Skip to content

Update dependency express to v5 - #17

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/express-5.x
Open

Update dependency express to v5#17
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/express-5.x

Conversation

@renovate

@renovate renovate Bot commented Jun 29, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
express (source) ^4.18.1 → ^5.0.0 age confidence

Release Notes

expressjs/express (express)

v5.3.0

Compare Source

=====

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #​4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #​7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #​7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #​5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #​6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #​7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #​6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #​7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

  • Upgrade body-parser to ^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalid limit option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid limit values now throw at parser initialization instead of being ignored - by @​Mayvis in #​7390

⚡ Performance

  • Avoid duplicate Content-Type header processing in res.send() when sending string responses without an explicit Content-Type header - by @​bjohansebas in #​6991

v5.2.1

Compare Source

=====

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

v5.2.0

Compare Source

=====

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

v5.1.0

Compare Source

=====

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

v5.0.1

Compare Source

=====

v5.0.0

Compare Source

=====

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@​1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:
    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@​4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@​6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0
    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0

v4.22.3

Compare Source

What's Changed

New Contributors

Full Changelog: expressjs/express@v4.22.2...v4.22.3

v4.22.2

Compare Source

What's Changed

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

New Contributors

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

Compare Source

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@4.22.0...v4.22.1

v4.22.0

Compare Source

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from a96bf05 to 6f63038 Compare July 2, 2025 06:30
@github-actions

github-actions Bot commented Jul 2, 2025

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from 6f63038 to d5dd365 Compare August 10, 2025 15:01
@github-actions

github-actions Bot commented Aug 10, 2025

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from d5dd365 to 9c3b0d7 Compare September 25, 2025 14:56
@github-actions

github-actions Bot commented Sep 25, 2025

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from 9c3b0d7 to ba0df3d Compare November 18, 2025 16:09
@renovate
renovate Bot force-pushed the renovate/express-5.x branch from ba0df3d to 2a5626b Compare December 1, 2025 19:12
@github-actions

github-actions Bot commented Dec 1, 2025

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from 2a5626b to b7942b1 Compare December 1, 2025 22:01
@github-actions

github-actions Bot commented Dec 1, 2025

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from b7942b1 to 2935765 Compare December 31, 2025 16:56
@github-actions

github-actions Bot commented Dec 31, 2025

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from 2935765 to fd29ded Compare January 8, 2026 19:38
@github-actions

github-actions Bot commented Jan 8, 2026

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch 2 times, most recently from 65957e8 to 6d62d9e Compare February 17, 2026 15:45
@github-actions

github-actions Bot commented Feb 17, 2026

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from 6d62d9e to bec01ea Compare March 27, 2026 13:31
@github-actions

github-actions Bot commented Mar 27, 2026

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from bec01ea to e58d8cb Compare April 1, 2026 16:40
@github-actions

github-actions Bot commented Apr 1, 2026

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from e58d8cb to fbf3d07 Compare April 8, 2026 18:44
@renovate
renovate Bot force-pushed the renovate/express-5.x branch from fbf3d07 to 498e8ac Compare April 29, 2026 18:58
@renovate
renovate Bot force-pushed the renovate/express-5.x branch from 498e8ac to bbdba13 Compare May 18, 2026 17:53
@github-actions

github-actions Bot commented May 18, 2026

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from bbdba13 to b1ff96e Compare July 12, 2026 15:46
@renovate
renovate Bot force-pushed the renovate/express-5.x branch from b1ff96e to 3885c89 Compare July 24, 2026 21:42
@renovate
renovate Bot force-pushed the renovate/express-5.x branch from 3885c89 to b6e2aa3 Compare August 14, 2026 17:54
@renovate
renovate Bot force-pushed the renovate/express-5.x branch from b6e2aa3 to 3a2d7ce Compare August 26, 2026 15:40
@renovate
renovate Bot force-pushed the renovate/express-5.x branch from 3a2d7ce to 1a48890 Compare September 2, 2026 22:30
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from 1a48890 to 8498192 Compare October 9, 2026 15:31
@renovate
renovate Bot force-pushed the renovate/express-5.x branch 2 times, most recently from 7a9385c to 4b0b5a7 Compare October 22, 2026 13:16
@github-actions

github-actions Bot commented Oct 22, 2026

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

@renovate
renovate Bot force-pushed the renovate/express-5.x branch from 4b0b5a7 to f5a8445 Compare November 5, 2026 22:52
@github-actions

github-actions Bot commented Nov 5, 2026

Copy link
Copy Markdown

Coverage Report (Node 20.x)

Coverage after merging renovate/express-5.x into main will be
89.38%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
server.js85.37%70%75%92.59%23, 37, 42–44
db
   db.js78.95%100%60%85.71%17, 30
db/models
   user.js100%100%100%100%
   video.js100%100%100%100%
routes
   auth-routes.js100%100%100%100%
   pipeline-routes.js94.29%90.91%100%95.65%26–27
   video-routes.js96.25%95.65%100%96.23%45, 63–64
utils
   funcs.js79.41%72.41%77.78%82.81%22–23, 23, 23–24, 24, 24–26, 26, 26–27, 27, 27–28, 30–33
   logger.js65.79%40%66.67%76%103, 33, 55, 64, 64, 64, 66, 74, 89, 89, 96–97

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants