fix(deps): update npm dependencies updates (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
express (source)	^4.18.2 → ^5.0.0
nodemon (source)	2.0.15 → 3.1.14

---

Release Notes

expressjs/express (express)

v5.2.1

Compare Source

=======================

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

v5.2.0

Compare Source

========================

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
• deps: body-parser@^2.2.1
• A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

v5.1.0

Compare Source

========================

• Add support for Uint8Array in res.send()
• Add support for ETag option in res.sendFile()
• Add support for multiple links with the same rel in res.links()
• Add funding field to package.json
• perf: use loop for acceptParams
• refactor: prefix built-in node module imports
• deps: remove setprototypeof
• deps: remove safe-buffer
• deps: remove utils-merge
• deps: remove methods
• deps: remove depd
• deps: debug@^4.4.0
• deps: body-parser@^2.2.0
• deps: router@^2.2.0
• deps: content-type@^1.0.5
• deps: finalhandler@^2.1.0
• deps: qs@^6.14.0
• deps: server-static@2.2.0
• deps: type-is@2.0.1

v5.0.1

Compare Source

==========

• Update cookie semver lock to address CVE-2024-47764

v5.0.0

Compare Source

=========================

• remove:
  • path-is-absolute dependency - use path.isAbsolute instead
• breaking:
  • res.status() accepts only integers, and input must be greater than 99 and less than 1000
    • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
    • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
  • deps: send@​1.0.0
  • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
• change:
  • res.clearCookie will ignore user provided maxAge and expires options
• deps: cookie-signature@^1.2.1
• deps: debug@​4.3.6
• deps: merge-descriptors@^2.0.0
• deps: serve-static@^2.1.0
• deps: qs@​6.13.0
• deps: accepts@^2.0.0
• deps: mime-types@^3.0.0
  • application/javascript => text/javascript
• deps: type-is@^2.0.0
• deps: content-disposition@^1.0.0
• deps: finalhandler@^2.0.0
• deps: fresh@^2.0.0
• deps: body-parser@^2.0.1
• deps: send@^1.1.0

v4.22.1

Compare Source

v4.22.0

Compare Source

v4.21.2

Compare Source

What's Changed

• Add funding field (v4) by @​bjohansebas in #​6065
• deps: path-to-regexp@​0.1.11 by @​blakeembrey in #​5956
• deps: bump path-to-regexp@​0.1.12 by @​jonchurch in #​6209
• Release: 4.21.2 by @​UlisesGascon in #​6094

Full Changelog: expressjs/express@4.21.1...4.21.2

v4.21.1

Compare Source

What's Changed

• Backport a fix for CVE-2024-47764 to the 4.x branch by @​joshbuker in #​6029
• Release: 4.21.1 by @​UlisesGascon in #​6031

Full Changelog: expressjs/express@4.21.0...4.21.1

v4.21.0

Compare Source

What's Changed

• Deprecate "back" magic string in redirects by @​blakeembrey in #​5935
• finalhandler@​1.3.1 by @​wesleytodd in #​5954
• fix(deps): serve-static@​1.16.2 by @​wesleytodd in #​5951
• Upgraded dependency qs to 6.13.0 to match qs in body-parser by @​agadzinski93 in #​5946

New Contributors

• @​agadzinski93 made their first contribution in #​5946

Full Changelog: expressjs/express@4.20.0...4.21.0

v4.20.0

Compare Source

==========

• deps: serve-static@​0.16.0
  • Remove link renderization in html while redirecting
• deps: send@​0.19.0
  • Remove link renderization in html while redirecting
• deps: body-parser@​0.6.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
• Remove link renderization in html while using res.redirect
• deps: path-to-regexp@​0.1.10
  • Adds support for named matching groups in the routes using a regex
  • Adds backtracking protection to parameters without regexes defined
• deps: encodeurl@~2.0.0
  • Removes encoding of \, |, and ^ to align better with URL spec
• Deprecate passing options.maxAge and options.expires to res.clearCookie
  • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

