash from 4.17.20 to 4.17.21 #35 from express-rate-limit/dependabot/npm_and_yarn/qs-and-formidable-6.11.0
3349032 Bump qs and formidable
bb44566 Bump minimatch from 3.0.4 to 3.1.2
a9e6509 1.5.0
fd544b4 Merge pull request [Snyk] Upgrade mongoose from 5.11.16 to 5.12.2 #23 from ev3nvy/main
76c1760 add tests
7adbd95 allow delayMs and maxDelayMs to be a function
b118b9e Setting delay to 0 does not disable it
9bac5ff 1.4.2
ff4f60d loosen up timings on one legacy realtime test to allow for slow macos CI environment
0a94326 don't hang if req body is processed before express-slow-down sees it.
eab0bf9 Update CI status badge
7b813df loosening up legacy tests a bit for macos in CI
003013d drop node.js 12 from CI
48441b8 switch to jest, add a bunch of new tests, upgrade supertest, disable one legacy test
528cbc5 re-enable windows and mac tests