fix(deps): update dependency express to v4 (master) by mend-for-github-com[bot] · Pull Request #85 · Vonage/swagger-codegen

mend-for-github-com · 2024-02-21T02:24:07Z

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
express (source)	`3.x` → `4.x`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

expressjs/express (express)

`v4.22.1`

Compare Source

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Release: 4.22.1 by @UlisesGascon in #6934

Full Changelog: expressjs/express@4.22.0...v4.22.1

`v4.22.0`

Compare Source

Important: Security

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

Refactor: improve readability by @sazk07 in #6190
ci: add support for Node.js@23.0 by @UlisesGascon in #6080
Method functions with no path should error by @wesleytodd in #5957
ci: updated github actions ci workflow by @Phillip9587 in #6323
ci: reorder npm i steps to fix ci for older node versions by @Phillip9587 in #6336
Backport: ci: add node.js 24 to test matrix by @Phillip9587 in #6506
chore(4.x): wider range for query test skip by @jonchurch in #6513
use tilde notation for certain dependencies by @UlisesGascon in #6905
deps: qs@6.14.0 by @UlisesGascon in #6909
deps: use tilde notation for qs by @Phillip9587 in #6919
Release: 4.22.0 by @UlisesGascon in #6921

Full Changelog: expressjs/express@4.21.2...4.22.0

`v4.21.2`

Compare Source

What's Changed

Add funding field (v4) by @bjohansebas in #6065
deps: path-to-regexp@0.1.11 by @blakeembrey in #5956
deps: bump path-to-regexp@0.1.12 by @jonchurch in #6209
Release: 4.21.2 by @UlisesGascon in #6094

Full Changelog: expressjs/express@4.21.1...4.21.2

`v4.21.1`

Compare Source

What's Changed

Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in #6029
Release: 4.21.1 by @UlisesGascon in #6031

Full Changelog: expressjs/express@4.21.0...4.21.1

`v4.21.0`

Compare Source

What's Changed

Deprecate "back" magic string in redirects by @blakeembrey in #5935
finalhandler@1.3.1 by @wesleytodd in #5954
fix(deps): serve-static@1.16.2 by @wesleytodd in #5951
Upgraded dependency qs to 6.13.0 to match qs in body-parser by @agadzinski93 in #5946

New Contributors

@agadzinski93 made their first contribution in #5946

Full Changelog: expressjs/express@4.20.0...4.21.0

`v4.20.0`

Compare Source

==========

deps: serve-static@0.16.0
- Remove link renderization in html while redirecting
deps: send@0.19.0
- Remove link renderization in html while redirecting
deps: body-parser@0.6.0
- add depth option to customize the depth level in the parser
- IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
Remove link renderization in html while using res.redirect
deps: path-to-regexp@0.1.10
- Adds support for named matching groups in the routes using a regex
- Adds backtracking protection to parameters without regexes defined
deps: encodeurl@~2.0.0
- Removes encoding of \, |, and ^ to align better with URL spec
Deprecate passing options.maxAge and options.expires to res.clearCookie
- Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

`v4.19.2`

Compare Source

==========

Improved fix for open redirect allow list bypass

`v4.19.1`

Compare Source

==========

Allow passing non-strings to res.location with new encoding handling checks

`v4.19.0`

Compare Source

==========

Prevent open redirect allow list bypass due to encodeurl
deps: cookie@0.6.0

`v4.18.3`

Compare Source

==========

Fix routing requests without method
deps: body-parser@1.20.2
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
- deps: raw-body@2.5.2
deps: cookie@0.6.0
- Add partitioned option

`v4.18.2`

Compare Source

===================

Fix regression routing a large stack in a single route
deps: body-parser@1.20.1
- deps: qs@6.11.0
- perf: remove unnecessary object clone
deps: qs@6.11.0

`v4.18.1`

Compare Source

===================

Fix hanging on large stack of sync routes

`v4.18.0`

Compare Source

===================

Add "root" option to res.download
Allow options without filename in res.download
Deprecate string and non-integer arguments to res.status
Fix behavior of null/undefined as maxAge in res.cookie
Fix handling very large stacks of sync middleware
Ignore Object.prototype values in settings through app.set/app.get
Invoke default with same arguments as types in res.format
Support proper 205 responses using res.send
Use http-errors for res.format error
deps: body-parser@1.20.0
- Fix error message for json parse whitespace in strict
- Fix internal error when inflated body exceeds limit
- Prevent loss of async hooks context
- Prevent hanging when request already read
- deps: depd@2.0.0
- deps: http-errors@2.0.0
- deps: on-finished@2.4.1
- deps: qs@6.10.3
- deps: raw-body@2.5.1
deps: cookie@0.5.0
- Add priority option
- Fix expires option to reject invalid dates
deps: depd@2.0.0
- Replace internal eval usage with Function constructor
- Use instance methods on process to check for listeners
deps: finalhandler@1.2.0
- Remove set content headers that break response
- deps: on-finished@2.4.1
- deps: statuses@2.0.1
deps: on-finished@2.4.1
- Prevent loss of async hooks context
deps: qs@6.10.3
deps: send@0.18.0
- Fix emitted 416 error missing headers property
- Limit the headers removed for 304 response
- deps: depd@2.0.0
- deps: destroy@1.2.0
- deps: http-errors@2.0.0
- deps: on-finished@2.4.1
- deps: statuses@2.0.1
deps: serve-static@1.15.0
- deps: send@0.18.0
deps: statuses@2.0.1
- Remove code 306
- Rename 425 Unordered Collection to standard 425 Too Early

`v4.17.3`

Compare Source

===================

deps: accepts@~1.3.8
- deps: mime-types@~2.1.34
- deps: negotiator@0.6.3
deps: body-parser@1.19.2
- deps: bytes@3.1.2
- deps: qs@6.9.7
- deps: raw-body@2.4.3
deps: cookie@0.4.2
deps: qs@6.9.7
- Fix handling of __proto__ keys
pref: remove unnecessary regexp for trust proxy

`v4.17.2`

Compare Source

===================

Fix handling of undefined in res.jsonp
Fix handling of undefined when "json escape" is enabled
Fix incorrect middleware execution with unanchored RegExps
Fix res.jsonp(obj, status) deprecation message
Fix typo in res.is JSDoc
deps: body-parser@1.19.1
- deps: bytes@3.1.1
- deps: http-errors@1.8.1
- deps: qs@6.9.6
- deps: raw-body@2.4.2
- deps: safe-buffer@5.2.1
- deps: type-is@~1.6.18
deps: content-disposition@0.5.4
- deps: safe-buffer@5.2.1
deps: cookie@0.4.1
- Fix maxAge option to reject invalid values
deps: proxy-addr@~2.0.7
- Use req.socket over deprecated req.connection
- deps: forwarded@0.2.0
- deps: ipaddr.js@1.9.1
deps: qs@6.9.6
deps: safe-buffer@5.2.1
deps: send@0.17.2
- deps: http-errors@1.8.1
- deps: ms@2.1.3
- pref: ignore empty http tokens
deps: serve-static@1.14.2
- deps: send@0.17.2
deps: setprototypeof@1.2.0

`v4.17.1`

Compare Source

===================

Revert "Improve error message for null/undefined to res.status"

