dependencie updates (express 4.20.0) not part of released unleash server version 6.2.2

[skyd0me]

In version 6.2.2 it looks like a update of express was shipped: v6.2.2...main#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519R151

Unfortunately this change is not part of the published version: https://www.npmjs.com/package/unleash-server/v/6.2.2?activeTab=code

This results in having the "old" express version as peer dependency and thus also the related vulnerability reported with this version.

Expected behavior

have the updated express v 4.20 listed as peer dependency

Screenshots

Unleash version

6.2.2

[gastonfournier]

Hi @skyd0me we'll look into it, we're going to release a patch version with some security updates.

[gastonfournier]

Well, 6.2 seems to have the old version https://github.com/Unleash/unleash/blob/6.2/package.json#L129 not sure why the comparison you showed is saying otherwise, but we'll fix it

[skyd0me]

Ahhh I think I got the issue. Just clicked on the wrong comparison. We can close this for now and happy that you will publish a new version with the fix.
Would be awesome if someone can do the same for unleash-proxy: Unleash/unleash-proxy#193

[gastonfournier]

Nice @skyd0me thanks for the contribution to proxy! I'll run it an also release it