fix(deps): update npm dependencies updates (major) by renovate[bot] · Pull Request #119 · hackariens/expressjs

renovate · 2025-11-03T04:47:19Z

This PR contains the following updates:

Package	Change	Age	Confidence
express (source)	`4.17.1` → `5.2.1`
http-errors	`1.8.0` → `2.0.1`
nodemon (source)	`2.0.7` → `3.1.14`

Release Notes

expressjs/express (express)

`v5.2.1`

Compare Source

=======================

Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

`v5.2.0`

Compare Source

========================

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
deps: body-parser@^2.2.1
A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

`v5.1.0`

Compare Source

========================

Add support for Uint8Array in res.send()
Add support for ETag option in res.sendFile()
Add support for multiple links with the same rel in res.links()
Add funding field to package.json
perf: use loop for acceptParams
refactor: prefix built-in node module imports
deps: remove setprototypeof
deps: remove safe-buffer
deps: remove utils-merge
deps: remove methods
deps: remove depd
deps: debug@^4.4.0
deps: body-parser@^2.2.0
deps: router@^2.2.0
deps: content-type@^1.0.5
deps: finalhandler@^2.1.0
deps: qs@^6.14.0
deps: server-static@2.2.0
deps: type-is@2.0.1

`v5.0.1`

Compare Source

==========

Update cookie semver lock to address CVE-2024-47764

`v5.0.0`

Compare Source

=========================

remove:
- path-is-absolute dependency - use path.isAbsolute instead
breaking:
- res.status() accepts only integers, and input must be greater than 99 and less than 1000
  - will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
  - will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
- deps: send@1.0.0
- res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
change:
- res.clearCookie will ignore user provided maxAge and expires options
deps: cookie-signature@^1.2.1
deps: debug@4.3.6
deps: merge-descriptors@^2.0.0
deps: serve-static@^2.1.0
deps: qs@6.13.0
deps: accepts@^2.0.0
deps: mime-types@^3.0.0
- application/javascript => text/javascript
deps: type-is@^2.0.0
deps: content-disposition@^1.0.0
deps: finalhandler@^2.0.0
deps: fresh@^2.0.0
deps: body-parser@^2.0.1
deps: send@^1.1.0

What's Changed

Add funding field (v4) by @bjohansebas in #6065
deps: path-to-regexp@0.1.11 by @blakeembrey in #5956
deps: bump path-to-regexp@0.1.12 by @jonchurch in #6209
Release: 4.21.2 by @UlisesGascon in #6094

Full Changelog: expressjs/express@4.21.1...4.21.2

`v4.21.1`

Compare Source

What's Changed

Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in #6029
Release: 4.21.1 by @UlisesGascon in #6031

Full Changelog: expressjs/express@4.21.0...4.21.1

`v4.21.0`

Compare Source

What's Changed

Deprecate "back" magic string in redirects by @blakeembrey in #5935
finalhandler@1.3.1 by @wesleytodd in #5954
fix(deps): serve-static@1.16.2 by @wesleytodd in #5951
Upgraded dependency qs to 6.13.0 to match qs in body-parser by @agadzinski93 in #5946

New Contributors

@agadzinski93 made their first contribution in #5946

Full Changelog: expressjs/express@4.20.0...4.21.0

`v4.20.0`

Compare Source

==========

deps: serve-static@0.16.0
- Remove link renderization in html while redirecting
deps: send@0.19.0
- Remove link renderization in html while redirecting
deps: body-parser@0.6.0
- add depth option to customize the depth level in the parser
- IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
Remove link renderization in html while using res.redirect
deps: path-to-regexp@0.1.10
- Adds support for named matching groups in the routes using a regex
- Adds backtracking protection to parameters without regexes defined
deps: encodeurl@~2.0.0
- Removes encoding of \, |, and ^ to align better with URL spec
Deprecate passing options.maxAge and options.expires to res.clearCookie
- Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

`v4.19.2`

Compare Source

==========

Improved fix for open redirect allow list bypass

`v4.19.1`

Compare Source

==========

Allow passing non-strings to res.location with new encoding handling checks

`v4.19.0`

Compare Source

==========

Prevent open redirect allow list bypass due to encodeurl
deps: cookie@0.6.0

`v4.18.3`

Compare Source

==========

Fix routing requests without method
deps: body-parser@1.20.2
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
- deps: raw-body@2.5.2
deps: cookie@0.6.0
- Add partitioned option

`v4.18.2`

Compare Source

===================

Fix regression routing a large stack in a single route
deps: body-parser@1.20.1
- deps: qs@6.11.0
- perf: remove unnecessary object clone
deps: qs@6.11.0

