[Snyk] Security upgrade @bull-board/express from 4.2.2 to 5.10.2

[naiba4]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	551/1000 Why? Recently disclosed, Has a fix available, CVSS 5.3	Improper Control of Dynamically-Managed Code Resources SNYK-JS-EJS-6689533	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @bull-board/express

The new version differs by 220 commits.

• cda599b Release 5.10.2
• 8a27924 fix: remove the strict need for express deps, closes #656
• a13e4d5 add an example with csrf token enabled
• cf1a136 Release 5.10.1
• 3014f47 fix: align en locale lang to be full specified (en-US)
• e06f3b5 add locale pt-BR (feat: added docker-compose.log.yml for log viewer chrisleekr/binance-trading-bot#654)
• ea75f2e Release 5.10.0
• de5350d feat: add bundle-analyzer
• 396bf70 fix: reduce bundle size
• 615daa4 feat: add translation ability, Docker Proxy Support (Outgoing connections) chrisleekr/binance-trading-bot#653
• 3d9ee8f chore(deps-dev): bump axios from 0.26.1 to 1.6.0 (Notional value is less than the minimum notional value. Do not place an order for the grid trade #1. chrisleekr/binance-trading-bot#644)
• 03afb90 Release 5.9.2
• b5ace07 Update QueueAdapterOptions typing (#652)
• 37a618f upgrade-express-ex: upgrade express example (ImportError: cannot import name 'url_quote' from 'werkzeug.urls' (/usr/local/lib/python3.9/site-packages/werkzeug/urls.py) chrisleekr/binance-trading-bot#648)
• 9ce2f63 Release 5.9.1
• 7ce08ab Update readme
• 39a1333 Update README.md (feat: update deps, conf and fix test chrisleekr/binance-trading-bot#638)
• 8f30a87 chore(deps): bump @ babel/traverse from 7.22.15 to 7.23.2 (Can you create a video showing your installations? chrisleekr/binance-trading-bot#637)
• 3e45bb5 chore(deps-dev): bump @ babel/traverse in /examples/with-nestjs (Stuck on Failed to load account information, how it`s fix chrisleekr/binance-trading-bot#636)
• 04af55b chore(deps): bump @ babel/traverse in /examples/with-nestjs-module (Buy order stop price is higher than current buy limit price, cancel current buy order chrisleekr/binance-trading-bot#635)
• 6109d30 Release 5.9.0
• 6a4b2ce feat: add new statuses to overview page
• 816fe76 feat: add overlay page to readme
• 8e5fe74 feat: Improve progress bar layout

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Control of Dynamically-Managed Code Resources

[cloudflare-workers-and-pages]

Deploying binance-trading-bot with    Cloudflare Pages

Latest commit:	52dc1d8
Status:	🚫  Build failed.

View logs

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[guardrails]

⚠️ We detected 1 security issue in this pull request:

Vulnerable Libraries (1)

Severity	Details
High	pkg:npm/@bull-board/[email protected] upgrade to: > 5.10.2

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@bull-board/[email protected]	Transitive: eval	+1	74.2 kB	felixmosh
npm/@bull-board/[email protected]	None	0	2.56 MB	felixmosh

🚮 Removed packages: npm/@bull-board/[email protected], npm/@bull-board/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source
New author	npm/[email protected]	New Author: doowb Previous Author: jonschlinkert	package-lock.json
Environment variable access	npm/[email protected]	Env Vars: TESTING_MKDIRP_NODE_VERSION Location: Package overview	package-lock.json package.json
Environment variable access	npm/[email protected]	Env Vars: TESTING_MKDIRP_PLATFORM Location: Package overview	package-lock.json package.json
Filesystem access	npm/[email protected]	Module: fs Location: Package overview	package-lock.json package.json
Filesystem access	npm/[email protected]	Module: fs.realpath Location: Package overview	package-lock.json package.json
Uses eval	npm/[email protected]	Eval Type: Function Location: Package overview	package-lock.json
Uses eval	npm/[email protected]	Eval Type: Function Location: Package overview	package-lock.json
Dynamic require	npm/[email protected]	Location: Package overview	package-lock.json
Environment variable access	npm/[email protected]	Env Vars: PATH Location: Package overview	package-lock.json
Environment variable access	npm/[email protected]	Env Vars: OSTYPE Location: Package overview	package-lock.json
Environment variable access	npm/[email protected]	Env Vars: PATHEXT Location: Package overview	package-lock.json
New author	npm/[email protected]	New Author: michaelficarra Previous Author: nzakas	package-lock.json
Network access	npm/[email protected]	Module: http Location: Package overview	package-lock.json package.json
Network access	npm/[email protected]	Module: net Location: Package overview	package-lock.json package.json
Network access	npm/[email protected]	Module: tls Location: Package overview	package-lock.json package.json
Network access	npm/[email protected]	Module: https Location: Package overview	package-lock.json package.json
Unmaintained	npm/[email protected]	Last Publish: 8/5/2018, 4:59:03 PM	package-lock.json package.json
Unmaintained	npm/[email protected]	Last Publish: 4/7/2019, 6:04:37 AM	package-lock.json package.json
Environment variable access	npm/[email protected]	Env Vars: DEBUG_FD Location: Package overview	package-lock.json package.json
Network access	npm/[email protected]	Module: net Location: Package overview	package-lock.json package.json
Filesystem access	npm/[email protected]	Module: fs Location: Package overview	package-lock.json package.json
Deprecated	npm/[email protected]	Reason: Please upgrade to v1.0.1	package-lock.json package.json
Deprecated	npm/[email protected]	Reason: Please upgrade to v1.0.1	package-lock.json package.json
Filesystem access	npm/[email protected]	Module: fs Location: Package overview	package-lock.json
New author	npm/[email protected]	New Author: jbnicolai Previous Author: sindresorhus	package-lock.json
Trivial Package	npm/[email protected]	Location: Package overview	package-lock.json
Trivial Package	npm/[email protected]	Location: Package overview	package-lock.json
New author	npm/[email protected]	New Author: qix Previous Author: sindresorhus	package-lock.json
Filesystem access	npm/[email protected]	Module: fs.realpath Location: Package overview	package-lock.json package.json
CVE	npm/[email protected]	CVE: GHSA-9c47-m6qq-7p4h Prototype Pollution in JSON5 via Parse Method (HIGH) Affected versions: < 1.0.2 Patched version: 1.0.2	package-lock.json package.json
Trivial Package	npm/[email protected]	Location: Package overview	package-lock.json package.json
Dynamic require	npm/[email protected]	Location: Package overview	package-lock.json
Uses eval	npm/[email protected]	Eval Type: Function Location: Package overview	package-lock.json
Dynamic require	npm/[email protected]	Location: Package overview	package-lock.json package.json
Environment variable access	npm/[email protected]	Env Vars: Location: Package overview	package-lock.json package.json
Filesystem access	npm/[email protected]	Module: fs Location: Package overview	package-lock.json package.json
Shell access	npm/[email protected]	Module: child_process Location: Package overview	package-lock.json package.json
Shell access	npm/[email protected]	Module: child_process Location: Package overview	package-lock.json package.json
Deprecated	npm/[email protected]	Reason: The v1 package contains DANGEROUS / INSECURE binaries. Upgrade to safe fsevents v2	package-lock.json package.json
Native code	npm/[email protected]	Location: Package overview	package-lock.json package.json
Filesystem access	npm/[email protected]	Module: fs Location: Package overview	package-lock.json package.json
Install scripts	npm/[email protected]	Install script: install Source: node install.js	package-lock.json package.json
Trivial Package	npm/[email protected]	Location: Package overview	package-lock.json package.json
Trivial Package	npm/[email protected]	Location: Package overview	package-lock.json
Deprecated	npm/[email protected]	Reason: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.	package-lock.json package.json
CVE	npm/[email protected]	CVE: GHSA-ww39-953v-wcq6 glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex (HIGH) Affected versions: < 5.1.2 Patched version: 5.1.2	package-lock.json package.json
Dynamic require	npm/[email protected]	Location: Package overview	package-lock.json package.json
Environment variable access	npm/[email protected]	Env Vars: YARGS_MIN_NODE_VERSION Location: Package overview	package-lock.json package.json
Environment variable access	npm/[email protected]	Env Vars: Location: Package overview	package-lock.json package.json
Filesystem access	npm/[email protected]	Module: fs Location: Package overview	package-lock.json package.json
Dynamic require	npm/[email protected]	Location: Package overview	package-lock.json package.json
New author	npm/[email protected]	New Author: ruyadorno Previous Author: gar	package-lock.json package.json
CVE	npm/[email protected]	CVE: GHSA-3xq5-wjfh-ppjc Luxon Inefficient Regular Expression Complexity vulnerability (HIGH) Affected versions: >= 3.0.0, < 3.2.1 Patched version: