chore(deps): bump on-headers, morgan and compression in /angular8 - #187
chore(deps): bump on-headers, morgan and compression in /angular8#187dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [on-headers](https://github.com/jshttp/on-headers) to 1.1.0 and updates ancestor dependencies [on-headers](https://github.com/jshttp/on-headers), [morgan](https://github.com/expressjs/morgan) and [compression](https://github.com/expressjs/compression). These dependencies need to be updated together. Updates `on-headers` from 1.0.2 to 1.1.0 - [Release notes](https://github.com/jshttp/on-headers/releases) - [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md) - [Commits](jshttp/on-headers@v1.0.2...v1.1.0) Updates `morgan` from 1.10.0 to 1.11.0 - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.10.0...1.11.0) Updates `compression` from 1.7.4 to 1.8.1 - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](expressjs/compression@1.7.4...v1.8.1) --- updated-dependencies: - dependency-name: on-headers dependency-version: 1.1.0 dependency-type: indirect - dependency-name: morgan dependency-version: 1.11.0 dependency-type: direct:production - dependency-name: compression dependency-version: 1.8.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Semgrep found 2 Risk: Affected versions of @babel/helpers, @babel/runtime, @babel/runtime-corejs2, and @babel/runtime-corejs3 are vulnerable to Inefficient Regular Expression Complexity. Babel generates a polyfill (the Fix: Upgrade this library to at least version 7.26.10 at angular2-jwt-samples/angular8/package-lock.json:4019. Reference(s): GHSA-968p-4wvh-cqc8, CVE-2025-27789 Semgrep found 1 Risk: Affected versions of esbuild are vulnerable to Origin Validation Error. esbuild's development server responds to every request, including Server-Sent Events connections, with Manual Review Advice: A vulnerability from this advisory is reachable if you run esbuild with the Fix: Upgrade this library to at least version 0.25.0 at angular2-jwt-samples/angular8/package-lock.json:352. Reference(s): GHSA-67mh-4wv8-2f99 Semgrep found 1 Risk: Affected versions of js-yaml are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). js-yaml is vulnerable to prototype pollution through its YAML merge key ( Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 3.14.2 at angular2-jwt-samples/angular8/package-lock.json:11554. Reference(s): GHSA-mh29-5h37-fv8m, CVE-2025-64718 Semgrep found 1 Risk: Affected versions of webpack-dev-server are vulnerable to Exposed Dangerous Method or Function. webpack-dev-server serves bundled assets without rejecting cross-origin classic script requests. Because such Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 5.2.1 at angular2-jwt-samples/angular8/package-lock.json:18686. Reference(s): GHSA-4v9v-hfq4-rm2v, CVE-2025-30359 Semgrep found 1 Risk: Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable. Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 5.2.1 at angular2-jwt-samples/angular8/package-lock.json:18686. Reference(s): GHSA-9jgg-88mc-972h, CVE-2025-30360 Semgrep found 1 Risk: Affected versions of webpack are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). webpack's AutoPublicPathRuntimeModule emits runtime code that derives the asset public path from document.currentScript. Because document.currentScript can be DOM-clobbered by an injected scriptless element (e.g. Manual Review Advice: A vulnerability from this advisory is reachable if you build with output.publicPath unset Fix: Upgrade this library to at least version 5.94.0 at angular2-jwt-samples/angular8/package-lock.json:18595. Reference(s): GHSA-4vvj-4cpr-p986, CVE-2024-43788 Semgrep found 1 Risk: samples-bootstrap-theme contains malicious code. Remove it immediately. Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8/package-lock.json:16302. Reference(s): https://osv.dev/vulnerability/MAL-2022-5922 Semgrep found 1 Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key ( Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 3.15.0 at angular2-jwt-samples/angular8/package-lock.json:11554. Reference(s): GHSA-52cp-r559-cp3m, CVE-2026-59869 Semgrep found 1 Risk: Affected versions of @babel/plugin-transform-modules-systemjs are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') / Improper Control of Generation of Code ('Code Injection'). @babel/plugin-transform-modules-systemjs mishandles module string specifiers when compiling code into SystemJS module form. An attacker who can supply specially crafted source code to a Babel build that uses this plugin (directly, or transitively via @babel/preset-env configured with Manual Review Advice: A vulnerability from this advisory is reachable if you install Fix: Upgrade this library to at least version 7.29.4 at angular2-jwt-samples/angular8/package-lock.json:3560. Reference(s): GHSA-fv7c-fp4j-7gwp, CVE-2026-44728 Semgrep found 1 Risk: Affected versions of @angular/compiler are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A stored XSS vulnerability in the Angular Template Compiler arises because its internal security schema doesn't classify certain URL‐ holding attributes (e.g. xlink:href, math|href, annotation|href) or the Manual Review Advice: A vulnerability from this advisory is reachable if you allow Fix: Upgrade this library to at least version 19.2.17 at angular2-jwt-samples/angular8/package-lock.json:986. Reference(s): GHSA-v4hv-rgfq-gp49, CVE-2025-66412 Semgrep found 6
Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation. Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8/package-lock.json:6176. Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133 |
Bumps on-headers to 1.1.0 and updates ancestor dependencies on-headers, morgan and compression. These dependencies need to be updated together.
Updates
on-headersfrom 1.0.2 to 1.1.0Release notes
Sourced from on-headers's releases.
Changelog
Sourced from on-headers's changelog.
Commits
4b017af1.1.0b636f2d♻️ refactor header array code3e2c2d4✨ ignore falsy header keys, matching node behavior172eb41✨ support duplicate headersc6e3849🔒️ fix array handling6893518💚 update CI - add newer node versions56a345d✨ add script to update known hashes175ab21👷 add upstream change detection (#31)ce0b2c8ci: apply OSSF Scorecard security best practices (#20)1a38c54fix: useubuntu-latestas ci runner (#19)Maintainer changes
This version was pushed to npm by ulisesgascon, a new releaser for on-headers since your current version.
Updates
morganfrom 1.10.0 to 1.11.0Release notes
Sourced from morgan's releases.
Changelog
Sourced from morgan's changelog.
Commits
e0e6f17Release 1.11.0 (#350)b3f5d9bMerge commit from fork203c758build(deps): bump github/codeql-action from 4.32.4 to 4.35.2 (#346)002bc81build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#347)561b0d7build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.0 (#338)2db705ebuild(deps): bump github/codeql-action from 3.29.7 to 4.32.4 (#337)a373c5fbuild(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.3 (#327)c8e72fabuild(deps): bump actions/checkout from 4.1.1 to 6.0.1 (#324)023300ebuild(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (#307)9d8d6c0build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 (#306)Maintainer changes
This version was pushed to npm by ulisesgascon, a new releaser for morgan since your current version.
Updates
compressionfrom 1.7.4 to 1.8.1Release notes
Sourced from compression's releases.
... (truncated)
Changelog
Sourced from compression's changelog.
Commits
83a0c451.8.1ce62713deps: on-headers@1.1.0 (#246)f4acb23build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#244)6eaebe6build(deps): bump actions/checkout from 4.1.1 to 4.2.2 (#241)37e0623build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 (#240)bc436b2build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (#239)2f9f572build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 (#243)5f13b14[StepSecurity] ci: Harden GitHub Actions (#235)76e0945build(deps-dev): bump supertest from 6.2.3 to 6.3.4 (#231)ae6ee80build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 (#230)Maintainer changes
This version was pushed to npm by ulisesgascon, a new releaser for compression since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.