v4.19.2

Compare Source

==========

• Improved fix for open redirect allow list bypass

v4.19.1

Compare Source

==========

• Allow passing non-strings to res.location with new encoding handling checks

v4.19.0

Compare Source

==========

• Prevent open redirect allow list bypass due to encodeurl
• deps: cookie@​0.6.0

v4.18.3

Compare Source

==========

• Fix routing requests without method
• deps: body-parser@​1.20.2
  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
  • deps: raw-body@​2.5.2
• deps: cookie@​0.6.0
  • Add partitioned option

remy/nodemon (nodemon)

v3.1.14

Compare Source

Bug Fixes

• get watch working on windows (cfebe2f), closes #​2270

v3.1.13

Compare Source

Bug Fixes

• TypeScript definition for 'restart' args (5c03715), closes #​2265

v3.1.12

Compare Source

Bug Fixes

• bump minimatch (9376af3), closes #​2267

v3.1.11

Compare Source

v3.1.10

Compare Source

Bug Fixes

• update types and jsdocs (#​2232) (297c7c7), closes #​2231

v3.1.9

Compare Source

Bug Fixes

• maintain backward support for exitcrash (9c9de6e)

v3.1.8

Compare Source

Bug Fixes

• types updated (cb91187)

v3.1.7

Compare Source

Bug Fixes

• types for export on ESModule (#​2211) (9b0606a)

v3.1.6

Compare Source

Bug Fixes

• watch nested paths (11fcaaa), closes #​2216

v3.1.5

Compare Source

Bug Fixes

• add missing ignore option to type defintion of config (#​2224) (254c2ab)

v3.1.4

Compare Source

Bug Fixes

• ensure local env have priority (6020968), closes #​2209

v3.1.3

Compare Source

Bug Fixes

• cast the nodemon function as Nodemon type (eaa1d54), closes #​2206

v3.1.2

Compare Source

Bug Fixes

• Type exports correctly (#​2207) (789663c), closes #​2206

v3.1.1

Compare Source

Bug Fixes

• add types to help with required nodemon usage (#​2204) (cd27c0b)

v3.1.0

Compare Source

Features

• Enable nodemon to monitor file removal (#​2182) (02d216f)

v3.0.3

Compare Source

Bug Fixes

• use node when using --import (d3ee86e), closes #​2157

v3.0.2

Compare Source

Bug Fixes

• bump debug out of vuln range (533ad9c), closes #​2146

v3.0.1

Compare Source

Bug Fixes

• restore default ext watch behaviour (95bee00), closes #​2124 #​1957

v3.0.0

Compare Source

Bug Fixes

• also watch cjs (86d5f40)
• node@​10 support back in (af3b9e2)
• semver vuln dep (6bb8766), closes #​2119

Features

• always use polling on IBM i (3b58104)

BREAKING CHANGES

• official support for node@​8 dropped.

However there's no function being used in semver that breaks node 8,
so it's technically still possible to run with node 8, but it will
no longer be supported (or tested in CI).

v2.0.22

Compare Source

Bug Fixes

• remove ts mapping if loader present (f7816e4), closes #​2083

v2.0.21

Compare Source

Bug Fixes

• remove ts mapping if loader present (1468397), closes #​2083

v2.0.20

Compare Source

Bug Fixes

• remove postinstall script (e099e91)

v2.0.19

Compare Source

Bug Fixes

• Replace update notifier with simplified deps (#​2033) (176c4a6), closes #​1961 #​2028

v2.0.18

Compare Source

Bug Fixes

• revert update-notifier forcing esm (1b3bc8c)

v2.0.17

Compare Source

Bug Fixes

• bump update-notifier to v6.0.0 (#​2029) (0144e4f)
• update packge-lock (27e91c3)

v2.0.16

Compare Source

Bug Fixes

• support windows by using path.delimiter (e26aaa9)

---

Configuration

📅 Schedule: Branch creation - "before 8am on monday" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.