andylockran/eventloop-adventures
Watch
1
0
Fork
You've already forked eventloop-adventures
 0
Code Issues 1 Pull requests 10 Projects Releases Packages Wiki Activity Actions

Update dependency express to ~4.22.0 #5

Open
renovate wants to merge 1 commit from renovate/express-4.x into main
pull from: renovate/express-4.x
merge into: andylockran:main
Conversation 0 Commits 1 Files changed 2 +665 -149
renovate commented 2026-10-27 00:15:54 +00:00
Collaborator

This PR contains the following updates:

Package Change Age Confidence
express (source) ~4.16.1 → ~4.22.0 age confidence

Release Notes

expressjs/express (express)

v4.22.3

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/expressjs/express/compare/v4.22.2...v4.22.3

v4.22.2

Compare Source

What's Changed

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

New Contributors

Full Changelog: https://github.com/expressjs/express/compare/v4.22.1...v4.22.2

v4.22.1

Compare Source

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: https://github.com/expressjs/express/compare/4.22.0...v4.22.1

v4.22.0

Compare Source

Important: Security

What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.2...4.22.0

v4.21.2

Compare Source

What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.1...4.21.2

v4.21.1

Compare Source

What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.0...4.21.1

v4.21.0

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/expressjs/express/compare/4.20.0...4.21.0

v4.20.0

Compare Source

======

  • deps: serve-static@​0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@​0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@​0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@​0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

v4.19.2

Compare Source

======

  • Improved fix for open redirect allow list bypass

v4.19.1

Compare Source

======

  • Allow passing non-strings to res.location with new encoding handling checks

v4.19.0

Compare Source

======

  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@​0.6.0

v4.18.3

Compare Source

======

  • Fix routing requests without method
  • deps: body-parser@​1.20.2
    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@​2.5.2
  • deps: cookie@​0.6.0
    • Add partitioned option

v4.18.2

Compare Source

======

  • Fix regression routing a large stack in a single route
  • deps: body-parser@​1.20.1
    • deps: qs@​6.11.0
    • perf: remove unnecessary object clone
  • deps: qs@​6.11.0

v4.18.1

Compare Source

======

  • Fix hanging on large stack of sync routes

v4.18.0

Compare Source

======

  • Add "root" option to res.download
  • Allow options without filename in res.download
  • Deprecate string and non-integer arguments to res.status
  • Fix behavior of null/undefined as maxAge in res.cookie
  • Fix handling very large stacks of sync middleware
  • Ignore Object.prototype values in settings through app.set/app.get
  • Invoke default with same arguments as types in res.format
  • Support proper 205 responses using res.send
  • Use http-errors for res.format error
  • deps: body-parser@​1.20.0
    • Fix error message for json parse whitespace in strict
    • Fix internal error when inflated body exceeds limit
    • Prevent loss of async hooks context
    • Prevent hanging when request already read
    • deps: depd@​2.0.0
    • deps: http-errors@​2.0.0
    • deps: on-finished@​2.4.1
    • deps: qs@​6.10.3
    • deps: raw-body@​2.5.1
  • deps: cookie@​0.5.0
    • Add priority option
    • Fix expires option to reject invalid dates
  • deps: depd@​2.0.0
    • Replace internal eval usage with Function constructor
    • Use instance methods on process to check for listeners
  • deps: finalhandler@​1.2.0
    • Remove set content headers that break response
    • deps: on-finished@​2.4.1
    • deps: statuses@​2.0.1
  • deps: on-finished@​2.4.1
    • Prevent loss of async hooks context
  • deps: qs@​6.10.3
  • deps: send@​0.18.0
    • Fix emitted 416 error missing headers property
    • Limit the headers removed for 304 response
    • deps: depd@​2.0.0
    • deps: destroy@​1.2.0
    • deps: http-errors@​2.0.0
    • deps: on-finished@​2.4.1
    • deps: statuses@​2.0.1
  • deps: serve-static@​1.15.0
    • deps: send@​0.18.0
  • deps: statuses@​2.0.1
    • Remove code 306
    • Rename 425 Unordered Collection to standard 425 Too Early

v4.17.3

Compare Source

======

  • deps: accepts@~1.3.8
    • deps: mime-types@~2.1.34
    • deps: negotiator@​0.6.3
  • deps: body-parser@​1.19.2
    • deps: bytes@​3.1.2
    • deps: qs@​6.9.7
    • deps: raw-body@​2.4.3
  • deps: cookie@​0.4.2
  • deps: qs@​6.9.7
    • Fix handling of __proto__ keys
  • pref: remove unnecessary regexp for trust proxy

v4.17.2

Compare Source

======

  • Fix handling of undefined in res.jsonp
  • Fix handling of undefined when "json escape" is enabled
  • Fix incorrect middleware execution with unanchored RegExps
  • Fix res.jsonp(obj, status) deprecation message
  • Fix typo in res.is JSDoc
  • deps: body-parser@​1.19.1
    • deps: bytes@​3.1.1
    • deps: http-errors@​1.8.1
    • deps: qs@​6.9.6
    • deps: raw-body@​2.4.2
    • deps: safe-buffer@​5.2.1
    • deps: type-is@~1.6.18
  • deps: content-disposition@​0.5.4
    • deps: safe-buffer@​5.2.1
  • deps: cookie@​0.4.1
    • Fix maxAge option to reject invalid values
  • deps: proxy-addr@~2.0.7
    • Use req.socket over deprecated req.connection
    • deps: forwarded@​0.2.0
    • deps: ipaddr.js@​1.9.1
  • deps: qs@​6.9.6
  • deps: safe-buffer@​5.2.1
  • deps: send@​0.17.2
    • deps: http-errors@​1.8.1
    • deps: ms@​2.1.3
    • pref: ignore empty http tokens
  • deps: serve-static@​1.14.2
    • deps: send@​0.17.2
  • deps: setprototypeof@​1.2.0

v4.17.1

Compare Source

======

  • Revert "Improve error message for null/undefined to res.status"

v4.17.0

Compare Source

======

  • Add express.raw to parse bodies into Buffer
  • Add express.text to parse bodies into string
  • Improve error message for non-strings to res.sendFile
  • Improve error message for null/undefined to res.status
  • Support multiple hosts in X-Forwarded-Host
  • deps: accepts@~1.3.7
  • deps: body-parser@​1.19.0
    • Add encoding MIK
    • Add petabyte (pb) support
    • Fix parsing array brackets after index
    • deps: bytes@​3.1.0
    • deps: http-errors@​1.7.2
    • deps: iconv-lite@​0.4.24
    • deps: qs@​6.7.0
    • deps: raw-body@​2.4.0
    • deps: type-is@~1.6.17
  • deps: content-disposition@​0.5.3
  • deps: cookie@​0.4.0
    • Add SameSite=None support
  • deps: finalhandler@~1.1.2
    • Set stricter Content-Security-Policy header
    • deps: parseurl@~1.3.3
    • deps: statuses@~1.5.0
  • deps: parseurl@~1.3.3
  • deps: proxy-addr@~2.0.5
    • deps: ipaddr.js@​1.9.0
  • deps: qs@​6.7.0
    • Fix parsing array brackets after index
  • deps: range-parser@~1.2.1
  • deps: send@​0.17.1
    • Set stricter CSP header in redirect & error responses
    • deps: http-errors@~1.7.2
    • deps: mime@​1.6.0
    • deps: ms@​2.1.1
    • deps: range-parser@~1.2.1
    • deps: statuses@~1.5.0
    • perf: remove redundant path.normalize call
  • deps: serve-static@​1.14.1
    • Set stricter CSP header in redirect response
    • deps: parseurl@~1.3.3
    • deps: send@​0.17.1
  • deps: setprototypeof@​1.1.1
  • deps: statuses@~1.5.0
    • Add 103 Early Hints
  • deps: type-is@~1.6.18
    • deps: mime-types@~2.1.24
    • perf: prevent internal throw on invalid type

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [express](https://expressjs.com/) ([source](https://github.com/expressjs/express)) | [`~4.16.1` → `~4.22.0`](https://renovatebot.com/diffs/npm/express/4.16.4/4.22.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/express/4.22.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/4.16.4/4.22.3?slim=true) | --- ### Release Notes <details> <summary>expressjs/express (express)</summary> ### [`v4.22.3`](https://github.com/expressjs/express/releases/tag/v4.22.3) [Compare Source](https://github.com/expressjs/express/compare/v4.22.2...v4.22.3) #### What's Changed - Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 by [@&#8203;baryman](https://github.com/baryman) in [#&#8203;7135](https://github.com/expressjs/express/pull/7135) - feat: allow conditional revalidation for QUERY requests (v4) by [@&#8203;Cherry](https://github.com/Cherry) in [#&#8203;7377](https://github.com/expressjs/express/pull/7377) - deps: qs@\~6.16.0 by [@&#8203;lazerg](https://github.com/lazerg) in [#&#8203;7440](https://github.com/expressjs/express/pull/7440) - ci: add npm staged publication with dist-tag support by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;7465](https://github.com/expressjs/express/pull/7465) - 4.22.3 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;7466](https://github.com/expressjs/express/pull/7466) #### New Contributors - [@&#8203;baryman](https://github.com/baryman) made their first contribution in [#&#8203;7135](https://github.com/expressjs/express/pull/7135) - [@&#8203;lazerg](https://github.com/lazerg) made their first contribution in [#&#8203;7440](https://github.com/expressjs/express/pull/7440) **Full Changelog**: <https://github.com/expressjs/express/compare/v4.22.2...v4.22.3> ### [`v4.22.2`](https://github.com/expressjs/express/releases/tag/v4.22.2) [Compare Source](https://github.com/expressjs/express/compare/v4.22.1...v4.22.2) #### What's Changed - fix: restore >20 array parsing for `req.query` repeated keys ([`8d09bfe6`](https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db)) - This also unifies array-cap behavior across notations. Indexed notation (`a[0]=...`) was historically capped at qs's default `arrayLimit` of 20 even in older qs versions; after this change it also allows up to 1000 items. - deps: qs@\~6.15.1 - deps: body-parser@\~1.20.5 #### New Contributors - [@&#8203;suuuuuuminnnnnn](https://github.com/suuuuuuminnnnnn) made their first contribution in [#&#8203;7021](https://github.com/expressjs/express/pull/7021) - [@&#8203;SAY-5](https://github.com/SAY-5) made their first contribution in [#&#8203;7181](https://github.com/expressjs/express/pull/7181) **Full Changelog**: <https://github.com/expressjs/express/compare/v4.22.1...v4.22.2> ### [`v4.22.1`](https://github.com/expressjs/express/releases/tag/v4.22.1) [Compare Source](https://github.com/expressjs/express/compare/4.22.0...v4.22.1) #### What's Changed > \[!IMPORTANT]\ > The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release. - Release: 4.22.1 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6934](https://github.com/expressjs/express/pull/6934) **Full Changelog**: <https://github.com/expressjs/express/compare/4.22.0...v4.22.1> ### [`v4.22.0`](https://github.com/expressjs/express/releases/tag/4.22.0) [Compare Source](https://github.com/expressjs/express/compare/4.21.2...4.22.0) #### Important: Security - Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6)) #### What's Changed - Refactor: improve readability by [@&#8203;sazk07](https://github.com/sazk07) in [#&#8203;6190](https://github.com/expressjs/express/pull/6190) - ci: add support for Node.js\@&#8203;23.0 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6080](https://github.com/expressjs/express/pull/6080) - Method functions with no path should error by [@&#8203;wesleytodd](https://github.com/wesleytodd) in [#&#8203;5957](https://github.com/expressjs/express/pull/5957) - ci: updated github actions ci workflow by [@&#8203;Phillip9587](https://github.com/Phillip9587) in [#&#8203;6323](https://github.com/expressjs/express/pull/6323) - ci: reorder `npm i` steps to fix ci for older node versions by [@&#8203;Phillip9587](https://github.com/Phillip9587) in [#&#8203;6336](https://github.com/expressjs/express/pull/6336) - Backport: ci: add node.js 24 to test matrix by [@&#8203;Phillip9587](https://github.com/Phillip9587) in [#&#8203;6506](https://github.com/expressjs/express/pull/6506) - chore(4.x): wider range for query test skip by [@&#8203;jonchurch](https://github.com/jonchurch) in [#&#8203;6513](https://github.com/expressjs/express/pull/6513) - use tilde notation for certain dependencies by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6905](https://github.com/expressjs/express/pull/6905) - deps: qs\@&#8203;6.14.0 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6909](https://github.com/expressjs/express/pull/6909) - deps: use tilde notation for `qs` by [@&#8203;Phillip9587](https://github.com/Phillip9587) in [#&#8203;6919](https://github.com/expressjs/express/pull/6919) - Release: 4.22.0 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6921](https://github.com/expressjs/express/pull/6921) **Full Changelog**: <https://github.com/expressjs/express/compare/4.21.2...4.22.0> ### [`v4.21.2`](https://github.com/expressjs/express/releases/tag/4.21.2) [Compare Source](https://github.com/expressjs/express/compare/4.21.1...4.21.2) #### What's Changed - Add funding field (v4) by [@&#8203;bjohansebas](https://github.com/bjohansebas) in [#&#8203;6065](https://github.com/expressjs/express/pull/6065) - deps: path-to-regexp\@&#8203;0.1.11 by [@&#8203;blakeembrey](https://github.com/blakeembrey) in [#&#8203;5956](https://github.com/expressjs/express/pull/5956) - deps: bump path-to-regexp\@&#8203;0.1.12 by [@&#8203;jonchurch](https://github.com/jonchurch) in [#&#8203;6209](https://github.com/expressjs/express/pull/6209) - Release: 4.21.2 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6094](https://github.com/expressjs/express/pull/6094) **Full Changelog**: <https://github.com/expressjs/express/compare/4.21.1...4.21.2> ### [`v4.21.1`](https://github.com/expressjs/express/releases/tag/4.21.1) [Compare Source](https://github.com/expressjs/express/compare/4.21.0...4.21.1) #### What's Changed - Backport a fix for CVE-2024-47764 to the 4.x branch by [@&#8203;joshbuker](https://github.com/joshbuker) in [#&#8203;6029](https://github.com/expressjs/express/pull/6029) - Release: 4.21.1 by [@&#8203;UlisesGascon](https://github.com/UlisesGascon) in [#&#8203;6031](https://github.com/expressjs/express/pull/6031) **Full Changelog**: <https://github.com/expressjs/express/compare/4.21.0...4.21.1> ### [`v4.21.0`](https://github.com/expressjs/express/releases/tag/4.21.0) [Compare Source](https://github.com/expressjs/express/compare/4.20.0...4.21.0) #### What's Changed - Deprecate `"back"` magic string in redirects by [@&#8203;blakeembrey](https://github.com/blakeembrey) in [#&#8203;5935](https://github.com/expressjs/express/pull/5935) - finalhandler\@&#8203;1.3.1 by [@&#8203;wesleytodd](https://github.com/wesleytodd) in [#&#8203;5954](https://github.com/expressjs/express/pull/5954) - fix(deps): serve-static\@&#8203;1.16.2 by [@&#8203;wesleytodd](https://github.com/wesleytodd) in [#&#8203;5951](https://github.com/expressjs/express/pull/5951) - Upgraded dependency qs to 6.13.0 to match qs in body-parser by [@&#8203;agadzinski93](https://github.com/agadzinski93) in [#&#8203;5946](https://github.com/expressjs/express/pull/5946) #### New Contributors - [@&#8203;agadzinski93](https://github.com/agadzinski93) made their first contribution in [#&#8203;5946](https://github.com/expressjs/express/pull/5946) **Full Changelog**: <https://github.com/expressjs/express/compare/4.20.0...4.21.0> ### [`v4.20.0`](https://github.com/expressjs/express/blob/HEAD/History.md#4200) [Compare Source](https://github.com/expressjs/express/compare/4.19.2...4.20.0) \====== - deps: serve-static\@&#8203;0.16.0 - Remove link renderization in html while redirecting - deps: send\@&#8203;0.19.0 - Remove link renderization in html while redirecting - deps: body-parser\@&#8203;0.6.0 - add `depth` option to customize the depth level in the parser - IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`) - Remove link renderization in html while using `res.redirect` - deps: path-to-regexp\@&#8203;0.1.10 - Adds support for named matching groups in the routes using a regex - Adds backtracking protection to parameters without regexes defined - deps: encodeurl@\~2.0.0 - Removes encoding of `\`, `|`, and `^` to align better with URL spec - Deprecate passing `options.maxAge` and `options.expires` to `res.clearCookie` - Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie ### [`v4.19.2`](https://github.com/expressjs/express/blob/HEAD/History.md#4192) [Compare Source](https://github.com/expressjs/express/compare/4.19.1...4.19.2) \====== - Improved fix for open redirect allow list bypass ### [`v4.19.1`](https://github.com/expressjs/express/blob/HEAD/History.md#4191) [Compare Source](https://github.com/expressjs/express/compare/4.19.0...4.19.1) \====== - Allow passing non-strings to res.location with new encoding handling checks ### [`v4.19.0`](https://github.com/expressjs/express/blob/HEAD/History.md#4190) [Compare Source](https://github.com/expressjs/express/compare/4.18.3...4.19.0) \====== - Prevent open redirect allow list bypass due to encodeurl - deps: cookie\@&#8203;0.6.0 ### [`v4.18.3`](https://github.com/expressjs/express/blob/HEAD/History.md#4183) [Compare Source](https://github.com/expressjs/express/compare/4.18.2...4.18.3) \====== - Fix routing requests without method - deps: body-parser\@&#8203;1.20.2 - Fix strict json error message on Node.js 19+ - deps: content-type@\~1.0.5 - deps: raw-body\@&#8203;2.5.2 - deps: cookie\@&#8203;0.6.0 - Add `partitioned` option ### [`v4.18.2`](https://github.com/expressjs/express/blob/HEAD/History.md#4182) [Compare Source](https://github.com/expressjs/express/compare/4.18.1...4.18.2) \====== - Fix regression routing a large stack in a single route - deps: body-parser\@&#8203;1.20.1 - deps: qs\@&#8203;6.11.0 - perf: remove unnecessary object clone - deps: qs\@&#8203;6.11.0 ### [`v4.18.1`](https://github.com/expressjs/express/blob/HEAD/History.md#4181) [Compare Source](https://github.com/expressjs/express/compare/4.18.0...4.18.1) \====== - Fix hanging on large stack of sync routes ### [`v4.18.0`](https://github.com/expressjs/express/blob/HEAD/History.md#4180) [Compare Source](https://github.com/expressjs/express/compare/4.17.3...4.18.0) \====== - Add "root" option to `res.download` - Allow `options` without `filename` in `res.download` - Deprecate string and non-integer arguments to `res.status` - Fix behavior of `null`/`undefined` as `maxAge` in `res.cookie` - Fix handling very large stacks of sync middleware - Ignore `Object.prototype` values in settings through `app.set`/`app.get` - Invoke `default` with same arguments as types in `res.format` - Support proper 205 responses using `res.send` - Use `http-errors` for `res.format` error - deps: body-parser\@&#8203;1.20.0 - Fix error message for json parse whitespace in `strict` - Fix internal error when inflated body exceeds limit - Prevent loss of async hooks context - Prevent hanging when request already read - deps: depd\@&#8203;2.0.0 - deps: http-errors\@&#8203;2.0.0 - deps: on-finished\@&#8203;2.4.1 - deps: qs\@&#8203;6.10.3 - deps: raw-body\@&#8203;2.5.1 - deps: cookie\@&#8203;0.5.0 - Add `priority` option - Fix `expires` option to reject invalid dates - deps: depd\@&#8203;2.0.0 - Replace internal `eval` usage with `Function` constructor - Use instance methods on `process` to check for listeners - deps: finalhandler\@&#8203;1.2.0 - Remove set content headers that break response - deps: on-finished\@&#8203;2.4.1 - deps: statuses\@&#8203;2.0.1 - deps: on-finished\@&#8203;2.4.1 - Prevent loss of async hooks context - deps: qs\@&#8203;6.10.3 - deps: send\@&#8203;0.18.0 - Fix emitted 416 error missing headers property - Limit the headers removed for 304 response - deps: depd\@&#8203;2.0.0 - deps: destroy\@&#8203;1.2.0 - deps: http-errors\@&#8203;2.0.0 - deps: on-finished\@&#8203;2.4.1 - deps: statuses\@&#8203;2.0.1 - deps: serve-static\@&#8203;1.15.0 - deps: send\@&#8203;0.18.0 - deps: statuses\@&#8203;2.0.1 - Remove code 306 - Rename `425 Unordered Collection` to standard `425 Too Early` ### [`v4.17.3`](https://github.com/expressjs/express/blob/HEAD/History.md#4173) [Compare Source](https://github.com/expressjs/express/compare/4.17.2...4.17.3) \====== - deps: accepts@\~1.3.8 - deps: mime-types@\~2.1.34 - deps: negotiator\@&#8203;0.6.3 - deps: body-parser\@&#8203;1.19.2 - deps: bytes\@&#8203;3.1.2 - deps: qs\@&#8203;6.9.7 - deps: raw-body\@&#8203;2.4.3 - deps: cookie\@&#8203;0.4.2 - deps: qs\@&#8203;6.9.7 - Fix handling of `__proto__` keys - pref: remove unnecessary regexp for trust proxy ### [`v4.17.2`](https://github.com/expressjs/express/blob/HEAD/History.md#4172) [Compare Source](https://github.com/expressjs/express/compare/4.17.1...4.17.2) \====== - Fix handling of `undefined` in `res.jsonp` - Fix handling of `undefined` when `"json escape"` is enabled - Fix incorrect middleware execution with unanchored `RegExp`s - Fix `res.jsonp(obj, status)` deprecation message - Fix typo in `res.is` JSDoc - deps: body-parser\@&#8203;1.19.1 - deps: bytes\@&#8203;3.1.1 - deps: http-errors\@&#8203;1.8.1 - deps: qs\@&#8203;6.9.6 - deps: raw-body\@&#8203;2.4.2 - deps: safe-buffer\@&#8203;5.2.1 - deps: type-is@\~1.6.18 - deps: content-disposition\@&#8203;0.5.4 - deps: safe-buffer\@&#8203;5.2.1 - deps: cookie\@&#8203;0.4.1 - Fix `maxAge` option to reject invalid values - deps: proxy-addr@\~2.0.7 - Use `req.socket` over deprecated `req.connection` - deps: forwarded\@&#8203;0.2.0 - deps: ipaddr.js\@&#8203;1.9.1 - deps: qs\@&#8203;6.9.6 - deps: safe-buffer\@&#8203;5.2.1 - deps: send\@&#8203;0.17.2 - deps: http-errors\@&#8203;1.8.1 - deps: ms\@&#8203;2.1.3 - pref: ignore empty http tokens - deps: serve-static\@&#8203;1.14.2 - deps: send\@&#8203;0.17.2 - deps: setprototypeof\@&#8203;1.2.0 ### [`v4.17.1`](https://github.com/expressjs/express/blob/HEAD/History.md#4171) [Compare Source](https://github.com/expressjs/express/compare/4.17.0...4.17.1) \====== - Revert "Improve error message for `null`/`undefined` to `res.status`" ### [`v4.17.0`](https://github.com/expressjs/express/blob/HEAD/History.md#4170) [Compare Source](https://github.com/expressjs/express/compare/4.16.4...4.17.0) \====== - Add `express.raw` to parse bodies into `Buffer` - Add `express.text` to parse bodies into string - Improve error message for non-strings to `res.sendFile` - Improve error message for `null`/`undefined` to `res.status` - Support multiple hosts in `X-Forwarded-Host` - deps: accepts@\~1.3.7 - deps: body-parser\@&#8203;1.19.0 - Add encoding MIK - Add petabyte (`pb`) support - Fix parsing array brackets after index - deps: bytes\@&#8203;3.1.0 - deps: http-errors\@&#8203;1.7.2 - deps: iconv-lite\@&#8203;0.4.24 - deps: qs\@&#8203;6.7.0 - deps: raw-body\@&#8203;2.4.0 - deps: type-is@\~1.6.17 - deps: content-disposition\@&#8203;0.5.3 - deps: cookie\@&#8203;0.4.0 - Add `SameSite=None` support - deps: finalhandler@\~1.1.2 - Set stricter `Content-Security-Policy` header - deps: parseurl@\~1.3.3 - deps: statuses@\~1.5.0 - deps: parseurl@\~1.3.3 - deps: proxy-addr@\~2.0.5 - deps: ipaddr.js\@&#8203;1.9.0 - deps: qs\@&#8203;6.7.0 - Fix parsing array brackets after index - deps: range-parser@\~1.2.1 - deps: send\@&#8203;0.17.1 - Set stricter CSP header in redirect & error responses - deps: http-errors@\~1.7.2 - deps: mime\@&#8203;1.6.0 - deps: ms\@&#8203;2.1.1 - deps: range-parser@\~1.2.1 - deps: statuses@\~1.5.0 - perf: remove redundant `path.normalize` call - deps: serve-static\@&#8203;1.14.1 - Set stricter CSP header in redirect response - deps: parseurl@\~1.3.3 - deps: send\@&#8203;0.17.1 - deps: setprototypeof\@&#8203;1.1.1 - deps: statuses@\~1.5.0 - Add `103 Early Hints` - deps: type-is@\~1.6.18 - deps: mime-types@\~2.1.24 - perf: prevent internal `throw` on invalid type </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODYuNCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4Ni40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin "renovate/express-4.x:renovate/express-4.x"
git switch "renovate/express-4.x"

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch "main"
git merge --no-ff "renovate/express-4.x"
git switch "renovate/express-4.x"
git rebase "main"
git switch "main"
git merge --ff-only "renovate/express-4.x"
git switch "renovate/express-4.x"
git rebase "main"
git switch "main"
git merge --no-ff "renovate/express-4.x"
git switch "main"
git merge --squash "renovate/express-4.x"
git switch "main"
git merge --ff-only "renovate/express-4.x"
git switch "main"
git merge "renovate/express-4.x"
git push origin "main"
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
andylockran/eventloop-adventures!5
No description provided.