[Snyk] Security upgrade express from 4.21.2 to 4.22.0#72
[Snyk] Security upgrade express from 4.21.2 to 4.22.0#72
Conversation
…server/pnpm-lock.yaml to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-QS-15268416
omercnet
requested review from
anvibanga,
gaokevin1 and
mrunankpawar
as code owners
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
✅ Deploy Preview for mcp-example-oauth canceled.
|
❌ Deploy Preview for express-mcp-server failed. Why did it fail? →
|
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
brave-search-mcp-server | 2b5b971 | Feb 17 2026, 01:59 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
remote-mcp-server-bearer-auth | 2b5b971 | Feb 17 2026, 01:59 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
weather-mcp-server | 2b5b971 | Feb 17 2026, 01:59 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
brave-search-mcp-server | 2b5b971 | Feb 17 2026, 01:59 PM |
There was a problem hiding this comment.
Pull request overview
Updates the examples/express-mcp-server example’s Express dependency to address a Snyk-reported vulnerability (via Express’s qs dependency), and refreshes the pnpm lockfile accordingly.
Changes:
- Bump
expressdependency range inexamples/express-mcp-server/package.json. - Update
examples/express-mcp-server/pnpm-lock.yamlto resolveexpressto 4.22.1 and add its new snapshot/package entries.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| examples/express-mcp-server/package.json | Updates the direct express dependency version range. |
| examples/express-mcp-server/pnpm-lock.yaml | Updates the resolved Express version and lockfile entries for the new version. |
Files not reviewed (1)
- examples/express-mcp-server/pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "cors": "^2.8.5", | ||
| "dotenv": "^16.4.7", | ||
| "express": "^4.21.2", | ||
| "express": "^4.22.0", |
There was a problem hiding this comment.
The dependency range for express in this package.json (^4.22.0) does not match the specifier recorded for express in pnpm-lock.yaml (^4.22.1). This indicates the lockfile was generated from a different package.json state and pnpm install will likely rewrite the lockfile. Align the version range (either update package.json to match the lock, or regenerate the lockfile from the current package.json).
| "express": "^4.22.0", | |
| "express": "^4.22.1", |
| express: | ||
| specifier: ^4.21.2 | ||
| version: 4.21.2 | ||
| specifier: ^4.22.1 | ||
| version: 4.22.1 |
There was a problem hiding this comment.
Although the importer now resolves express to 4.22.1, this lockfile still includes and uses express@4.21.2 (e.g., via @descope/mcp-express), which in turn pulls qs@6.13.0. If the goal is to remediate the Snyk qs vulnerability, the fix may be incomplete as long as express@4.21.2 remains in the dependency graph. Regenerate the lockfile and/or update/override dependencies so no package installs express@4.21.2 (and thus qs@6.13.0).
2 participants
Snyk has created this PR to fix 1 vulnerabilities in the pnpm dependencies of this project.
Snyk changed the following file(s):
examples/express-mcp-server/package.jsonexamples/express-mcp-server/pnpm-lock.yamlVulnerabilities that will be fixed with an upgrade:
SNYK-JS-QS-15268416
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Allocation of Resources Without Limits or Throttling