renovate 2662ba763c chore: bump up express version to v4.19.2 [SECURITY] (#6308)
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [express](http://expressjs.com/) ([source](https://togithub.com/expressjs/express)) | [`4.18.2` -> `4.19.2`](https://renovatebot.com/diffs/npm/express/4.18.2/4.19.2) | [![age](https://developer.mend.io/api/mc/badges/age/npm/express/4.19.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/express/4.19.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/express/4.18.2/4.19.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/4.18.2/4.19.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) |

### GitHub Vulnerability Alerts

#### [CVE-2024-29041](https://togithub.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc)

### Impact

Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.

When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://togithub.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.

The main method impacted is `res.location()` but this is also called from within `res.redirect()`.

### Patches

https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd
https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94

An initial fix went out with `express@4.19.0`, we then patched a feature regression in `4.19.1` and added improved handling for the bypass in `4.19.2`.

### Workarounds

The fix for this involves pre-parsing the url string with either `require('node:url').parse` or `new URL`. These are steps you can take on your own before passing the user input string to `res.location` or `res.redirect`.

### References

[https://github.com/expressjs/express/pull/5539](https://togithub.com/expressjs/express/pull/5539)
[https://github.com/koajs/koa/issues/1800](https://togithub.com/koajs/koa/issues/1800)
https://expressjs.com/en/4x/api.html#res.location

---

### Release Notes

<details>
<summary>expressjs/express (express)</summary>

### [`v4.19.2`](https://togithub.com/expressjs/express/blob/HEAD/History.md#4192--2024-03-25)

[Compare Source](https://togithub.com/expressjs/express/compare/4.19.1...4.19.2)

\==========

-   Improved fix for open redirect allow list bypass

### [`v4.19.1`](https://togithub.com/expressjs/express/blob/HEAD/History.md#4191--2024-03-20)

[Compare Source](https://togithub.com/expressjs/express/compare/4.19.0...4.19.1)

\==========

-   Allow passing non-strings to res.location with new encoding handling checks

### [`v4.19.0`](https://togithub.com/expressjs/express/compare/4.18.3...83e77aff6a3859d58206f3ff9501277023c03f87)

[Compare Source](https://togithub.com/expressjs/express/compare/4.18.3...4.19.0)

### [`v4.18.3`](https://togithub.com/expressjs/express/blob/HEAD/History.md#4183--2024-02-26)

[Compare Source](https://togithub.com/expressjs/express/compare/4.18.2...4.18.3)

\==========

-   Fix routing requests without method
-   deps: body-parser@1.20.2
    -   Fix strict json error message on Node.js 19+
    -   deps: content-type@~1.0.5
    -   deps: raw-body@2.5.2

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=-->
2024-03-26 03:17:49 +00:00
2024-03-21 10:09:26 +00:00
2024-03-26 02:24:17 +00:00
2024-03-25 09:20:45 +00:00
2024-03-25 07:11:49 +00:00
2023-07-10 06:19:59 +00:00
2023-04-13 20:30:18 +00:00
2023-05-11 14:41:51 +08:00
2023-05-03 00:47:43 -05:00
2023-09-15 07:50:00 +00:00
2024-01-18 08:18:37 +00:00
2024-03-25 07:11:49 +00:00
2024-02-26 10:57:11 +00:00
2023-05-11 14:41:51 +08:00

AFFiNE.PRO
Write, Draw and Plan All at Once

affine logo

A privacy-focussed, local-first, open-source, and ready-to-use alternative for Notion & Miro.
One hyper-fused platform for wildly creative minds.



AFFiNE - One app for all - Where Notion meets Miro | Product Hunt


Releases All Contributors TypeScript-version-icon Rust-version-icon


Docs, canvas and tables are hyper-merged with AFFiNE - just like the word affine (əˈfʌɪn | a-fine).

Getting started & staying tuned with us.

Star us, and you will receive all releases notifications from GitHub without any delay!

What is AFFiNE

AFFiNE is an open-source, all-in-one workspace and an operating system for all the building blocks that assemble your knowledge base and much more -- wiki, knowledge management, presentation and digital assets. It's a better alternative to Notion and Miro.

Features

A true canvas for blocks in any form. Docs and whiteboard are now fully merged.

  • Many editor apps claim to be a canvas for productivity, but AFFiNE is one of the very few which allows you to put any building block on an edgeless canvas -- rich text, sticky notes, any embedded web pages, multi-view databases, linked pages, shapes and even slides. We have it all.

Multimodal AI partner ready to kick in any work

  • Write up professional work report? Turn an outline into expressive and presentable slides? Summary an article into a well-structured mindmap? Sorting your job plan and backlog for tasks? Or....draw and code prototype apps and web pages directly all with one prompt? With you, AFFiNE AI pushes your creativity to the edge of your imagination.

