fix(deps): update dependency express to v5 - #131

Open
renovate[bot] wants to merge 1 commit into
devfrom
renovate/express-5.x
Open

fix(deps): update dependency express to v5#131
renovate[bot] wants to merge 1 commit into
devfrom
renovate/express-5.x

Conversation

@renovate

@renovaterenovateBot commented Aug 9, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeConfidence
express (source)^4.21.2 → ^5.0.0ageconfidence

Release Notes

expressjs/express (express)

v5.2.1

Compare Source

=======================

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

v5.2.0

Compare Source

========================

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

v5.1.0

Compare Source

========================

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

v5.0.1

Compare Source

==========

v5.0.0

Compare Source

=========================

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@​1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:
    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@​4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@​6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0
    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0

v4.22.2

Compare Source

What's Changed

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

New Contributors

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

Compare Source

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@4.22.0...v4.22.1

v4.22.0

Compare Source

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "after 11pm every weekend,before 8am every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovaterenovateBot added package:npm Pull requests that update node.js deps type:dependencies Pull requests that update a dependency file update:major Major Updates of dependency labels Sep 9, 2025
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from 32f7044 to ec6ba44CompareSeptember 9, 2025 01:19
@snyk-io

snyk-ioBot commented Sep 9, 2025•
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@renovate
renovateBotforce-pushed the renovate/express-5.x branch from ec6ba44 to 8d49fcaCompareSeptember 25, 2025 16:58
@socket-security

socket-securityBot commented Sep 25, 2025•
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedexpress@​4.21.2 ⏵ 5.2.197+110010087-1100

View full report

@renovate
renovateBotforce-pushed the renovate/express-5.x branch 4 times, most recently from eab5047 to 1d49afaCompareOctober 1, 2025 04:40
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from 1d49afa to 9ae00f6CompareOctober 22, 2025 00:35
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from 9ae00f6 to 9570109CompareNovember 10, 2025 20:52
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from 9570109 to 28fe1b5CompareDecember 3, 2025 17:12
@renovate
renovateBotforce-pushed the renovate/express-5.x branch 2 times, most recently from dc1474f to 7f46e68CompareDecember 15, 2025 22:45
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from 7f46e68 to 3586e61CompareDecember 31, 2025 13:58
@renovate
renovateBotforce-pushed the renovate/express-5.x branch 2 times, most recently from 073c2ba to 48c3d78CompareJanuary 23, 2026 19:46
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from 48c3d78 to fa88965CompareMarch 5, 2026 19:49
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from fa88965 to 4a33c26CompareApril 29, 2026 13:44
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from 4a33c26 to 036b8ceCompareMay 12, 2026 10:35
@renovate
renovateBotforce-pushed the renovate/express-5.x branch 2 times, most recently from 2fc1dfd to 1635df1CompareJune 1, 2026 17:34
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from 1635df1 to 8109766CompareJuly 12, 2026 12:58
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from 8109766 to a4ceeebCompareJuly 21, 2026 03:09
@renovate
renovateBotforce-pushed the renovate/express-5.x branch from a4ceeeb to b057733CompareAugust 11, 2026 22:30
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
fix(deps): update dependency express to v5 - #131
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Open
fix(deps): update dependency express to v5#131
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Aug 9, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)^4.21.2 → ^5.0.0ageconfidence
Release Notes
expressjs/express (express)
v5.2.1
Compare Source
=======================
  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
v5.2.0
Compare Source
========================
  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
v5.1.0
Compare Source
========================
  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1
v5.0.1
Compare Source
==========
v5.0.0
Compare Source
=========================
  • remove:

    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:

    • res.status() accepts only integers, and input must be greater than 99 and less than 1000

      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@​1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:

    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@​4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@​6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0

    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0
v4.22.2
Compare Source
What's Changed
  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)

    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5
New Contributors
Full Changelog: expressjs/express@v4.22.1...v4.22.2
v4.22.1
Compare Source
What's Changed
[!IMPORTANT]

The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
Full Changelog: expressjs/express@4.22.0...v4.22.1
v4.22.0
Compare Source
Important: Security
What's Changed
Full Changelog: expressjs/express@4.21.2...4.22.0
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Sep 9, 2025
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
32f7044 to
ec6ba44CompareSeptember 9, 2025 01:19
@snyk-io
snyk-ioBot
commented
Sep 9, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
ec6ba44 to
8d49fcaCompareSeptember 25, 2025 16:58
@socket-security
socket-securityBot
commented
Sep 25, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedexpress@​4.21.2 ⏵ 5.2.197+110010087-1100
View full report
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
4 times, most recently
from
eab5047 to
1d49afaCompareOctober 1, 2025 04:40
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1d49afa to
9ae00f6CompareOctober 22, 2025 00:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9ae00f6 to
9570109CompareNovember 10, 2025 20:52
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9570109 to
28fe1b5CompareDecember 3, 2025 17:12
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
dc1474f to
7f46e68CompareDecember 15, 2025 22:45
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
7f46e68 to
3586e61CompareDecember 31, 2025 13:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
073c2ba to
48c3d78CompareJanuary 23, 2026 19:46
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
48c3d78 to
fa88965CompareMarch 5, 2026 19:49
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
fa88965 to
4a33c26CompareApril 29, 2026 13:44
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
4a33c26 to
036b8ceCompareMay 12, 2026 10:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
2fc1dfd to
1635df1CompareJune 1, 2026 17:34
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1635df1 to
8109766CompareJuly 12, 2026 12:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
8109766 to
a4ceeebCompareJuly 21, 2026 03:09
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
a4ceeeb to
b057733CompareAugust 11, 2026 22:30
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency express to v5 - #131
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Open
fix(deps): update dependency express to v5#131
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Aug 9, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)^4.21.2 → ^5.0.0ageconfidence
Release Notes
expressjs/express (express)
v5.2.1
Compare Source
=======================
  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
v5.2.0
Compare Source
========================
  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
v5.1.0
Compare Source
========================
  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1
v5.0.1
Compare Source
==========
v5.0.0
Compare Source
=========================
  • remove:

    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:

    • res.status() accepts only integers, and input must be greater than 99 and less than 1000

      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@​1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:

    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@​4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@​6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0

    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0
v4.22.2
Compare Source
What's Changed
  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)

    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5
New Contributors
Full Changelog: expressjs/express@v4.22.1...v4.22.2
v4.22.1
Compare Source
What's Changed
[!IMPORTANT]

The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
Full Changelog: expressjs/express@4.22.0...v4.22.1
v4.22.0
Compare Source
Important: Security
What's Changed
Full Changelog: expressjs/express@4.21.2...4.22.0
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Sep 9, 2025
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
32f7044 to
ec6ba44CompareSeptember 9, 2025 01:19
@snyk-io
snyk-ioBot
commented
Sep 9, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
ec6ba44 to
8d49fcaCompareSeptember 25, 2025 16:58
@socket-security
socket-securityBot
commented
Sep 25, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedexpress@​4.21.2 ⏵ 5.2.197+110010087-1100
View full report
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
4 times, most recently
from
eab5047 to
1d49afaCompareOctober 1, 2025 04:40
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1d49afa to
9ae00f6CompareOctober 22, 2025 00:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9ae00f6 to
9570109CompareNovember 10, 2025 20:52
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9570109 to
28fe1b5CompareDecember 3, 2025 17:12
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
dc1474f to
7f46e68CompareDecember 15, 2025 22:45
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
7f46e68 to
3586e61CompareDecember 31, 2025 13:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
073c2ba to
48c3d78CompareJanuary 23, 2026 19:46
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
48c3d78 to
fa88965CompareMarch 5, 2026 19:49
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
fa88965 to
4a33c26CompareApril 29, 2026 13:44
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
4a33c26 to
036b8ceCompareMay 12, 2026 10:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
2fc1dfd to
1635df1CompareJune 1, 2026 17:34
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1635df1 to
8109766CompareJuly 12, 2026 12:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
8109766 to
a4ceeebCompareJuly 21, 2026 03:09
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
a4ceeeb to
b057733CompareAugust 11, 2026 22:30
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency express to v5 - #131
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Open
fix(deps): update dependency express to v5#131
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Aug 9, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)^4.21.2 → ^5.0.0ageconfidence
Release Notes
expressjs/express (express)
v5.2.1
Compare Source
=======================
  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
v5.2.0
Compare Source
========================
  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
v5.1.0
Compare Source
========================
  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1
v5.0.1
Compare Source
==========
v5.0.0
Compare Source
=========================
  • remove:

