andylockran/eventloop-adventures
Watch
1
0
Fork
You've already forked eventloop-adventures
 0
Code Issues 1 Pull requests 10 Projects Releases Packages Wiki Activity Actions

Update dependency express to v5 #11

Open
renovate wants to merge 1 commit from renovate/express-5.x into main
pull from: renovate/express-5.x
merge into: andylockran:main
Conversation 0 Commits 1 Files changed 2 +945 -216
renovate commented 2026-10-28 12:19:45 +00:00
Collaborator

This PR contains the following updates:

Package Change Age Confidence
express (source) ~4.16.1 → ~5.3.0 age confidence

Release Notes

expressjs/express (express)

v5.3.0

Compare Source

=====

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #​4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #​7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #​7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #​5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #​6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #​7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #​6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #​7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

  • Upgrade body-parser to ^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalid limit option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid limit values now throw at parser initialization instead of being ignored - by @​Mayvis in #​7390

⚡ Performance

  • Avoid duplicate Content-Type header processing in res.send() when sending string responses without an explicit Content-Type header - by @​bjohansebas in #​6991

v5.2.1

Compare Source

=====

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

v5.2.0

Compare Source

=====

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

v5.1.0

Compare Source

=====

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

v5.0.1

Compare Source

=====

v5.0.0

Compare Source

=====

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@​1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:
    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@​4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@​6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0
    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0

v4.22.3

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/expressjs/express/compare/v4.22.2...v4.22.3

v4.22.2

Compare Source

What's Changed

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

New Contributors

Full Changelog: https://github.com/expressjs/express/compare/v4.22.1...v4.22.2

v4.22.1

Compare Source

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: https://github.com/expressjs/express/compare/4.22.0...v4.22.1

v4.22.0

Compare Source

Important: Security

What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.2...4.22.0

v4.21.2

Compare Source

What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.1...4.21.2

v4.21.1

Compare Source

What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.0...4.21.1

v4.21.0

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/expressjs/express/compare/4.20.0...4.21.0

v4.20.0

Compare Source

======

  • deps: serve-static@​0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@​0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@​0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@​0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

v4.19.2

Compare Source

======

  • Improved fix for open redirect allow list bypass

v4.19.1

Compare Source

======

  • Allow passing non-strings to res.location with new encoding handling checks

v4.19.0

Compare Source

======

  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@​0.6.0

v4.18.3

Compare Source

======

  • Fix routing requests without method
  • deps: body-parser@​1.20.2
    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@​2.5.2
  • deps: cookie@​0.6.0
    • Add partitioned option

v4.18.2

Compare Source

======

  • Fix regression routing a large stack in a single route
  • deps: body-parser@​1.20.1
    • deps: qs@​6.11.0
    • perf: remove unnecessary object clone
  • deps: qs@​6.11.0

v4.18.1

Compare Source

======

  • Fix hanging on large stack of sync routes

v4.18.0

Compare Source

======

  • Add "root" option to res.download
  • Allow options without filename in res.download
  • Deprecate string and non-integer arguments to res.status
  • Fix behavior of null/undefined as maxAge in res.cookie
  • Fix handling very large stacks of sync middleware
  • Ignore Object.prototype values in settings through app.set/app.get
  • Invoke default with same arguments as types in res.format
  • Support proper 205 responses using res.send
  • Use http-errors for res.format error
  • deps: body-parser@​1.20.0
    • Fix error message for json parse whitespace in strict
    • Fix internal error when inflated body exceeds limit
    • Prevent loss of async hooks context
    • Prevent hanging when request already read
    • deps: depd@​2.0.0
    • deps: http-errors@​2.0.0
    • deps: on-finished@​2.4.1
    • deps: qs@​6.10.3
    • deps: raw-body@​2.5.1
  • deps: cookie@​0.5.0
    • Add priority option
    • Fix expires option to reject invalid dates
  • deps: depd@​2.0.0
    • Replace internal eval usage with Function constructor
    • Use instance methods on process to check for listeners
  • deps: finalhandler@​1.2.0
    • Remove set content headers that break response
    • deps: on-finished@​2.4.1
    • deps: statuses@​2.0.1
  • deps: on-finished@​2.4.1
    • Prevent loss of async hooks context
  • deps: qs@​6.10.3
  • deps: send@​0.18.0
    • Fix emitted 416 error missing headers property
    • Limit the headers removed for 304 response
    • deps: depd@​2.0.0
    • deps: destroy@​1.2.0
    • deps: http-errors@​2.0.0
    • deps: on-finished@​2.4.1
    • deps: statuses@​2.0.1
  • deps: serve-static@​1.15.0
    • deps: send@​0.18.0
  • deps: statuses@​2.0.1
    • Remove code 306
    • Rename 425 Unordered Collection to standard 425 Too Early