`v4.18.1`

Compare Source

===================

Fix hanging on large stack of sync routes

`v4.18.0`

Compare Source

===================

Add "root" option to res.download
Allow options without filename in res.download
Deprecate string and non-integer arguments to res.status
Fix behavior of null/undefined as maxAge in res.cookie
Fix handling very large stacks of sync middleware
Ignore Object.prototype values in settings through app.set/app.get
Invoke default with same arguments as types in res.format
Support proper 205 responses using res.send
Use http-errors for res.format error
deps: body-parser@1.20.0
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: depd@2.0.0
- deps: http-errors@2.0.0
- deps: on-finished@2.4.1
- deps: qs@6.10.3
- deps: raw-body@2.5.1
deps: cookie@0.5.0
- Add priority option
- Fix expires option to reject invalid dates
deps: depd@2.0.0
- Replace internal eval usage with Function constructor
- Use instance methods on process to check for listeners
deps: finalhandler@1.2.0
- Remove set content headers that break response
- deps: on-finished@2.4.1
- deps: statuses@2.0.1
deps: on-finished@2.4.1
- Prevent loss of async hooks context
deps: qs@6.10.3
deps: send@0.18.0
- Fix emitted 416 error missing headers property
- Limit the headers removed for 304 response
- deps: depd@2.0.0
- deps: destroy@1.2.0
- deps: http-errors@2.0.0
- deps: on-finished@2.4.1
- deps: statuses@2.0.1
deps: serve-static@1.15.0
- deps: send@0.18.0
deps: statuses@2.0.1
- Remove code 306
- Rename 425 Unordered Collection to standard 425 Too Early

`v4.17.3`

Compare Source

===================

deps: accepts@~1.3.8
- deps: mime-types@~2.1.34
- deps: negotiator@0.6.3
deps: body-parser@1.19.2
- deps: bytes@3.1.2
- deps: qs@6.9.7
- deps: raw-body@2.4.3
deps: cookie@0.4.2
deps: qs@6.9.7
- Fix handling of __proto__ keys
pref: remove unnecessary regexp for trust proxy

`v4.17.2`

Compare Source

===================

Fix handling of undefined in res.jsonp
Fix handling of undefined when "json escape" is enabled
Fix incorrect middleware execution with unanchored RegExps
Fix res.jsonp(obj, status) deprecation message
Fix typo in res.is JSDoc
deps: body-parser@1.19.1
- deps: bytes@3.1.1
- deps: http-errors@1.8.1
- deps: qs@6.9.6
- deps: raw-body@2.4.2
- deps: safe-buffer@5.2.1
- deps: type-is@~1.6.18
deps: content-disposition@0.5.4
- deps: safe-buffer@5.2.1
deps: cookie@0.4.1
- Fix maxAge option to reject invalid values
deps: proxy-addr@~2.0.7
- Use req.socket over deprecated req.connection
- deps: forwarded@0.2.0
- deps: ipaddr.js@1.9.1
deps: qs@6.9.6
deps: safe-buffer@5.2.1
deps: send@0.17.2
- deps: http-errors@1.8.1
- deps: ms@2.1.3
- pref: ignore empty http tokens
deps: serve-static@1.14.2
- deps: send@0.17.2
deps: setprototypeof@1.2.0

jshttp/http-errors (http-errors)

`v2.0.1`

Compare Source

==================

deps: use tilde notation for dependencies
deps: update statuses to 2.0.2

`v2.0.0`

Compare Source

==================

Drop support for Node.js 0.6
Remove I'mateapot export; use ImATeapot instead
Remove support for status being non-first argument
Rename UnorderedCollection constructor to TooEarly
deps: depd@2.0.0
- Replace internal eval usage with Function constructor
- Use instance methods on process to check for listeners
deps: statuses@2.0.1
- Fix messaging casing of 418 I'm a Teapot
- Remove code 306
- Rename 425 Unordered Collection to standard 425 Too Early

`v1.8.1`

Compare Source

==================

deps: toidentifier@1.0.1

remy/nodemon (nodemon)

`v3.1.14`

Compare Source

Bug Fixes

get watch working on windows (cfebe2f), closes #2270

`v3.1.13`

Compare Source

Bug Fixes

TypeScript definition for 'restart' args (5c03715), closes #2265

`v3.1.12`

Compare Source

Bug Fixes

bump minimatch (9376af3), closes #2267

`v3.1.11`

Compare Source

`v3.1.10`

Compare Source

Bug Fixes

update types and jsdocs (#2232) (297c7c7), closes #2231

`v3.1.9`

Compare Source

Bug Fixes

maintain backward support for exitcrash (9c9de6e)

`v3.1.8`

Compare Source

Bug Fixes

types updated (cb91187)

`v3.1.7`

Compare Source

Bug Fixes

types for export on ESModule (#2211) (9b0606a)