    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:

    • res.status() accepts only integers, and input must be greater than 99 and less than 1000

      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@​1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:

    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@​4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@​6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0

    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0
v4.22.2
Compare Source
What's Changed
  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)

    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5
New Contributors
Full Changelog: expressjs/express@v4.22.1...v4.22.2
v4.22.1
Compare Source
What's Changed
[!IMPORTANT]

The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
Full Changelog: expressjs/express@4.22.0...v4.22.1
v4.22.0
Compare Source
Important: Security
What's Changed
Full Changelog: expressjs/express@4.21.2...4.22.0
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Sep 9, 2025
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
32f7044 to
ec6ba44CompareSeptember 9, 2025 01:19
@snyk-io
snyk-ioBot
commented
Sep 9, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
ec6ba44 to
8d49fcaCompareSeptember 25, 2025 16:58
@socket-security
socket-securityBot
commented
Sep 25, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedexpress@​4.21.2 ⏵ 5.2.197+110010087-1100
View full report
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
4 times, most recently
from
eab5047 to
1d49afaCompareOctober 1, 2025 04:40
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1d49afa to
9ae00f6CompareOctober 22, 2025 00:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9ae00f6 to
9570109CompareNovember 10, 2025 20:52
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9570109 to
28fe1b5CompareDecember 3, 2025 17:12
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
dc1474f to
7f46e68CompareDecember 15, 2025 22:45
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
7f46e68 to
3586e61CompareDecember 31, 2025 13:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
073c2ba to
48c3d78CompareJanuary 23, 2026 19:46
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
48c3d78 to
fa88965CompareMarch 5, 2026 19:49
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
fa88965 to
4a33c26CompareApril 29, 2026 13:44
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
4a33c26 to
036b8ceCompareMay 12, 2026 10:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
2fc1dfd to
1635df1CompareJune 1, 2026 17:34
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1635df1 to
8109766CompareJuly 12, 2026 12:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
8109766 to
a4ceeebCompareJuly 21, 2026 03:09
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
a4ceeeb to
b057733CompareAugust 11, 2026 22:30
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
fix(deps): update dependency express to v5 - #131
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Open
fix(deps): update dependency express to v5#131
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Aug 9, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)^4.21.2 → ^5.0.0ageconfidence
Release Notes
expressjs/express (express)
v5.2.1
Compare Source
=======================
  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
v5.2.0
Compare Source
========================
  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
v5.1.0
Compare Source
========================
  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1
v5.0.1
Compare Source
==========
v5.0.0
Compare Source
=========================
  • remove:

    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:

    • res.status() accepts only integers, and input must be greater than 99 and less than 1000

      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@​1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:

    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@​4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@​6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0

    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0
v4.22.2
Compare Source
What's Changed
  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)

    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5
New Contributors
Full Changelog: expressjs/express@v4.22.1...v4.22.2
v4.22.1
Compare Source
What's Changed
[!IMPORTANT]

The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
Full Changelog: expressjs/express@4.22.0...v4.22.1
v4.22.0
Compare Source
Important: Security
What's Changed
Full Changelog: expressjs/express@4.21.2...4.22.0
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Sep 9, 2025
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
32f7044 to
ec6ba44CompareSeptember 9, 2025 01:19
@snyk-io
snyk-ioBot
commented
Sep 9, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
ec6ba44 to
8d49fcaCompareSeptember 25, 2025 16:58
@socket-security
socket-securityBot
commented
Sep 25, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedexpress@​4.21.2 ⏵ 5.2.197+110010087-1100
View full report
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
4 times, most recently
from
eab5047 to
1d49afaCompareOctober 1, 2025 04:40
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1d49afa to
9ae00f6CompareOctober 22, 2025 00:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9ae00f6 to
9570109CompareNovember 10, 2025 20:52
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9570109 to
28fe1b5CompareDecember 3, 2025 17:12
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
dc1474f to
7f46e68CompareDecember 15, 2025 22:45
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
7f46e68 to
3586e61CompareDecember 31, 2025 13:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
073c2ba to
48c3d78CompareJanuary 23, 2026 19:46
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
48c3d78 to
fa88965CompareMarch 5, 2026 19:49
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
fa88965 to
4a33c26CompareApril 29, 2026 13:44
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
4a33c26 to
036b8ceCompareMay 12, 2026 10:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
2fc1dfd to
1635df1CompareJune 1, 2026 17:34
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1635df1 to
8109766CompareJuly 12, 2026 12:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
8109766 to
a4ceeebCompareJuly 21, 2026 03:09
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
a4ceeeb to
b057733CompareAugust 11, 2026 22:30
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency express to v5 - #131
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Open
fix(deps): update dependency express to v5#131
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Aug 9, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)^4.21.2 → ^5.0.0ageconfidence
Release Notes
expressjs/express (express)
v5.2.1
Compare Source
=======================
  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
v5.2.0
Compare Source
========================
  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
v5.1.0
Compare Source
========================
  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1
v5.0.1
Compare Source
==========
v5.0.0
Compare Source
=========================
  • remove:

    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:

    • res.status() accepts only integers, and input must be greater than 99 and less than 1000

      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@​1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:

    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@​4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@​6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0

    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0
v4.22.2
Compare Source
What's Changed
  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)

    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5
New Contributors
Full Changelog: expressjs/express@v4.22.1...v4.22.2
v4.22.1
Compare Source
What's Changed
[!IMPORTANT]

The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
Full Changelog: expressjs/express@4.22.0...v4.22.1
v4.22.0
Compare Source
Important: Security
What's Changed
Full Changelog: expressjs/express@4.21.2...4.22.0
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Sep 9, 2025
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
32f7044 to
ec6ba44CompareSeptember 9, 2025 01:19
@snyk-io
snyk-ioBot
commented
Sep 9, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
ec6ba44 to
8d49fcaCompareSeptember 25, 2025 16:58
@socket-security
socket-securityBot
commented
Sep 25, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedexpress@​4.21.2 ⏵ 5.2.197+110010087-1100
View full report
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
4 times, most recently
from
eab5047 to
1d49afaCompareOctober 1, 2025 04:40
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1d49afa to
9ae00f6CompareOctober 22, 2025 00:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9ae00f6 to
9570109CompareNovember 10, 2025 20:52
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9570109 to
28fe1b5CompareDecember 3, 2025 17:12
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
dc1474f to
7f46e68CompareDecember 15, 2025 22:45
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
7f46e68 to
3586e61CompareDecember 31, 2025 13:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
073c2ba to
48c3d78CompareJanuary 23, 2026 19:46
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
48c3d78 to
fa88965CompareMarch 5, 2026 19:49
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
fa88965 to
4a33c26CompareApril 29, 2026 13:44
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
4a33c26 to
036b8ceCompareMay 12, 2026 10:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
2fc1dfd to
1635df1CompareJune 1, 2026 17:34
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1635df1 to
8109766CompareJuly 12, 2026 12:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
8109766 to
a4ceeebCompareJuly 21, 2026 03:09
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
a4ceeeb to
b057733CompareAugust 11, 2026 22:30
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency express to v5 - #131
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Open
fix(deps): update dependency express to v5#131
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Aug 9, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)^4.21.2 → ^5.0.0ageconfidence
Release Notes
expressjs/express (express)
v5.2.1
Compare Source
=======================
  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
v5.2.0
Compare Source
========================
  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
v5.1.0
Compare Source
========================
  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1
v5.0.1
Compare Source
==========
v5.0.0
Compare Source
=========================
  • remove:

    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:

    • res.status() accepts only integers, and input must be greater than 99 and less than 1000

      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@​1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:

    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@​4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@​6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0

    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0
v4.22.2
Compare Source
What's Changed
  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)

    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5
New Contributors
Full Changelog: expressjs/express@v4.22.1...v4.22.2
v4.22.1
Compare Source
What's Changed
[!IMPORTANT]

The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
Full Changelog: expressjs/express@4.22.0...v4.22.1
v4.22.0
Compare Source
Important: Security
What's Changed
Full Changelog: expressjs/express@4.21.2...4.22.0
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Sep 9, 2025
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
32f7044 to
ec6ba44CompareSeptember 9, 2025 01:19
@snyk-io
snyk-ioBot
commented
Sep 9, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
ec6ba44 to
8d49fcaCompareSeptember 25, 2025 16:58
@socket-security
socket-securityBot
commented
Sep 25, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedexpress@​4.21.2 ⏵ 5.2.197+110010087-1100
View full report
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
4 times, most recently
from
eab5047 to
1d49afaCompareOctober 1, 2025 04:40
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1d49afa to
9ae00f6CompareOctober 22, 2025 00:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9ae00f6 to
9570109CompareNovember 10, 2025 20:52
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9570109 to
28fe1b5CompareDecember 3, 2025 17:12
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
dc1474f to
7f46e68CompareDecember 15, 2025 22:45
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
7f46e68 to
3586e61CompareDecember 31, 2025 13:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
073c2ba to
48c3d78CompareJanuary 23, 2026 19:46
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
48c3d78 to
fa88965CompareMarch 5, 2026 19:49
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
fa88965 to
4a33c26CompareApril 29, 2026 13:44
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
4a33c26 to
036b8ceCompareMay 12, 2026 10:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
2fc1dfd to
1635df1CompareJune 1, 2026 17:34
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1635df1 to
8109766CompareJuly 12, 2026 12:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
8109766 to
a4ceeebCompareJuly 21, 2026 03:09
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
a4ceeeb to
b057733CompareAugust 11, 2026 22:30
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
fix(deps): update dependency express to v5 - #131
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Open
fix(deps): update dependency express to v5#131
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/express-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Aug 9, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)^4.21.2 → ^5.0.0ageconfidence
Release Notes
expressjs/express (express)
v5.2.1
Compare Source
=======================
  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
v5.2.0
Compare Source
========================
  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
v5.1.0
Compare Source
========================
  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1
v5.0.1
Compare Source
==========
v5.0.0
Compare Source
=========================
  • remove:

    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:

    • res.status() accepts only integers, and input must be greater than 99 and less than 1000

      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@​1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:

    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@​4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@​6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0

    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0
v4.22.2
Compare Source
What's Changed
  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)

    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5
New Contributors
Full Changelog: expressjs/express@v4.22.1...v4.22.2
v4.22.1
Compare Source
What's Changed
[!IMPORTANT]

The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
Full Changelog: expressjs/express@4.22.0...v4.22.1
v4.22.0
Compare Source
Important: Security
What's Changed
Full Changelog: expressjs/express@4.21.2...4.22.0
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Sep 9, 2025
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
32f7044 to
ec6ba44CompareSeptember 9, 2025 01:19
@snyk-io
snyk-ioBot
commented
Sep 9, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
ec6ba44 to
8d49fcaCompareSeptember 25, 2025 16:58
@socket-security
socket-securityBot
commented
Sep 25, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedexpress@​4.21.2 ⏵ 5.2.197+110010087-1100
View full report
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
4 times, most recently
from
eab5047 to
1d49afaCompareOctober 1, 2025 04:40
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1d49afa to
9ae00f6CompareOctober 22, 2025 00:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9ae00f6 to
9570109CompareNovember 10, 2025 20:52
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
9570109 to
28fe1b5CompareDecember 3, 2025 17:12
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
dc1474f to
7f46e68CompareDecember 15, 2025 22:45
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
7f46e68 to
3586e61CompareDecember 31, 2025 13:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
073c2ba to
48c3d78CompareJanuary 23, 2026 19:46
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
48c3d78 to
fa88965CompareMarch 5, 2026 19:49
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
fa88965 to
4a33c26CompareApril 29, 2026 13:44
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
4a33c26 to
036b8ceCompareMay 12, 2026 10:35
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
2fc1dfd to
1635df1CompareJune 1, 2026 17:34
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
1635df1 to
8109766CompareJuly 12, 2026 12:58
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
8109766 to
a4ceeebCompareJuly 21, 2026 03:09
@renovate
renovateBotforce-pushed
the
renovate/express-5.x
branch
from
a4ceeeb to
b057733CompareAugust 11, 2026 22:30
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants