Skip to content

[Snyk] Upgrade http-errors from 1.8.0 to 1.8.1#1034

Closed
samaradel wants to merge 1 commit into
developmentfrom
snyk-upgrade-876c6cf2d461ec8ec370cdb81c5a6cf5
Closed

[Snyk] Upgrade http-errors from 1.8.0 to 1.8.1#1034
samaradel wants to merge 1 commit into
developmentfrom
snyk-upgrade-876c6cf2d461ec8ec370cdb81c5a6cf5

Conversation

@samaradel
Copy link
Copy Markdown
Contributor

snyk-top-banner

Snyk has created this PR to upgrade http-errors from 1.8.0 to 1.8.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 1 version ahead of your current version.

  • The recommended version was released 3 years ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ES5EXT-6095076
696 Proof of Concept
Release notes
Package name: http-errors from http-errors GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Snyk has created this PR to upgrade http-errors from 1.8.0 to 1.8.1.

See this package in npm:
http-errors

See this project in Snyk:
https://app.snyk.io/org/samaradel/project/6dfbd1f8-e7bc-460e-a3d3-6af714fe8d69?utm_source=github&utm_medium=referral&page=upgrade-pr
sameh-farouk added a commit that referenced this pull request Apr 9, 2026
- pino: 6.11.3 → 6.14.0
- jsonschema: 1.4.0 → 1.5.0
- http-errors: 1.8.0 → 1.8.1

All minor/patch bumps. Tested locally — app loads, routing, validation,
error handling, and logging all work correctly.

Consolidates Snyk PRs #1032, #1033, #1034 which conflicted after #1031
was merged.
@sameh-farouk
Copy link
Copy Markdown
Member

Closing as superseded by #1085, which consolidates the pino 6.14.0, jsonschema 1.5.0, and http-errors 1.8.1 bumps into activation-service with a clean, non-conflicting lockfile. This auto-generated PR is now conflicting/dirty against development. The http-errors 1.8.1 bump is carried forward by #1085. Reopen if #1085 does not land.

sameh-farouk added a commit that referenced this pull request Jun 1, 2026
* chore(activation-service): upgrade pino, jsonschema, http-errors

- pino: 6.11.3 → 6.14.0
- jsonschema: 1.4.0 → 1.5.0
- http-errors: 1.8.0 → 1.8.1

All minor/patch bumps. Tested locally — app loads, routing, validation,
error handling, and logging all work correctly.

Consolidates Snyk PRs #1032, #1033, #1034 which conflicted after #1031
was merged.

* chore(activation-service): sync yarn.lock with package.json

yarn.lock had been stale since #1031 (pinned express ^4.17.1 while
package.json requires ^4.21.2), so `yarn install --frozen-lockfile`
was already failing on it. Reconcile it with the current package.json:

- pino 6.14.0, jsonschema 1.5.0, http-errors 1.8.1 (this PR's bumps)
- deduped pino to a single 6.14.0 entry (was split 6.0.0->6.11.3)
- picks up express 4.21.2's accumulated transitive updates

Verified: `yarn install --frozen-lockfile` is consistent, and the app
boots and serves /activation/ (200), 404 (http-errors), and validation
400 (jsonschema) with pino structured logging.

Note: yarn resolves express to 4.22.2 (latest in ^4.21.2) vs the npm
package-lock's pinned 4.21.2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants