andylockran/eventloop-adventures

Watch

Fork 0

Update dependency morgan to ~1.12.0 #8

Open

renovate wants to merge 1 commit from renovate/morgan-1.x into main

renovate commented

2026-10-28 00:17:45 +00:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
morgan	`~1.9.1` → `~1.12.0`

Release Notes

expressjs/morgan (morgan)

`v1.12.1`

Compare Source

======

Security fix for CVE-2026-87859(GHSA-9f6g-j8ch-79g4)

`v1.12.0`

Compare Source

======

Security fix for CVE-2026-15603(GHSA-jxfw-x594-9x9m)
Allow format functions to return objects for streams in objectMode
Respect the NO_COLOR environment variable in the dev format

`v1.11.0`

Compare Source

======

add :pid token

Security Fix:

Escape control characters in :remote-user token to prevent log injection
- Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

`v1.10.1`

Compare Source

======

deps: on-headers@~1.1.0
- Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

`v1.10.0`

Compare Source

======

Add :total-time token
Fix trailing space in colored status code for dev format
deps: basic-auth@~2.0.1
- deps: safe-buffer@5.1.2
deps: depd@~2.0.0
- Replace internal eval usage with Function constructor
- Use instance methods on process to check for listeners
deps: on-headers@~1.0.2
- Fix res.writeHead patch missing return value

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [morgan](https://github.com/expressjs/morgan) | [`~1.9.1` → `~1.12.0`](https://renovatebot.com/diffs/npm/morgan/1.9.1/1.12.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/morgan/1.12.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/morgan/1.9.1/1.12.1?slim=true) | --- ### Release Notes <details> <summary>expressjs/morgan (morgan)</summary> ### [`v1.12.1`](https://github.com/expressjs/morgan/blob/HEAD/HISTORY.md#1121) [Compare Source](https://github.com/expressjs/morgan/compare/1.12.0...1.12.1) \====== - Security fix for [CVE-2026-87859](https://www.cve.org/CVERecord?id=CVE-2026-87859)([GHSA-9f6g-j8ch-79g4](https://github.com/expressjs/morgan/security/advisories/GHSA-9f6g-j8ch-79g4)) ### [`v1.12.0`](https://github.com/expressjs/morgan/blob/HEAD/HISTORY.md#1120) [Compare Source](https://github.com/expressjs/morgan/compare/1.11.0...1.12.0) \====== - Security fix for [CVE-2026-15603](https://www.cve.org/CVERecord?id=CVE-2026-15603)([GHSA-jxfw-x594-9x9m](https://github.com/expressjs/morgan/security/advisories/GHSA-jxfw-x594-9x9m)) - Allow format functions to return objects for streams in `objectMode` - Respect the `NO_COLOR` environment variable in the `dev` format ### [`v1.11.0`](https://github.com/expressjs/morgan/blob/HEAD/HISTORY.md#1110) [Compare Source](https://github.com/expressjs/morgan/compare/1.10.1...1.11.0) \====== - add `:pid` token Security Fix: - Escape control characters in `:remote-user` token to prevent log injection - Fixes [CVE-2026-5078](https://www.cve.org/CVERecord?id=CVE-2026-5078) [GHSA-4vj7-5mj6-jm8m](https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m) ### [`v1.10.1`](https://github.com/expressjs/morgan/blob/HEAD/HISTORY.md#1101) [Compare Source](https://github.com/expressjs/morgan/compare/1.10.0...1.10.1) \====== - deps: on-headers@\~1.1.0 - Fix [CVE-2025-7339](https://www.cve.org/CVERecord?id=CVE-2025-7339) ([GHSA-76c9-3jph-rj3q](https://github.com/expressjs/on-headers/security/advisories/GHSA-76c9-3jph-rj3q)) ### [`v1.10.0`](https://github.com/expressjs/morgan/blob/HEAD/HISTORY.md#1100) [Compare Source](https://github.com/expressjs/morgan/compare/1.9.1...1.10.0) \====== - Add `:total-time` token - Fix trailing space in colored status code for `dev` format - deps: basic-auth@\~2.0.1 - deps: safe-buffer\@5.1.2 - deps: depd@\~2.0.0 - Replace internal `eval` usage with `Function` constructor - Use instance methods on `process` to check for listeners - deps: on-headers@\~1.0.2 - Fix `res.writeHead` patch missing return value </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate added 1 commit

2026-10-28 00:17:45 +00:00

Update dependency morgan to ~1.12.0 c443d93ebd

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin "renovate/morgan-1.x:renovate/morgan-1.x"

git switch "renovate/morgan-1.x"

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch "main"

git merge --no-ff "renovate/morgan-1.x"

git switch "renovate/morgan-1.x"

git rebase "main"

git switch "main"

git merge --ff-only "renovate/morgan-1.x"

git switch "renovate/morgan-1.x"

git rebase "main"

git switch "main"

git merge --no-ff "renovate/morgan-1.x"

git switch "main"

git merge --squash "renovate/morgan-1.x"