v4.17.3

Compare Source

======

  • deps: accepts@~1.3.8
    • deps: mime-types@~2.1.34
    • deps: negotiator@​0.6.3
  • deps: body-parser@​1.19.2
    • deps: bytes@​3.1.2
    • deps: qs@​6.9.7
    • deps: raw-body@​2.4.3
  • deps: cookie@​0.4.2
  • deps: qs@​6.9.7
    • Fix handling of __proto__ keys
  • pref: remove unnecessary regexp for trust proxy

v4.17.2

Compare Source

======

  • Fix handling of undefined in res.jsonp
  • Fix handling of undefined when "json escape" is enabled
  • Fix incorrect middleware execution with unanchored RegExps
  • Fix res.jsonp(obj, status) deprecation message
  • Fix typo in res.is JSDoc
  • deps: body-parser@​1.19.1
    • deps: bytes@​3.1.1
    • deps: http-errors@​1.8.1
    • deps: qs@​6.9.6
    • deps: raw-body@​2.4.2
    • deps: safe-buffer@​5.2.1
    • deps: type-is@~1.6.18
  • deps: content-disposition@​0.5.4
    • deps: safe-buffer@​5.2.1
  • deps: cookie@​0.4.1
    • Fix maxAge option to reject invalid values
  • deps: proxy-addr@~2.0.7
    • Use req.socket over deprecated req.connection
    • deps: forwarded@​0.2.0
    • deps: ipaddr.js@​1.9.1
  • deps: qs@​6.9.6
  • deps: safe-buffer@​5.2.1
  • deps: send@​0.17.2
    • deps: http-errors@​1.8.1
    • deps: ms@​2.1.3
    • pref: ignore empty http tokens
  • deps: serve-static@​1.14.2
    • deps: send@​0.17.2
  • deps: setprototypeof@​1.2.0

v4.17.1

Compare Source

======

  • Revert "Improve error message for null/undefined to res.status"

v4.17.0

Compare Source

======

  • Add express.raw to parse bodies into Buffer
  • Add express.text to parse bodies into string
  • Improve error message for non-strings to res.sendFile
  • Improve error message for null/undefined to res.status
  • Support multiple hosts in X-Forwarded-Host
  • deps: accepts@~1.3.7
  • deps: body-parser@​1.19.0
    • Add encoding MIK
    • Add petabyte (pb) support
    • Fix parsing array brackets after index
    • deps: bytes@​3.1.0
    • deps: http-errors@​1.7.2
    • deps: iconv-lite@​0.4.24
    • deps: qs@​6.7.0
    • deps: raw-body@​2.4.0
    • deps: type-is@~1.6.17
  • deps: content-disposition@​0.5.3
  • deps: cookie@​0.4.0
    • Add SameSite=None support
  • deps: finalhandler@~1.1.2
    • Set stricter Content-Security-Policy header
    • deps: parseurl@~1.3.3
    • deps: statuses@~1.5.0
  • deps: parseurl@~1.3.3
  • deps: proxy-addr@~2.0.5
    • deps: ipaddr.js@​1.9.0
  • deps: qs@​6.7.0
    • Fix parsing array brackets after index
  • deps: range-parser@~1.2.1
  • deps: send@​0.17.1
    • Set stricter CSP header in redirect & error responses
    • deps: http-errors@~1.7.2
    • deps: mime@​1.6.0
    • deps: ms@​2.1.1
    • deps: range-parser@~1.2.1
    • deps: statuses@~1.5.0
    • perf: remove redundant path.normalize call
  • deps: serve-static@​1.14.1
    • Set stricter CSP header in redirect response
    • deps: parseurl@~1.3.3
    • deps: send@​0.17.1
  • deps: setprototypeof@​1.1.1
  • deps: statuses@~1.5.0
    • Add 103 Early Hints
  • deps: type-is@~1.6.18
    • deps: mime-types@~2.1.24
    • perf: prevent internal throw on invalid type

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [express](https://expressjs.com/) ([source](https://github.com/expressjs/express)) | [`~4.16.1` → `~5.3.0`](https://renovatebot.com/diffs/npm/express/4.16.4/5.3.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/express/5.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/4.16.4/5.3.0?slim=true) | --- ### Release Notes <details> <summary>expressjs/express (express)</summary> ### [`v5.3.0`](https://github.com/expressjs/express/blob/HEAD/History.md#530) [Compare Source](https://github.com/expressjs/express/compare/v5.2.1...v5.3.0) \===== #### 🐞 Bug fixes - Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by [@&#8203;YuryShkoda](https://github.com/YuryShkoda) in [#&#8203;4893](https://github.com/expressjs/express/pull/4893) Fixed the behavior of `res.send()` to prevent conflicts between `Content-Length` and `Transfer-Encoding` HTTP headers in responses. The `Content-Length` header in `res.send()` is now only added when a `Transfer-Encoding` header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a `Transfer-Encoding` header - by [@&#8203;cuishuang](https://github.com/cuishuang) in [#&#8203;7459](https://github.com/expressjs/express/pull/7459) * Upgrade `qs` to `^6.16.0`, which fixes [CVE-2026-2391](https://www.cve.org/CVERecord?id=CVE-2026-2391) ([GHSA-w7fw-mjwx-w883](https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883)), [CVE-2026-82417](https://www.cve.org/CVERecord?id=CVE-2026-82417) ([GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g)) and [CVE-2026-82562](https://www.cve.org/CVERecord?id=CVE-2026-82562) ([GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx)): `arrayLimit` bypasses in comma parsing and a denial of service via an attacker-controlled `isBuffer` - by [@&#8203;davetashner](https://github.com/davetashner) in [#&#8203;7057](https://github.com/expressjs/express/pull/7057) and [#&#8203;7478](https://github.com/expressjs/express/pull/7478), and [@&#8203;cyphercodes](https://github.com/cyphercodes) in [#&#8203;7305](https://github.com/expressjs/express/pull/7305) * Upgrade `proxy-addr` to `^2.0.8`, which fixes [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) - by [@&#8203;lazerg](https://github.com/lazerg) in [#&#8203;7474](https://github.com/expressjs/express/pull/7474) #### 🚀 Improvements - Allow conditional revalidation for QUERY requests. `req.fresh` previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by [@&#8203;Cherry](https://github.com/Cherry) in [#&#8203;7366](https://github.com/expressjs/express/pull/7366) ```js // QUERY /reports with If-None-Match: "12345" app.query('/reports', (req, res) => { res.set('ETag', '"12345"'); res.send(results); // now responds 304 Not Modified }); ``` - Improve HTML structure in `res.redirect()` responses when HTML format is accepted by adding `<!DOCTYPE html>`, `<title>`, and `<body>` tags for better browser compatibility - by [@&#8203;Bernice55231](https://github.com/Bernice55231) in [#&#8203;5167](https://github.com/expressjs/express/pull/5167) - When calling `app.render` with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by [AkaHarshit](https://github.com/AkaHarshit) in [#&#8203;6903](https://github.com/expressjs/express/pull/6903) ```js app.render('index', null, callback); // now works as expected ``` - Upgrade `content-type` to `^2.0.0`, bringing a faster parser (\~1.5x quicker `Content-Type` parsing/formatting in `res.send()`) along with a behavior change: `res.send()` now keeps any existing parameters when adding the charset and no longer throws on a `Content-Type` that fails to parse. `type-is` is upgraded to `^2.1.0` as part of the same change - by [@&#8203;blakeembrey](https://github.com/blakeembrey) in [#&#8203;7234](https://github.com/expressjs/express/pull/7234) ```js res.set('Content-Type', 'text/plain; foo=bar').send('hey'); // -> Content-Type: text/plain; foo=bar; charset=utf-8 ``` - The default error handler now logs the full error object instead of only its stack trace, so nested details such as `Error.cause` and library-specific properties (e.g. Sequelize's `parent`/`original`) are no longer swallowed - by [@&#8203;Nitin-Mohapatra](https://github.com/Nitin-Mohapatra) in [#&#8203;6464](https://github.com/expressjs/express/pull/6464) - Upgrade `content-disposition` to `^2.0.1`, which changes the `Content-Disposition` header emitted by `res.download()`, `res.attachment()`, and `res.sendFile()`: file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by [@&#8203;blakeembrey](https://github.com/blakeembrey) in [#&#8203;7233](https://github.com/expressjs/express/pull/7233) ```js res.attachment('user.html'); // before -> Content-Disposition: attachment; filename="user.html" // after -> Content-Disposition: attachment; filename=user.html ``` - Upgrade `body-parser` to `^2.3.0`, which fixes [CVE-2026-12590](https://www.cve.org/CVERecord?id=CVE-2026-12590) ([GHSA-v422-hmwv-36x6](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6)): an invalid `limit` option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid `limit` values now throw at parser initialization instead of being ignored - by [@&#8203;Mayvis](https://github.com/Mayvis) in [#&#8203;7390](https://github.com/expressjs/express/pull/7390) #### ⚡ Performance - Avoid duplicate Content-Type header processing in `res.send()` when sending string responses without an explicit Content-Type header - by [@&#8203;bjohansebas](https://github.com/bjohansebas) in [#&#8203;6991](https://github.com/expressjs/express/pull/6991) ### [`v5.2.1`](https://github.com/expressjs/express/blob/HEAD/History.md#521) [Compare Source](https://github.com/expressjs/express/compare/v5.2.0...v5.2.1) \===== - Revert security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6)) - The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release. ### [`v5.2.0`](https://github.com/expressjs/express/blob/HEAD/History.md#520) [Compare Source](https://github.com/expressjs/express/compare/v5.1.0...v5.2.0) \===== - Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6)) - deps: `body-parser@^2.2.1` - A deprecation warning was added when using `res.redirect` with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix. ### [`v5.1.0`](https://github.com/expressjs/express/blob/HEAD/History.md#510) [Compare Source](https://github.com/expressjs/express/compare/v5.0.1...v5.1.0) \===== - Add support for `Uint8Array` in `res.send()` - Add support for ETag option in `res.sendFile()` - Add support for multiple links with the same rel in `res.links()` - Add funding field to package.json - perf: use loop for acceptParams - refactor: prefix built-in node module imports - deps: remove `setprototypeof` - deps: remove `safe-buffer` - deps: remove `utils-merge` - deps: remove `methods` - deps: remove `depd` - deps: `debug@^4.4.0` - deps: `body-parser@^2.2.0` - deps: `router@^2.2.0` - deps: `content-type@^1.0.5` - deps: `finalhandler@^2.1.0` - deps: `qs@^6.14.0` - deps: `server-static@2.2.0` - deps: `type-is@2.0.1` ### [`v5.0.1`](https://github.com/expressjs/express/blob/HEAD/History.md#501) [Compare Source](https://github.com/expressjs/express/compare/v5.0.0...v5.0.1) \===== - Update `cookie` semver lock to address [CVE-2024-47764](https://nvd.nist.gov/vuln/detail/CVE-2024-47764) ### [`v5.0.0`](https://github.com/expressjs/express/blob/HEAD/History.md#500) [Compare Source](https://github.com/expressjs/express/compare/v4.22.3...v5.0.0) \===== - remove: - `path-is-absolute` dependency - use `path.isAbsolute` instead - breaking: - `res.status()` accepts only integers, and input must be greater than 99 and less than 1000 - will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.` for inputs outside this range - will throw a `TypeError: Invalid status code: ${code}. Status code must be an integer.` for non integer inputs - deps: send\@&#8203;1.0.0 - `res.redirect('back')` and `res.location('back')` is no longer a supported magic string, explicitly use `req.get('Referrer') || '/'`. - change: - `res.clearCookie` will ignore user provided `maxAge` and `expires` options - deps: cookie-signature@^1.2.1 - deps: debug\@&#8203;4.3.6 - deps: merge-descriptors@^2.0.0 - deps: serve-static@^2.1.0 - deps: qs\@&#8203;6.13.0 - deps: accepts@^2.0.0 - deps: mime-types@^3.0.0 - `application/javascript` => `text/javascript` - deps: type-is@^2.0.0 - deps: content-disposition@^1.0.0 - deps: finalhandler@^2.0.0 - deps: fresh@^2.0.0 - deps: body-parser@^2.0.1 - deps: send@^1.1.0 ### [`v4.22.3`](https://github.com/expressjs/express/releases/tag/v4.22.3) [Compare Source](https://github.com/expressjs/express/compare/v4.22.2...v4.22.3) #### What's Changed - Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 by [@&#8203;baryman](https://github.com/baryman) in [#&#8203;7135](https://github.com/expressjs/express/pull/7135) - feat: allow conditional revalidation for QUERY requests (v4) by [@&#8203;Cherry](https://github.com/Cherry) in [#&#8203;7377](https://github.com/expressjs/express/pull/7377) - deps: qs@\~6.16.0 by [@&#8203;lazerg](https://github.com/lazerg) in [#&#8203;7440](https://github.com/expressjs/express/pull/7440) - ci: add npm staged publication with dist-tag support by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;7465](https://github.com/expressjs/express/pull/7465) - 4.22.3 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;7466](https://github.com/expressjs/express/pull/7466) #### New Contributors - [@&#8203;baryman](https://github.com/baryman) made their first contribution in [#&#8203;7135](https://github.com/expressjs/express/pull/7135) - [@&#8203;lazerg](https://github.com/lazerg) made their first contribution in [#&#8203;7440](https://github.com/expressjs/express/pull/7440) **Full Changelog**: <https://github.com/expressjs/express/compare/v4.22.2...v4.22.3> ### [`v4.22.2`](https://github.com/expressjs/express/releases/tag/v4.22.2) [Compare Source](https://github.com/expressjs/express/compare/v4.22.1...v4.22.2) #### What's Changed - fix: restore >20 array parsing for `req.query` repeated keys ([`8d09bfe6`](https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db)) - This also unifies array-cap behavior across notations. Indexed notation (`a[0]=...`) was historically capped at qs's default `arrayLimit` of 20 even in older qs versions; after this change it also allows up to 1000 items. - deps: qs@\~6.15.1 - deps: body-parser@\~1.20.5 #### New Contributors - [@&#8203;suuuuuuminnnnnn](https://github.com/suuuuuuminnnnnn) made their first contribution in [#&#8203;7021](https://github.com/expressjs/express/pull/7021) - [@&#8203;SAY-5](https://github.com/SAY-5) made their first contribution in [#&#8203;7181](https://github.com/expressjs/express/pull/7181) **Full Changelog**: <https://github.com/expressjs/express/compare/v4.22.1...v4.22.2> ### [`v4.22.1`](https://github.com/expressjs/express/releases/tag/v4.22.1) [Compare Source](https://github.com/expressjs/express/compare/4.22.0...v4.22.1) #### What's Changed > \[!IMPORTANT]\ > The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release. - Release: 4.22.1 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6934](https://github.com/expressjs/express/pull/6934) **Full Changelog**: <https://github.com/expressjs/express/compare/4.22.0...v4.22.1> ### [`v4.22.0`](https://github.com/expressjs/express/releases/tag/4.22.0) [Compare Source](https://github.com/expressjs/express/compare/4.21.2...4.22.0) #### Important: Security - Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6)) #### What's Changed - Refactor: improve readability by [@&#8203;sazk07](https://github.com/sazk07) in [#&#8203;6190](https://github.com/expressjs/express/pull/6190) - ci: add support for Node.js\@&#8203;23.0 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6080](https://github.com/expressjs/express/pull/6080) - Method functions with no path should error by [@&#8203;wesleytodd](https://github.com/wesleytodd) in [#&#8203;5957](https://github.com/expressjs/express/pull/5957) - ci: updated github actions ci workflow by [@&#8203;Phillip9587](https://github.com/Phillip9587) in [#&#8203;6323](https://github.com/expressjs/express/pull/6323) - ci: reorder `npm i` steps to fix ci for older node versions by [@&#8203;Phillip9587](https://github.com/Phillip9587) in [#&#8203;6336](https://github.com/expressjs/express/pull/6336) - Backport: ci: add node.js 24 to test matrix by [@&#8203;Phillip9587](https://github.com/Phillip9587) in [#&#8203;6506](https://github.com/expressjs/express/pull/6506) - chore(4.x): wider range for query test skip by [@&#8203;jonchurch](https://github.com/jonchurch) in [#&#8203;6513](https://github.com/expressjs/express/pull/6513) - use tilde notation for certain dependencies by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6905](https://github.com/expressjs/express/pull/6905) - deps: qs\@&#8203;6.14.0 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6909](https://github.com/expressjs/express/pull/6909) - deps: use tilde notation for `qs` by [@&#8203;Phillip9587](https://github.com/Phillip9587) in [#&#8203;6919](https://github.com/expressjs/express/pull/6919) - Release: 4.22.0 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6921](https://github.com/expressjs/express/pull/6921) **Full Changelog**: <https://github.com/expressjs/express/compare/4.21.2...4.22.0> ### [`v4.21.2`](https://github.com/expressjs/express/releases/tag/4.21.2) [Compare Source](https://github.com/expressjs/express/compare/4.21.1...4.21.2) #### What's Changed - Add funding field (v4) by [@&#8203;bjohansebas](https://github.com/bjohansebas) in [#&#8203;6065](https://github.com/expressjs/express/pull/6065) - deps: path-to-regexp\@&#8203;0.1.11 by [@&#8203;blakeembrey](https://github.com/blakeembrey) in [#&#8203;5956](https://github.com/expressjs/express/pull/5956) - deps: bump path-to-regexp\@&#8203;0.1.12 by [@&#8203;jonchurch](https://github.com/jonchurch) in [#&#8203;6209](https://github.com/expressjs/express/pull/6209) - Release: 4.21.2 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6094](https://github.com/expressjs/express/pull/6094) **Full Changelog**: <https://github.com/expressjs/express/compare/4.21.1...4.21.2> ### [`v4.21.1`](https://github.com/expressjs/express/releases/tag/4.21.1) [Compare Source](https://github.com/expressjs/express/compare/4.21.0...4.21.1) #### What's Changed - Backport a fix for CVE-2024-47764 to the 4.x branch by [@&#8203;joshbuker](https://github.com/joshbuker) in [#&#8203;6029](https://github.com/expressjs/express/pull/6029) - Release: 4.21.1 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6031](https://github.com/expressjs/express/pull/6031) **Full Changelog**: <https://github.com/expressjs/express/compare/4.21.0...4.21.1> ### [`v4.21.0`](https://github.com/expressjs/express/releases/tag/4.21.0) [Compare Source](https://github.com/expressjs/express/compare/4.20.0...4.21.0) #### What's Changed - Deprecate `"back"` magic string in redirects by [@&#8203;blakeembrey](https://github.com/blakeembrey) in [#&#8203;5935](https://github.com/expressjs/express/pull/5935) - finalhandler\@&#8203;1.3.1 by [@&#8203;wesleytodd](https://github.com/wesleytodd) in [#&#8203;5954](https://github.com/expressjs/express/pull/5954) - fix(deps): serve-static\@&#8203;1.16.2 by [@&#8203;wesleytodd](https://github.com/wesleytodd) in [#&#8203;5951](https://github.com/expressjs/express/pull/5951) - Upgraded dependency qs to 6.13.0 to match qs in body-parser by [@&#8203;agadzinski93](https://github.com/agadzinski93) in [#&#8203;5946](https://github.com/expressjs/express/pull/5946) #### New Contributors - [@&#8203;agadzinski93](https://github.com/agadzinski93) made their first contribution in [#&#8203;5946](https://github.com/expressjs/express/pull/5946) **Full Changelog**: <https://github.com/expressjs/express/compare/4.20.0...4.21.0> ### [`v4.20.0`](https://github.com/expressjs/express/blob/HEAD/History.md#4200) [Compare Source](https://github.com/expressjs/express/compare/4.19.2...4.20.0) \====== - deps: serve-static\@&#8203;0.16.0 - Remove link renderization in html while redirecting - deps: send\@&#8203;0.19.0 - Remove link renderization in html while redirecting - deps: body-parser\@&#8203;0.6.0 - add `depth` option to customize the depth level in the parser - IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`) - Remove link renderization in html while using `res.redirect` - deps: path-to-regexp\@&#8203;0.1.10 - Adds support for named matching groups in the routes using a regex - Adds backtracking protection to parameters without regexes defined - deps: encodeurl@\~2.0.0 - Removes encoding of `\`, `|`, and `^` to align better with URL spec - Deprecate passing `options.maxAge` and `options.expires` to `res.clearCookie` - Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie ### [`v4.19.2`](https://github.com/expressjs/express/blob/HEAD/History.md#4192) [Compare Source](https://github.com/expressjs/express/compare/4.19.1...4.19.2) \====== - Improved fix for open redirect allow list bypass ### [`v4.19.1`](https://github.com/expressjs/express/blob/HEAD/History.md#4191) [Compare Source](https://github.com/expressjs/express/compare/4.19.0...4.19.1) \====== - Allow passing non-strings to res.location with new encoding handling checks ### [`v4.19.0`](https://github.com/expressjs/express/blob/HEAD/History.md#4190) [Compare Source](https://github.com/expressjs/express/compare/4.18.3...4.19.0) \====== - Prevent open redirect allow list bypass due to encodeurl - deps: cookie\@&#8203;0.6.0 ### [`v4.18.3`](https://github.com/expressjs/express/blob/HEAD/History.md#4183) [Compare Source](https://github.com/expressjs/express/compare/4.18.2...4.18.3) \====== - Fix routing requests without method - deps: body-parser\@&#8203;1.20.2 - Fix strict json error message on Node.js 19+ - deps: content-type@\~1.0.5 - deps: raw-body\@&#8203;2.5.2 - deps: cookie\@&#8203;0.6.0 - Add `partitioned` option ### [`v4.18.2`](https://github.com/expressjs/express/blob/HEAD/History.md#4182) [Compare Source](https://github.com/expressjs/express/compare/4.18.1...4.18.2) \====== - Fix regression routing a large stack in a single route - deps: body-parser\@&#8203;1.20.1 - deps: qs\@&#8203;6.11.0 - perf: remove unnecessary object clone - deps: qs\@&#8203;6.11.0 ### [`v4.18.1`](https://github.com/expressjs/express/blob/HEAD/History.md#4181) [Compare Source](https://github.com/expressjs/express/compare/4.18.0...4.18.1) \====== - Fix hanging on large stack of sync routes ### [`v4.18.0`](https://github.com/expressjs/express/blob/HEAD/History.md#4180) [Compare Source](https://github.com/expressjs/express/compare/4.17.3...4.18.0) \====== - Add "root" option to `res.download` - Allow `options` without `filename` in `res.download` - Deprecate string and non-integer arguments to `res.status` - Fix behavior of `null`/`undefined` as `maxAge` in `res.cookie` - Fix handling very large stacks of sync middleware - Ignore `Object.prototype` values in settings through `app.set`/`app.get` - Invoke `default` with same arguments as types in `res.format` - Support proper 205 responses using `res.send` - Use `http-errors` for `res.format` error - deps: body-parser\@&#8203;1.20.0 - Fix error message for json parse whitespace in `strict` - Fix internal error when inflated body exceeds limit - Prevent loss of async hooks context - Prevent hanging when request already read - deps: depd\@&#8203;2.0.0 - deps: http-errors\@&#8203;2.0.0 - deps: on-finished\@&#8203;2.4.1 - deps: qs\@&#8203;6.10.3 - deps: raw-body\@&#8203;2.5.1 - deps: cookie\@&#8203;0.5.0 - Add `priority` option - Fix `expires` option to reject invalid dates - deps: depd\@&#8203;2.0.0 - Replace internal `eval` usage with `Function` constructor - Use instance methods on `process` to check for listeners - deps: finalhandler\@&#8203;1.2.0 - Remove set content headers that break response - deps: on-finished\@&#8203;2.4.1 - deps: statuses\@&#8203;2.0.1 - deps: on-finished\@&#8203;2.4.1 - Prevent loss of async hooks context - deps: qs\@&#8203;6.10.3 - deps: send\@&#8203;0.18.0 - Fix emitted 416 error missing headers property - Limit the headers removed for 304 response - deps: depd\@&#8203;2.0.0 - deps: destroy\@&#8203;1.2.0 - deps: http-errors\@&#8203;2.0.0 - deps: on-finished\@&#8203;2.4.1 - deps: statuses\@&#8203;2.0.1 - deps: serve-static\@&#8203;1.15.0 - deps: send\@&#8203;0.18.0 - deps: statuses\@&#8203;2.0.1 - Remove code 306 - Rename `425 Unordered Collection` to standard `425 Too Early` ### [`v4.17.3`](https://github.com/expressjs/express/blob/HEAD/History.md#4173) [Compare Source](https://github.com/expressjs/express/compare/4.17.2...4.17.3) \====== - deps: accepts@\~1.3.8 - deps: mime-types@\~2.1.34 - deps: negotiator\@&#8203;0.6.3 - deps: body-parser\@&#8203;1.19.2 - deps: bytes\@&#8203;3.1.2 - deps: qs\@&#8203;6.9.7 - deps: raw-body\@&#8203;2.4.3 - deps: cookie\@&#8203;0.4.2 - deps: qs\@&#8203;6.9.7 - Fix handling of `__proto__` keys - pref: remove unnecessary regexp for trust proxy ### [`v4.17.2`](https://github.com/expressjs/express/blob/HEAD/History.md#4172) [Compare Source](https://github.com/expressjs/express/compare/4.17.1...4.17.2) \====== - Fix handling of `undefined` in `res.jsonp` - Fix handling of `undefined` when `"json escape"` is enabled - Fix incorrect middleware execution with unanchored `RegExp`s - Fix `res.jsonp(obj, status)` deprecation message - Fix typo in `res.is` JSDoc - deps: body-parser\@&#8203;1.19.1 - deps: bytes\@&#8203;3.1.1 - deps: http-errors\@&#8203;1.8.1 - deps: qs\@&#8203;6.9.6 - deps: raw-body\@&#8203;2.4.2 - deps: safe-buffer\@&#8203;5.2.1 - deps: type-is@\~1.6.18 - deps: content-disposition\@&#8203;0.5.4 - deps: safe-buffer\@&#8203;5.2.1 - deps: cookie\@&#8203;0.4.1 - Fix `maxAge` option to reject invalid values - deps: proxy-addr@\~2.0.7 - Use `req.socket` over deprecated `req.connection` - deps: forwarded\@&#8203;0.2.0 - deps: ipaddr.js\@&#8203;1.9.1 - deps: qs\@&#8203;6.9.6 - deps: safe-buffer\@&#8203;5.2.1 - deps: send\@&#8203;0.17.2 - deps: http-errors\@&#8203;1.8.1 - deps: ms\@&#8203;2.1.3 - pref: ignore empty http tokens - deps: serve-static\@&#8203;1.14.2 - deps: send\@&#8203;0.17.2 - deps: setprototypeof\@&#8203;1.2.0 ### [`v4.17.1`](https://github.com/expressjs/express/blob/HEAD/History.md#4171) [Compare Source](https://github.com/expressjs/express/compare/4.17.0...4.17.1) \====== - Revert "Improve error message for `null`/`undefined` to `res.status`" ### [`v4.17.0`](https://github.com/expressjs/express/blob/HEAD/History.md#4170) [Compare Source](https://github.com/expressjs/express/compare/4.16.4...4.17.0) \====== - Add `express.raw` to parse bodies into `Buffer` - Add `express.text` to parse bodies into string - Improve error message for non-strings to `res.sendFile` - Improve error message for `null`/`undefined` to `res.status` - Support multiple hosts in `X-Forwarded-Host` - deps: accepts@\~1.3.7 - deps: body-parser\@&#8203;1.19.0 - Add encoding MIK - Add petabyte (`pb`) support - Fix parsing array brackets after index - deps: bytes\@&#8203;3.1.0 - deps: http-errors\@&#8203;1.7.2 - deps: iconv-lite\@&#8203;0.4.24 - deps: qs\@&#8203;6.7.0 - deps: raw-body\@&#8203;2.4.0 - deps: type-is@\~1.6.17 - deps: content-disposition\@&#8203;0.5.3 - deps: cookie\@&#8203;0.4.0 - Add `SameSite=None` support - deps: finalhandler@\~1.1.2 - Set stricter `Content-Security-Policy` header - deps: parseurl@\~1.3.3 - deps: statuses@\~1.5.0 - deps: parseurl@\~1.3.3 - deps: proxy-addr@\~2.0.5 - deps: ipaddr.js\@&#8203;1.9.0 - deps: qs\@&#8203;6.7.0 - Fix parsing array brackets after index - deps: range-parser@\~1.2.1 - deps: send\@&#8203;0.17.1 - Set stricter CSP header in redirect & error responses - deps: http-errors@\~1.7.2 - deps: mime\@&#8203;1.6.0 - deps: ms\@&#8203;2.1.1 - deps: range-parser@\~1.2.1 - deps: statuses@\~1.5.0 - perf: remove redundant `path.normalize` call - deps: serve-static\@&#8203;1.14.1 - Set stricter CSP header in redirect response - deps: parseurl@\~1.3.3 - deps: send\@&#8203;0.17.1 - deps: setprototypeof\@&#8203;1.1.1 - deps: statuses@\~1.5.0 - Add `103 Early Hints` - deps: type-is@\~1.6.18 - deps: mime-types@\~2.1.24 - perf: prevent internal `throw` on invalid type </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xOTAuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE5MC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin "renovate/express-5.x:renovate/express-5.x"
git switch "renovate/express-5.x"

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch "main"
git merge --no-ff "renovate/express-5.x"
git switch "renovate/express-5.x"
git rebase "main"
git switch "main"
git merge --ff-only "renovate/express-5.x"
git switch "renovate/express-5.x"
git rebase "main"
git switch "main"
git merge --no-ff "renovate/express-5.x"
git switch "main"
git merge --squash "renovate/express-5.x"
git switch "main"
git merge --ff-only "renovate/express-5.x"
git switch "main"
git merge "renovate/express-5.x"
git push origin "main"
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
andylockran/eventloop-adventures!11
No description provided.