[CB-10590] Known security vulnerabilities in dependencies of current version of express: qs@0.4.x and connect@1.x

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Component/s: cordova-weinre (DEPRECATED)
• Labels: triaged
• Assignee: Patrick Mueller
• Reporter: Spencer A Claxton
• Created: 10/Feb/16 22:09
• Updated: 02/Jul/18 13:45
• Resolved: 02/Jul/18 13:45

Description

There are known security vulnerabilities in dependencies of current version of express: qs@0.4.x and connect@1.x. See https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking and https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting for more detail. Can we bump express so that these vulnerabilities go away?