`v4.17.0`

Compare Source

===================

Add express.raw to parse bodies into Buffer
Add express.text to parse bodies into string
Improve error message for non-strings to res.sendFile
Improve error message for null/undefined to res.status
Support multiple hosts in X-Forwarded-Host
deps: accepts@~1.3.7
deps: body-parser@1.19.0
- Add encoding MIK
- Add petabyte (pb) support
- Fix parsing array brackets after index
- deps: bytes@3.1.0
- deps: http-errors@1.7.2
- deps: iconv-lite@0.4.24
- deps: qs@6.7.0
- deps: raw-body@2.4.0
- deps: type-is@~1.6.17
deps: content-disposition@0.5.3
deps: cookie@0.4.0
- Add SameSite=None support
deps: finalhandler@~1.1.2
- Set stricter Content-Security-Policy header
- deps: parseurl@~1.3.3
- deps: statuses@~1.5.0
deps: parseurl@~1.3.3
deps: proxy-addr@~2.0.5
- deps: ipaddr.js@1.9.0
deps: qs@6.7.0
- Fix parsing array brackets after index
deps: range-parser@~1.2.1
deps: send@0.17.1
- Set stricter CSP header in redirect & error responses
- deps: http-errors@~1.7.2
- deps: mime@1.6.0
- deps: ms@2.1.1
- deps: range-parser@~1.2.1
- deps: statuses@~1.5.0
- perf: remove redundant path.normalize call
deps: serve-static@1.14.1
- Set stricter CSP header in redirect response
- deps: parseurl@~1.3.3
- deps: send@0.17.1
deps: setprototypeof@1.1.1
deps: statuses@~1.5.0
- Add 103 Early Hints
deps: type-is@~1.6.18
- deps: mime-types@~2.1.24
- perf: prevent internal throw on invalid type

`v4.16.4`

Compare Source

===================

Fix issue where "Request aborted" may be logged in res.sendfile
Fix JSDoc for Router constructor
deps: body-parser@1.18.3
- Fix deprecation warnings on Node.js 10+
- Fix stack trace for strict json parse error
- deps: depd@~1.1.2
- deps: http-errors@~1.6.3
- deps: iconv-lite@0.4.23
- deps: qs@6.5.2
- deps: raw-body@2.3.3
- deps: type-is@~1.6.16
deps: proxy-addr@~2.0.4
- deps: ipaddr.js@1.8.0
deps: qs@6.5.2
deps: safe-buffer@5.1.2

`v4.16.3`

Compare Source

===================

deps: accepts@~1.3.5
- deps: mime-types@~2.1.18
deps: depd@~1.1.2
- perf: remove argument reassignment
deps: encodeurl@~1.0.2
- Fix encoding % as last character
deps: finalhandler@1.1.1
- Fix 404 output for bad / missing pathnames
- deps: encodeurl@~1.0.2
- deps: statuses@~1.4.0
deps: proxy-addr@~2.0.3
- deps: ipaddr.js@1.6.0
deps: send@0.16.2
- Fix incorrect end tag in default error & redirects
- deps: depd@~1.1.2
- deps: encodeurl@~1.0.2
- deps: statuses@~1.4.0
deps: serve-static@1.13.2
- Fix incorrect end tag in redirects
- deps: encodeurl@~1.0.2
- deps: send@0.16.2
deps: statuses@~1.4.0
deps: type-is@~1.6.16
- deps: mime-types@~2.1.18

`v4.16.2`

Compare Source

===================

Fix TypeError in res.send when given Buffer and ETag header set
perf: skip parsing of entire X-Forwarded-Proto header

`v4.16.1`

Compare Source

===================

deps: send@0.16.1
deps: serve-static@1.13.1
- Fix regression when root is incorrectly set to a file
- deps: send@0.16.1

`v4.16.0`

Compare Source

===================

Add "json escape" setting for res.json and res.jsonp
Add express.json and express.urlencoded to parse bodies
Add options argument to res.download
Improve error message when autoloading invalid view engine
Improve error messages when non-function provided as middleware
Skip Buffer encoding when not generating ETag for small response
Use safe-buffer for improved Buffer API
deps: accepts@~1.3.4
- deps: mime-types@~2.1.16
deps: content-type@~1.0.4
- perf: remove argument reassignment
- perf: skip parameter parsing when no parameters
deps: etag@~1.8.1
- perf: replace regular expression with substring
deps: finalhandler@1.1.0
- Use res.headersSent when available
deps: parseurl@~1.3.2
- perf: reduce overhead for full URLs
- perf: unroll the "fast-path" RegExp
deps: proxy-addr@~2.0.2
- Fix trimming leading / trailing OWS in X-Forwarded-For
- deps: forwarded@~0.1.2
- deps: ipaddr.js@1.5.2
- perf: reduce overhead when no X-Forwarded-For header
deps: qs@6.5.1
- Fix parsing & compacting very deep objects
deps: send@0.16.0
- Add 70 new types for file extensions
- Add immutable option
- Fix missing </html> in default error & redirects
- Set charset as "UTF-8" for .js and .json
- Use instance methods on steam to check for listeners
- deps: mime@1.4.1
- perf: improve path validation speed
deps: serve-static@1.13.0
- Add 70 new types for file extensions
- Add immutable option
- Set charset as "UTF-8" for .js and .json
- deps: send@0.16.0
deps: setprototypeof@1.1.0
deps: utils-merge@1.0.1
deps: vary@~1.1.2
- perf: improve header token parsing speed
perf: re-use options object when generating ETags
perf: remove dead .charset set in res.jsonp

`v4.15.5`

Compare Source

===================

deps: debug@2.6.9
deps: finalhandler@~1.0.6
- deps: debug@2.6.9
- deps: parseurl@~1.3.2
deps: fresh@0.5.2
- Fix handling of modified headers with invalid dates
- perf: improve ETag match loop
- perf: improve If-None-Match token parsing
deps: send@0.15.6
- Fix handling of modified headers with invalid dates
- deps: debug@2.6.9
- deps: etag@~1.8.1
- deps: fresh@0.5.2
- perf: improve If-Match token parsing
deps: serve-static@1.12.6
- deps: parseurl@~1.3.2
- deps: send@0.15.6
- perf: improve slash collapsing

`v4.15.4`

Compare Source

===================

deps: debug@2.6.8
deps: depd@~1.1.1
- Remove unnecessary Buffer loading
deps: finalhandler@~1.0.4
- deps: debug@2.6.8
deps: proxy-addr@~1.1.5
- Fix array argument being altered
- deps: ipaddr.js@1.4.0
deps: qs@6.5.0
deps: send@0.15.4
- deps: debug@2.6.8
- deps: depd@~1.1.1
- deps: http-errors@~1.6.2
deps: serve-static@1.12.4
- deps: send@0.15.4

`v4.15.3`

Compare Source

===================

Fix error when res.set cannot add charset to Content-Type
deps: debug@2.6.7
- Fix DEBUG_MAX_ARRAY_LENGTH
- deps: ms@2.0.0
deps: finalhandler@~1.0.3
- Fix missing </html> in HTML document
- deps: debug@2.6.7
deps: proxy-addr@~1.1.4
- deps: ipaddr.js@1.3.0
deps: send@0.15.3
- deps: debug@2.6.7
- deps: ms@2.0.0
deps: serve-static@1.12.3
- deps: send@0.15.3
deps: type-is@~1.6.15
- deps: mime-types@~2.1.15
deps: vary@~1.1.1
- perf: hoist regular expression

`v4.15.2`

Compare Source

===================

deps: qs@6.4.0
- Fix regression parsing keys starting with [

`v4.15.1`

Compare Source

===================

deps: send@0.15.1
- Fix issue when Date.parse does not return NaN on invalid date
- Fix strict violation in broken environments
deps: serve-static@1.12.1
- Fix issue when Date.parse does not return NaN on invalid date
- deps: send@0.15.1

