From e73c3147c187170582b65b4cea9adef0444be1b6 Mon Sep 17 00:00:00 2001 From: Snyk Community Date: Wed, 19 Oct 2016 17:50:16 +0300 Subject: [PATCH 1/2] Fix for the ReDOS vulnerability habitica is currently affected by the high-severity [ReDOS vulnerability](https://snyk.io/vuln/npm:tough-cookie:20160722). Vulnerable module: `tough-cookie` Introduced through: ` request` This PR fixes the ReDOS vulnerability by upgrading ` request` to version 2.74.0 Check out the [Snyk test report](https://snyk.io/test/github/HabitRPG/habitica) to review other vulnerabilities that affect this repo. [Watch the repo](https://snyk.io/add) to * get alerts if newly disclosed vulnerabilities affect this repo in the future. * generate pull requests with the fixes you want, or let us do the work: when a newly disclosed vulnerability affects you, we'll submit a fix to you right away. Stay secure, The Snyk team --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 6eae693cf4..96a5a5e127 100644 --- a/package.json +++ b/package.json @@ -95,7 +95,7 @@ "pug": "^2.0.0-beta6", "push-notify": "habitrpg/push-notify#v1.2.0", "pusher": "^1.3.0", - "request": "~2.72.0", + "request": "~2.74.0", "rimraf": "^2.4.3", "run-sequence": "^1.1.4", "s3-upload-stream": "^1.0.6", From 136502a1106caf5917ee51d74eb3f7fb7a362414 Mon Sep 17 00:00:00 2001 From: Blade Barringer Date: Wed, 19 Oct 2016 17:41:58 -0500 Subject: [PATCH 2/2] chore: update express --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 96a5a5e127..8c13cae62e 100644 --- a/package.json +++ b/package.json @@ -35,7 +35,7 @@ "cwait": "^1.0.0", "domain-middleware": "~0.1.0", "estraverse": "^4.1.1", - "express": "~4.13.3", + "express": "~4.14.0", "express-csv": "~0.6.0", "express-validator": "^2.18.0", "extract-text-webpack-plugin": "^1.0.1",