`v3.1.6`

Compare Source

Bug Fixes

watch nested paths (11fcaaa), closes #2216

`v3.1.5`

Compare Source

Bug Fixes

add missing ignore option to type defintion of config (#2224) (254c2ab)

`v3.1.4`

Compare Source

Bug Fixes

ensure local env have priority (6020968), closes #2209

`v3.1.3`

Compare Source

Bug Fixes

cast the nodemon function as Nodemon type (eaa1d54), closes #2206

`v3.1.2`

Compare Source

Bug Fixes

Type exports correctly (#2207) (789663c), closes #2206

`v3.1.1`

Compare Source

Bug Fixes

add types to help with required nodemon usage (#2204) (cd27c0b)

`v3.1.0`

Compare Source

Features

Enable nodemon to monitor file removal (#2182) (02d216f)

`v3.0.3`

Compare Source

Bug Fixes

use node when using --import (d3ee86e), closes #2157

`v3.0.2`

Compare Source

Bug Fixes

bump debug out of vuln range (533ad9c), closes #2146

`v3.0.1`

Compare Source

Bug Fixes

restore default ext watch behaviour (95bee00), closes #2124 #1957

`v3.0.0`

Compare Source

Bug Fixes

also watch cjs (86d5f40)
node@10 support back in (af3b9e2)
semver vuln dep (6bb8766), closes #2119

Features

always use polling on IBM i (3b58104)

BREAKING CHANGES

official support for node@8 dropped.

However there's no function being used in semver that breaks node 8,
so it's technically still possible to run with node 8, but it will
no longer be supported (or tested in CI).

`v2.0.22`

Compare Source

Bug Fixes

remove ts mapping if loader present (f7816e4), closes #2083

`v2.0.21`

Compare Source

Bug Fixes

remove ts mapping if loader present (1468397), closes #2083

`v2.0.20`

Compare Source

Bug Fixes

remove postinstall script (e099e91)

`v2.0.19`

Compare Source

Bug Fixes

Replace update notifier with simplified deps (#2033) (176c4a6), closes #1961 #2028

`v2.0.18`

Compare Source

Bug Fixes

revert update-notifier forcing esm (1b3bc8c)

`v2.0.17`

Compare Source

Bug Fixes

bump update-notifier to v6.0.0 (#2029) (0144e4f)
update packge-lock (27e91c3)

`v2.0.16`

Compare Source

Bug Fixes

support windows by using path.delimiter (e26aaa9)

`v2.0.15`

Compare Source

Bug Fixes

bump prod dep versions (54784ab)

`v2.0.14`

Compare Source

Bug Fixes

add windows signals SIGUSR2 & SIGUSR1 to terminate the process (#1938) (61e7abd), closes #1903 #1915 #1936 #1937 #1882 #1893

`v2.0.13`

Compare Source

Bug Fixes

bump update-notifier (90e7a3e), closes #1919
release process on main (9f82a48)

`v2.0.12`

Compare Source

Bug Fixes

windows: properly handle quoted args in event (0823f18), closes #1823

`v2.0.11`

Compare Source

Bug Fixes

ensure numerical OS version check (f523d0e)

`v2.0.10`

Compare Source

Bug Fixes

windows 8 doesn't support windows-kill (6c6cb65), closes #1876

`v2.0.9`

Compare Source

Bug Fixes

allow windows users to install globally again (#1874) (3242215), closes #1872

`v2.0.8`

Compare Source

Bug Fixes

add support for SIGINT on Windows (fixes issue #1720) (#1853) (500c1b0)

Configuration

📅 Schedule: Branch creation - "before 8am on monday" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot force-pushed the renovate/major-npm-dependencies-updates branch from b52e4f8 to 044cd2a Compare November 11, 2025 17:15

renovate bot force-pushed the renovate/major-npm-dependencies-updates branch from 044cd2a to fa91fc4 Compare November 20, 2025 20:38

renovate bot force-pushed the renovate/major-npm-dependencies-updates branch from fa91fc4 to 3a55de3 Compare February 12, 2026 15:43

renovate bot force-pushed the renovate/major-npm-dependencies-updates branch 2 times, most recently from 366df52 to d521a00 Compare February 21, 2026 01:43

renovate bot force-pushed the renovate/major-npm-dependencies-updates branch from d521a00 to 03714cc Compare March 5, 2026 15:15

fix(deps): update npm dependencies updates

c9ebb18

renovate bot force-pushed the renovate/major-npm-dependencies-updates branch from 03714cc to c9ebb18 Compare March 27, 2026 01:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update npm dependencies updates (major)#119

fix(deps): update npm dependencies updates (major)#119
renovate[bot] wants to merge 1 commit intodevelopfrom
renovate/major-npm-dependencies-updates

renovate bot commented Nov 3, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

What's Changed

New Contributors

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Nov 3, 2025 •

edited

Loading