[Snyk] Fix for 1 vulnerabilities

[Omrisnyk]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • goof/package.json
  • goof/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity	Reachability
	44/1000 Why? Confidentiality impact: None, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 3, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 1.86, Score Version: V5	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	No	No Known Exploit	No Path Found

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: cookie-parser

• 1.4.7 - 2024-10-08
  

  What's Changed

  • chore: add support for OSSF scorecard reporting by @ inigomarquinez in #103
  • ci: fix errors in ci github action for node 8 and 9 by @ inigomarquinez in #104
  • ci: Use GITHUB_OUTPUT envvar instead of set-output command by @ arunsathiya in #100
  • deps: [email protected] by @ SamChatfield in #116
  • Release: 1.4.7 by @ UlisesGascon in #117

  New Contributors

  • @ inigomarquinez made their first contribution in #103
  • @ arunsathiya made their first contribution in #100
  • @ SamChatfield made their first contribution in #116
  • @ UlisesGascon made their first contribution in #117

  Full Changelog: 1.4.6...1.4.7

• 1.4.6 - 2021-11-16
  
  • deps: [email protected]
• 1.4.5 - 2020-03-15
  
  • deps: [email protected]
• 1.4.4 - 2019-02-13
  
  • perf: normalize secret argument only once
• 1.4.3 - 2016-05-27
  
  • deps: [email protected]
    • perf: use for loop in parse
• 1.4.2 - 2016-05-21
  
  • deps: [email protected]
    • perf: enable strict mode
    • perf: use for loop in parse
    • perf: use string concatination for serialization
• 1.4.1 - 2016-01-11
  
  • deps: [email protected]
  • perf: enable strict mode
• 1.4.0 - 2015-09-18
  

  1.4.0

• 1.3.5 - 2015-05-20
  
  • deps: [email protected]
    • Slight optimizations
• 1.3.4 - 2015-02-15
  
  • deps: [email protected]
• 1.3.3 - 2014-09-06

from cookie-parser GitHub release notes

Package name: express

• 4.21.1 - 2024-10-08
  

  What's Changed

  • Backport a fix for CVE-2024-47764 to the 4.x branch by @ joshbuker in #6029
  • Release: 4.21.1 by @ UlisesGascon in #6031

  Full Changelog: 4.21.0...4.21.1

• 4.21.0 - 2024-09-11
  

  What's Changed

  • Deprecate "back" magic string in redirects by @ blakeembrey in #5935
  • [email protected] by @ wesleytodd in #5954
  • fix(deps): [email protected] by @ wesleytodd in #5951
  • Upgraded dependency qs to 6.13.0 to match qs in body-parser by @ agadzinski93 in #5946

  New Contributors

  • @ agadzinski93 made their first contribution in #5946

  Full Changelog: 4.20.0...4.21.0

• 4.20.0 - 2024-09-10
  

  What's Changed

  Important

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect

  Other Changes

  • 4.19.2 Staging by @ wesleytodd in #5561
  • remove duplicate location test for data uri by @ wesleytodd in #5562
  • feat: document beta releases expectations by @ marco-ippolito in #5565
  • Cut down on duplicated CI runs by @ jonchurch in #5564
  • Add a Threat Model by @ UlisesGascon in #5526
  • Assign captain of encodeurl by @ blakeembrey in #5579
  • Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @ jonchurch in #5587
  • docs: update Security.md by @ inigomarquinez in #5590
  • docs: update triage nomination policy by @ UlisesGascon in #5600
  • Add CodeQL (SAST) by @ UlisesGascon in #5433
  • docs: add UlisesGascon as triage initiative captain by @ UlisesGascon in #5605
  • deps: encodeurl@~2.0.0 by @ blakeembrey in #5569
  • skip QUERY method test by @ jonchurch in #5628
  • ignore ETAG query test on 21 and 22, reuse skip util by @ jonchurch in #5639
  • add support Node.js@22 in the CI by @ mertcanaltin in #5627
  • doc: add table of contents, tc/triager lists to readme by @ mertcanaltin in #5619
  • List and sort all projects, add captains by @ blakeembrey in #5653
  • docs: add @ UlisesGascon as captain for cookie-parser by @ UlisesGascon in #5666
  • ✨ bring back query tests for node 21 by @ ctcpip in #5690
  • [v4] Deprecate res.clearCookie accepting options.maxAge and options.expires by @ jonchurch in #5672
  • skip QUERY tests for Node 21 only, still not supported by @ jonchurch in #5695
  • 📝 update people, add ctcpip to TC by @ ctcpip in #5683
  • remove minor version pinning from ci by @ jonchurch in #5722
  • Fix link variable use in attribution section of CODE OF CONDUCT by @ IamLizu in #5762
  • Replace Appveyor windows testing with GHA by @ jonchurch in #5599
  • Add OSSF Scorecard badge by @ UlisesGascon in #5436
  • update scorecard link by @ bjohansebas in #5814
  • Nominate @ IamLizu to the triage team by @ UlisesGascon in #5836
  • deps: [email protected] by @ blakeembrey in #5603
  • docs: specify new instructions for question and discuss by @ IamLizu in #5835
  • 4.x: Upgrade merge-descriptors dependency by @ RobinTail in #5781
  • [email protected] by @ blakeembrey in #5902

  New Contributors

  • @ marco-ippolito made their first contribution in #5565
  • @ inigomarquinez made their first contribution in #5590
  • @ mertcanaltin made their first contribution in #5627
  • @ ctcpip made their first contribution in #5690
  • @ bjohansebas made their first contribution in #5814

  Full Changelog: 4.19.1...4.20.0

• 4.19.2 - 2024-03-25
  

  What's Changed

  • Improved fix for open redirect allow list bypass

  Full Changelog: 4.19.1...4.19.2

• 4.19.1 - 2024-03-20
  

  What's Changed

  • Fix ci after location patch by @ wesleytodd in #5552
  • fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556

  Full Changelog: 4.19.0...4.19.1

• 4.19.0 - 2024-03-20
  

  What's Changed

  • fix typo in release date by @ UlisesGascon in #5527
  • docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
  • docs: loosen TC activity rules by @ wesleytodd in #5510
  • Add note on how to update docs for new release by @ crandmck in #5541
  • Prevent open redirect allow list bypass due to encodeurl
  • Release 4.19.0 by @ wesleytodd in #5551

  New Contributors

  • @ crandmck made their first contribution in #5541

  Full Changelog: 4.18.3...4.19.0

• 4.18.3 - 2024-02-29
• 4.18.2 - 2022-10-08
• 4.18.1 - 2022-04-29
• 4.18.0 - 2022-04-25
• 4.17.3 - 2022-02-17
• 4.17.2 - 2021-12-17
• 4.17.1 - 2019-05-26
• 4.17.0 - 2019-05-17
• 4.16.4 - 2018-10-11
• 4.16.3 - 2018-03-12
• 4.16.2 - 2017-10-10
• 4.16.1 - 2017-09-29
• 4.16.0 - 2017-09-28
• 4.15.5 - 2017-09-25
• 4.15.4 - 2017-08-07
• 4.15.3 - 2017-05-17
• 4.15.2 - 2017-03-06
• 4.15.1 - 2017-03-06
• 4.15.0 - 2017-03-01
• 4.14.1 - 2017-01-28
• 4.14.0 - 2016-06-16
• 4.13.4 - 2016-01-22
• 4.13.3 - 2015-08-03
• 4.13.2 - 2015-07-31
• 4.13.1 - 2015-07-06
• 4.13.0 - 2015-06-21
• 4.12.4 - 2015-05-18

from express GitHub release notes

Commit messages

Package name: cookie-parser

The new version differs by 209 commits.

• 5d61e1e 1.4.7
• ccf1f54 deps: [email protected] ([Snyk] Security upgrade mongoose from 4.2.4 to 5.13.20 #116)
• 429cfd4 ci: Use GITHUB_OUTPUT envvar instead of set-output command ([Snyk] Fix for 92 vulnerabilities #100)
• ca4c97e ci: fix errors in ci pipeline for node 8 and 9 ([Snyk] Security upgrade adm-zip from 0.4.7 to 0.4.11 #104)
• 97bdf39 ci: add support for OSSF scorecard reporting ([Snyk] Security upgrade adm-zip from 0.4.7 to 0.4.11 #103)
• e5862bd build: [email protected]
• f0688d2 build: [email protected]
• 44ec541 build: [email protected]
• 695435a deps: [email protected]
• f66e7e1 build: [email protected]
• 05e40b1 build: [email protected]
• bc1d501 build: use [email protected] for Node.js 6.x
• dda4c5b 1.4.6
• 8653e78 build: support Node.js 17.x
• 6ec9c5b deps: [email protected]
• ee68a8a build: [email protected]
• 7828d66 build: [email protected]
• dafa811 build: use nyc for coverage testing
• d80cf11 build: [email protected]
• c954873 build: [email protected]
• 8ad6c54 build: [email protected]
• 716f5a4 build: support Node.js 16.x
• 90c418d build: [email protected]
• a3cff78 build: support Node.js 15.x

See the full diff

Package name: express

The new version differs by 250 commits.

• 8e229f9 4.21.1
• a024c8a fix(deps): [email protected]
• 7e562c6 4.21.0
• 1bcde96 fix(deps): [email protected] ([Snyk] Security upgrade tap from 5.8.0 to 16.0.0 snyk-fixtures/npm-lockfiles#5946)
• 7d36477 fix(deps): [email protected] ([Snyk] Security upgrade tap from 5.8.0 to 16.0.0 snyk-fixtures/npm-lockfiles#5951)
• 40d2d8f fix(deps): [email protected]
• 77ada90 Deprecate `"back"` magic string in redirects ([Snyk] Security upgrade mongoose from 4.2.4 to 4.2.5 snyk-fixtures/npm-lockfiles#5935)
• 21df421 4.20.0
• 4c9ddc1 feat: upgrade to [email protected]
• 9ebe5d5 feat: upgrade to [email protected] ([Snyk] Security upgrade tap from 5.8.0 to 15.0.0 snyk-fixtures/npm-lockfiles#5928)
• ec4a01b feat: upgrade to [email protected] ([Snyk] Security upgrade tap from 5.8.0 to 15.0.0 snyk-fixtures/npm-lockfiles#5926)
• 54271f6 fix: don't render redirect values in anchor href
• 125bb74 [email protected] ([Snyk] Fix for 1 vulnerabilities snyk-fixtures/npm-lockfiles#5902)
• 2a980ad [email protected] ([Snyk] Security upgrade snyk from 1.389.0 to 1.685.0 snyk-fixtures/npm-lockfiles#5781)
• a3e7e05 docs: specify new instructions for `question` and `discuss`
• c5addb9 deps: [email protected] ([Snyk(Unlimited)] Upgrade marked from 0.3.5 to 0.8.2 snyk-fixtures/npm-lockfiles#5603)
• e35380a docs: add @ IamLizu to the triage team ([Snyk] Fix for 1 vulnerabilities snyk-fixtures/npm-lockfiles#5836)
• f5b6e67 docs: update scorecard link ([Snyk] Fix for 1 vulnerabilities snyk-fixtures/npm-lockfiles#5814)
• 2177f67 docs: add OSSF Scorecard badge ([Snyk(Unlimited)] Upgrade morgan from 1.9.1 to 1.10.0 snyk-fixtures/npm-lockfiles#5436)
• f4bd86e Replace Appveyor windows testing with GHA ([Snyk(Unlimited)] Upgrade adm-zip from 0.4.7 to 0.4.14 snyk-fixtures/npm-lockfiles#5599)
• 2ec589c Fix Contributor Covenant link definition reference in attribution section ([Snyk] Security upgrade snyk from 1.389.0 to 1.518.0 snyk-fixtures/npm-lockfiles#5762)
• 4cf7eed remove minor version pinning from ci ([Snyk] Security upgrade mongodb-schema from 8.2.2 to 9.0.0 snyk-fixtures/npm-lockfiles#5722)
• 6d08471 📝 update people, add ctcpip to TC ([Snyk] Security upgrade tap from 5.8.0 to 12.0.2 snyk-fixtures/npm-lockfiles#5683)
• 61421a8 skip QUERY tests for Node 21 only, still not supported ([Snyk-local] Security upgrade adm-zip from 0.4.7 to 0.4.11 snyk-fixtures/npm-lockfiles#5695)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)