`v4.15.0`

Compare Source

===================

Add debug message when loading view engine
Add next("router") to exit from router
Fix case where router.use skipped requests routes did not
Remove usage of res._headers private field
- Improves compatibility with Node.js 8 nightly
Skip routing when req.url is not set
Use %o in path debug to tell types apart
Use Object.create to setup request & response prototypes
Use setprototypeof module to replace __proto__ setting
Use statuses instead of http module for status messages
deps: debug@2.6.1
- Allow colors in workers
- Deprecated DEBUG_FD environment variable set to 3 or higher
- Fix error when running under React Native
- Use same color for same namespace
- deps: ms@0.7.2
deps: etag@~1.8.0
- Use SHA1 instead of MD5 for ETag hashing
- Works with FIPS 140-2 OpenSSL configuration
deps: finalhandler@~1.0.0
- Fix exception when err cannot be converted to a string
- Fully URL-encode the pathname in the 404
- Only include the pathname in the 404 message
- Send complete HTML document
- Set Content-Security-Policy: default-src 'self' header
- deps: debug@2.6.1
deps: fresh@0.5.0
- Fix false detection of no-cache request directive
- Fix incorrect result when If-None-Match has both * and ETags
- Fix weak ETag matching to match spec
- perf: delay reading header values until needed
- perf: enable strict mode
- perf: hoist regular expressions
- perf: remove duplicate conditional
- perf: remove unnecessary boolean coercions
- perf: skip checking modified time if ETag check failed
- perf: skip parsing If-None-Match when no ETag header
- perf: use Date.parse instead of new Date
deps: qs@6.3.1
- Fix array parsing from skipping empty values
- Fix compacting nested arrays
deps: send@0.15.0
- Fix false detection of no-cache request directive
- Fix incorrect result when If-None-Match has both * and ETags
- Fix weak ETag matching to match spec
- Remove usage of res._headers private field
- Support If-Match and If-Unmodified-Since headers
- Use res.getHeaderNames() when available
- Use res.headersSent when available
- deps: debug@2.6.1
- deps: etag@~1.8.0
- deps: fresh@0.5.0
- deps: http-errors@~1.6.1
deps: serve-static@1.12.0
- Fix false detection of no-cache request directive
- Fix incorrect result when If-None-Match has both * and ETags
- Fix weak ETag matching to match spec
- Remove usage of res._headers private field
- Send complete HTML document in redirect response
- Set default CSP header in redirect response
- Support If-Match and If-Unmodified-Since headers
- Use res.getHeaderNames() when available
- Use res.headersSent when available
- deps: send@0.15.0
perf: add fast match path for * route
perf: improve req.ips performance

`v4.14.1`

Compare Source

===================

deps: content-disposition@0.5.2
deps: finalhandler@0.5.1
- Fix exception when err.headers is not an object
- deps: statuses@~1.3.1
- perf: hoist regular expressions
- perf: remove duplicate validation path
deps: proxy-addr@~1.1.3
- deps: ipaddr.js@1.2.0
deps: send@0.14.2
- deps: http-errors@~1.5.1
- deps: ms@0.7.2
- deps: statuses@~1.3.1
deps: serve-static@~1.11.2
- deps: send@0.14.2
deps: type-is@~1.6.14
- deps: mime-types@~2.1.13

`v4.14.0`

Compare Source

===================

Add acceptRanges option to res.sendFile/res.sendfile
Add cacheControl option to res.sendFile/res.sendfile
Add options argument to req.range
- Includes the combine option
Encode URL in res.location/res.redirect if not already encoded
Fix some redirect handling in res.sendFile/res.sendfile
Fix Windows absolute path check using forward slashes
Improve error with invalid arguments to req.get()
Improve performance for res.json/res.jsonp in most cases
Improve Range header handling in res.sendFile/res.sendfile
deps: accepts@~1.3.3
- Fix including type extensions in parameters in Accept parsing
- Fix parsing Accept parameters with quoted equals
- Fix parsing Accept parameters with quoted semicolons
- Many performance improvements
- deps: mime-types@~2.1.11
- deps: negotiator@0.6.1
deps: content-type@~1.0.2
- perf: enable strict mode
deps: cookie@0.3.1
- Add sameSite option
- Fix cookie Max-Age to never be a floating point number
- Improve error message when encode is not a function
- Improve error message when expires is not a Date
- Throw better error for invalid argument to parse
- Throw on invalid values provided to serialize
- perf: enable strict mode
- perf: hoist regular expression
- perf: use for loop in parse
- perf: use string concatenation for serialization
deps: finalhandler@0.5.0
- Change invalid or non-numeric status code to 500
- Overwrite status message to match set status code
- Prefer err.statusCode if err.status is invalid
- Set response headers from err.headers object
- Use statuses instead of http module for status messages
deps: proxy-addr@~1.1.2
- Fix accepting various invalid netmasks
- Fix IPv6-mapped IPv4 validation edge cases
- IPv4 netmasks must be contiguous
- IPv6 addresses cannot be used as a netmask
- deps: ipaddr.js@1.1.1
deps: qs@6.2.0
- Add decoder option in parse function
deps: range-parser@~1.2.0
- Add combine option to combine overlapping ranges
- Fix incorrectly returning -1 when there is at least one valid range
- perf: remove internal function
deps: send@0.14.1
- Add acceptRanges option
- Add cacheControl option
- Attempt to combine multiple ranges into single range
- Correctly inherit from Stream class
- Fix Content-Range header in 416 responses when using start/end options
- Fix Content-Range header missing from default 416 responses
- Fix redirect error when path contains raw non-URL characters
- Fix redirect when path starts with multiple forward slashes
- Ignore non-byte Range headers
- deps: http-errors@~1.5.0
- deps: range-parser@~1.2.0
- deps: statuses@~1.3.0
- perf: remove argument reassignment
deps: serve-static@~1.11.1
- Add acceptRanges option
- Add cacheControl option
- Attempt to combine multiple ranges into single range
- Fix redirect error when req.url contains raw non-URL characters
- Ignore non-byte Range headers
- Use status code 301 for redirects
- deps: send@0.14.1
deps: type-is@~1.6.13
- Fix type error when given invalid type to match against
- deps: mime-types@~2.1.11
deps: vary@~1.1.0
- Only accept valid field names in the field argument
perf: use strict equality when possible

`v4.13.4`

Compare Source

===================

deps: content-disposition@0.5.1
- perf: enable strict mode
deps: cookie@0.1.5
- Throw on invalid values provided to serialize
deps: depd@~1.1.0
- Support web browser loading
- perf: enable strict mode
deps: escape-html@~1.0.3
- perf: enable strict mode
- perf: optimize string replacement
- perf: use faster string coercion
deps: finalhandler@0.4.1
- deps: escape-html@~1.0.3
deps: merge-descriptors@1.0.1
- perf: enable strict mode
deps: methods@~1.1.2
- perf: enable strict mode
deps: parseurl@~1.3.1
- perf: enable strict mode
deps: proxy-addr@~1.0.10
- deps: ipaddr.js@1.0.5
- perf: enable strict mode
deps: range-parser@~1.0.3
- perf: enable strict mode
deps: send@0.13.1
- deps: depd@~1.1.0
- deps: destroy@~1.0.4
- deps: escape-html@~1.0.3
- deps: range-parser@~1.0.3
deps: serve-static@~1.10.2
- deps: escape-html@~1.0.3
- deps: parseurl@~1.3.0
- deps: send@0.13.1

`v4.13.3`

Compare Source

===================

Fix infinite loop condition using mergeParams: true
Fix inner numeric indices incorrectly altering parent req.params

`v4.13.2`

Compare Source

===================

deps: accepts@~1.2.12
- deps: mime-types@~2.1.4
deps: array-flatten@1.1.1
- perf: enable strict mode
deps: path-to-regexp@0.1.7
- Fix regression with escaped round brackets and matching groups
deps: type-is@~1.6.6
- deps: mime-types@~2.1.4