Local-first & Real-time collaborative

  • We love the idea of local-first that you always own your data on your disk, in spite of the cloud. Furthermore, AFFiNE supports real-time sync and collaborations on web and cross-platform clients.

Self-host & Shape your own AFFiNE

  • You have the freedom to manage, self-host, fork and build your own AFFiNE. Plugin community and third-party blocks is coming soon. More tractions on Blocksuite. Check there to learn how to self-host AFFiNE.

Acknowledgement

“We shape our tools and thereafter our tools shape us”. A lot of pioneers have inspired us along the way, e.g.:

  • Quip & Notion with their great concept of “everything is a block”
  • Trello with their Kanban
  • Airtable & Miro with their no-code programable datasheets
  • Miro & Whimiscal with their edgeless visual whiteboard
  • Remnote & Capacities with their object-based tag system

There is a large overlap of their atomic “building blocks” between these apps. They are not open source, nor do they have a plugin system like Vscode for contributors to customize. We want to have something that contains all the features we love and also goes one step even further.

Thanks for checking us out, we appreciate your interest and sincerely hope that AFFiNE resonates with you! 🎵 Checking https://affine.pro/ for more details ions.

Contributing

Bug Reports Feature Requests Questions/Discussions AFFiNE Community
Create a bug report Submit a feature request Check GitHub Discussion Vist the AFFiNE Community
Something isn't working as expected An idea for a new feature, or improvements Discuss and ask questions A place to ask, learn and engage with others

Calling all developers, testers, tech writers and more! Contributions of all types are more than welcome, you can read more in docs/types-of-contributions.md. If you are interested in contributing code, read our docs/CONTRIBUTING.md and feel free to check out our GitHub issues to get stuck in to show us what youre made of.

Before you start contributing, please make sure you have read and accepted our Contributor License Agreement. To indicate your agreement, simply edit this file and submit a pull request.

For bug reports, feature requests and other suggestions you can also create a new issue and choose the most appropriate template for your feedback.

For translation and language support you can visit our i18n General Space.

Looking for others ways to contribute and wondering where to start? Check out the AFFiNE Ambassador program, we work closely with passionate community members and provide them with a wide-range of support and resources.

If you have questions, you are welcome to contact us. One of the best places to get more info and learn more is in the AFFiNE Community where you can engage with other like-minded individuals.

Ecosystem

Name
@affine/component AFFiNE Component Resources
@toeverything/y-indexeddb IndexedDB database adapter for Yjs
@toeverything/theme AFFiNE theme

Upstreams

We would also like to give thanks to open-source projects that make AFFiNE possible:

  • Blocksuite - 💠 BlockSuite is the open-source collaborative editor project behind AFFiNE.
  • OctoBase - 🐙 OctoBase is the open-source database behind AFFiNE, local-first, yet collaborative. A light-weight, scalable, data engine written in Rust.
  • yjs - Fundamental support of CRDTs for our implementation on state management and data sync.
  • electron - Build cross-platform desktop apps with JavaScript, HTML, and CSS.
  • React - The library for web and native user interfaces.
  • napi-rs - A framework for building compiled Node.js add-ons in Rust via Node-API.
  • Jotai - Primitive and flexible state management for React.
  • async-call-rpc - A lightweight JSON RPC client & server.
  • Vite - Next generation frontend tooling.
  • Other upstream dependencies.

Thanks a lot to the community for providing such powerful and simple libraries, so that we can focus more on the implementation of the product logic, and we hope that in the future our projects will also provide a more easy-to-use knowledge base for everyone.

Contributors

We would like to express our gratitude to all the individuals who have already contributed to AFFiNE! If you have any AFFiNE-related project, documentation, tool or template, please feel free to contribute it by submitting a pull request to our curated list on GitHub: awesome-affine.

contributors

Self-Host

Begin with Docker to deploy your own feature-rich, unrestricted version of AFFiNE. Our team is diligently updating to the latest version. For more information on how to self-host AFFiNE, please refer to our documentation.

Hiring

Some amazing companies including AFFiNE are looking for developers! Are you interesgo to iour discord channel AFFiNE and/or its partners? Check out some of the latest jobs available.

Feature Request

For feature request, please see community.affine.pro.

Building

Codespaces

From the GitHub repo main page, click the green "Code" button and select "Create codespace on master". This will open a new Codespace with the (supposedly auto-forked AFFiNE repo cloned, built, and ready to go.

Local

See BUILDING.md for instructions on how to build AFFiNE from source code.

Contributing

We welcome contributions from everyone. See docs/contributing/tutorial.md for details.

Thanks

Chromatic

Thanks to Chromatic for providing the visual testing platform that helps us review UI changes and catch visual regressions.

License

See LICENSE for details.

Languages
TypeScript 89.7%
Swift 4.2%
Rust 4%
Kotlin 1%
JavaScript 0.4%
Other 0.5%