[Snyk] Security upgrade express from 4.18.2 to 4.19.2

[oumao]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	591/1000 Why? Recently disclosed, Has a fix available, CVSS 6.1	Open Redirect SNYK-JS-EXPRESS-6474509	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: express

The new version differs by 59 commits.

• b28db2c 4.19.2
• 0b74695 Improved fix for open redirect allow list bypass
• 4f0f6cc 4.19.1
• a003cfa Allow passing non-strings to res.location with new encoding handling checks fixes #5554 #5555
• a1fa90f fixed un-edited version in history.md for 4.19.0
• 11f2b1d build: fix build due to inconsistent supertest behavior in older versions
• 084e365 4.19.0
• 0867302 Prevent open redirect allow list bypass due to encodeurl
• 567c9c6 Add note on how to update docs for new release (#5541)
• 69a4cf2 deps: cookie@0.6.0
• 4ee853e docs: loosen TC activity rules
• 414854b docs: nominating @ wesleytodd to be project captian
• 06c6b88 docs: update release date
• 1b51eda 4.18.3
• b625132 build: pin Node 21.x to minor
• e3eca80 build: pin Node 21.x to minor
• 23b44b3 build: support Node.js 21.6.2
• b9fea12 build: support Node.js 21.x in appveyor
• c259c34 build: support Node.js 21.x
• fdeb1d3 build: support Node.js 20.x in appveyor
• 734b281 build: support Node.js 20.x
• 0e3ab6e examples: improve view count in cookie-sessions
• 59af63a build: Node.js@18.19
• e720c5a docs: add documentation for benchmarks

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect

[what-the-diff]

PR Summary

This Pull Request primarily focuses on updating the versions of various software libraries we are using in our project. These updates will help improve the performance and security of our application. Here are the details:

• Upgraded version of 'express'
  The version of express has been updated in both package-lock.json and package.json from 4.18.2 to 4.19.2. This update may include bug fixes, new features, and performance improvements.

• Updated 'body-parser' version
  The 'body-parser' library, which helps in handling incoming request bodies, has been updated in package-lock.json from 1.20.1 to 1.20.2.

• Bumped up 'raw-body' library version
  We've updated the version of 'raw-body' in package-lock.json from 2.5.1 to 2.5.2. It's used for reading raw data from requests.

• Improved 'content-type' library
  The 'content-type' library has been updated in package-lock.json from 1.0.4 to 1.0.5. It's a useful tool for determining the media type of a request.

• 'cookie' library version upgrade
  We've enhanced the 'cookie' library from 0.5.0 to 0.6.0 in package-lock.json. This library helps manage cookies in our application.

All these changes will collectively contribute to better software robustness and improved user experience.