fix(deps): update dependency express - autoclosed

[mend-on-mend]

This PR contains the following updates:

Package	Type	Update	Change
express (source)	dependencies	patch	4.21.0 -> 4.21.1
express (source)	dependencies	minor	4.19.2 -> 4.20.0

---

express vulnerable to XSS via response.redirect()

CVE-2024-43796 / GHSA-qw6h-vgh9-j6wx

More information

Details

Impact

In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code

Patches

this issue is patched in express 4.20.0

Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

Details

successful exploitation of this vector requires the following:

1. The attacker MUST control the input to response.redirect()
2. express MUST NOT redirect before the template appears
3. the browser MUST NOT complete redirection before:
4. the user MUST click on the link in the template

Severity

• CVSS Score: 5.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

References

• https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx
• https://nvd.nist.gov/vuln/detail/CVE-2024-43796
• https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553
• https://github.com/expressjs/express

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

expressjs/express (express)

v4.21.1

Compare Source

What's Changed

• Backport a fix for CVE-2024-47764 to the 4.x branch by @​joshbuker in https://github.com/expressjs/express/pull/6029
• Release: 4.21.1 by @​UlisesGascon in https://github.com/expressjs/express/pull/6031

Full Changelog: expressjs/express@4.21.0...4.21.1

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box