`v4.13.1`

Compare Source

===================

deps: accepts@~1.2.10
- deps: mime-types@~2.1.2
deps: qs@4.0.0
- Fix dropping parameters like hasOwnProperty
- Fix various parsing edge cases
deps: type-is@~1.6.4
- deps: mime-types@~2.1.2
- perf: enable strict mode
- perf: remove argument reassignment

`v4.13.0`

Compare Source

===================

Add settings to debug output
Fix res.format error when only default provided
Fix issue where next('route') in app.param would incorrectly skip values
Fix hiding platform issues with decodeURIComponent
- Only URIErrors are a 400
Fix using * before params in routes
Fix using capture groups before params in routes
Simplify res.cookie to call res.append
Use array-flatten module for flattening arrays
deps: accepts@~1.2.9
- deps: mime-types@~2.1.1
- perf: avoid argument reassignment & argument slice
- perf: avoid negotiator recursive construction
- perf: enable strict mode
- perf: remove unnecessary bitwise operator
deps: cookie@0.1.3
- perf: deduce the scope of try-catch deopt
- perf: remove argument reassignments
deps: escape-html@1.0.2
deps: etag@~1.7.0
- Always include entity length in ETags for hash length extensions
- Generate non-Stats ETags using MD5 only (no longer CRC32)
- Improve stat performance by removing hashing
- Improve support for JXcore
- Remove base64 padding in ETags to shorten
- Support "fake" stats objects in environments without fs
- Use MD5 instead of MD4 in weak ETags over 1KB
deps: finalhandler@0.4.0
- Fix a false-positive when unpiping in Node.js 0.8
- Support statusCode property on Error objects
- Use unpipe module for unpiping requests
- deps: escape-html@1.0.2
- deps: on-finished@~2.3.0
- perf: enable strict mode
- perf: remove argument reassignment
deps: fresh@0.3.0
- Add weak ETag matching support
deps: on-finished@~2.3.0
- Add defined behavior for HTTP CONNECT requests
- Add defined behavior for HTTP Upgrade requests
- deps: ee-first@1.1.1
deps: path-to-regexp@0.1.6
deps: send@0.13.0
- Allow Node.js HTTP server to set Date response header
- Fix incorrectly removing Content-Location on 304 response
- Improve the default redirect response headers
- Send appropriate headers on default error response
- Use http-errors for standard emitted errors
- Use statuses instead of http module for status messages
- deps: escape-html@1.0.2
- deps: etag@~1.7.0
- deps: fresh@0.3.0
- deps: on-finished@~2.3.0
- perf: enable strict mode
- perf: remove unnecessary array allocations
deps: serve-static@~1.10.0
- Add fallthrough option
- Fix reading options from options prototype
- Improve the default redirect response headers
- Malformed URLs now next() instead of 400
- deps: escape-html@1.0.2
- deps: send@0.13.0
- perf: enable strict mode
- perf: remove argument reassignment
deps: type-is@~1.6.3
- deps: mime-types@~2.1.1
- perf: reduce try block size
- perf: remove bitwise operations
perf: enable strict mode
perf: isolate app.render try block
perf: remove argument reassignments in application
perf: remove argument reassignments in request prototype
perf: remove argument reassignments in response prototype
perf: remove argument reassignments in routing
perf: remove argument reassignments in View
perf: skip attempting to decode zero length string
perf: use saved reference to http.STATUS_CODES

`v4.12.4`

Compare Source

===================

deps: accepts@~1.2.7
- deps: mime-types@~2.0.11
- deps: negotiator@0.5.3
deps: debug@~2.2.0
- deps: ms@0.7.1
deps: depd@~1.0.1
deps: etag@~1.6.0
- Improve support for JXcore
- Support "fake" stats objects in environments without fs
deps: finalhandler@0.3.6
- deps: debug@~2.2.0
- deps: on-finished@~2.2.1
deps: on-finished@~2.2.1
- Fix isFinished(req) when data buffered
deps: proxy-addr@~1.0.8
- deps: ipaddr.js@1.0.1
deps: qs@2.4.2

Fix allowing parameters like constructor

deps: send@0.12.3
- deps: debug@~2.2.0
- deps: depd@~1.0.1
- deps: etag@~1.6.0
- deps: ms@0.7.1
- deps: on-finished@~2.2.1
deps: serve-static@~1.9.3
- deps: send@0.12.3
deps: type-is@~1.6.2
- deps: mime-types@~2.0.11

`v4.12.3`

Compare Source

===================

deps: accepts@~1.2.5
- deps: mime-types@~2.0.10
deps: debug@~2.1.3
- Fix high intensity foreground color for bold
- deps: ms@0.7.0
deps: finalhandler@0.3.4
- deps: debug@~2.1.3
deps: proxy-addr@~1.0.7
- deps: ipaddr.js@0.1.9
deps: qs@2.4.1
- Fix error when parameter hasOwnProperty is present
deps: send@0.12.2
- Throw errors early for invalid extensions or index options
- deps: debug@~2.1.3
deps: serve-static@~1.9.2
- deps: send@0.12.2
deps: type-is@~1.6.1
- deps: mime-types@~2.0.10

`v4.12.2`

Compare Source

===================

Fix regression where "Request aborted" is logged using res.sendFile

`v4.12.1`

Compare Source

===================

Fix constructing application with non-configurable prototype properties
Fix ECONNRESET errors from res.sendFile usage
Fix req.host when using "trust proxy" hops count
Fix req.protocol/req.secure when using "trust proxy" hops count
Fix wrong code on aborted connections from res.sendFile
deps: merge-descriptors@1.0.0

`v4.12.0`

Compare Source

===================

Fix "trust proxy" setting to inherit when app is mounted
Generate ETags for all request responses
- No longer restricted to only responses for GET and HEAD requests
Use content-type to parse Content-Type headers
deps: accepts@~1.2.4
- Fix preference sorting to be stable for long acceptable lists
- deps: mime-types@~2.0.9
- deps: negotiator@0.5.1
deps: cookie-signature@1.0.6
deps: send@0.12.1
- Always read the stat size from the file
- Fix mutating passed-in options
- deps: mime@1.3.4
deps: serve-static@~1.9.1
- deps: send@0.12.1
deps: type-is@~1.6.0
- fix argument reassignment
- fix false-positives in hasBody Transfer-Encoding check
- support wildcard for both type and subtype (*/*)
- deps: mime-types@~2.0.9

`v4.11.2`

Compare Source

===================

Fix res.redirect double-calling res.end for HEAD requests
deps: accepts@~1.2.3
- deps: mime-types@~2.0.8
deps: proxy-addr@~1.0.6
- deps: ipaddr.js@0.1.8
deps: type-is@~1.5.6
- deps: mime-types@~2.0.8

`v4.11.1`

Compare Source

===================

deps: send@0.11.1
- Fix root path disclosure
deps: serve-static@~1.8.1
- Fix redirect loop in Node.js 0.11.14
- Fix root path disclosure
- deps: send@0.11.1

`v4.11.0`

Compare Source

===================

Add res.append(field, val) to append headers
Deprecate leading : in name for app.param(name, fn)
Deprecate req.param() -- use req.params, req.body, or req.query instead
Deprecate app.param(fn)
Fix OPTIONS responses to include the HEAD method properly
Fix res.sendFile not always detecting aborted connection
Match routes iteratively to prevent stack overflows
deps: accepts@~1.2.2
- deps: mime-types@~2.0.7
- deps: negotiator@0.5.0
deps: send@0.11.0
- deps: debug@~2.1.1
- deps: etag@~1.5.1
- deps: ms@0.7.0
- deps: on-finished@~2.2.0
deps: serve-static@~1.8.0
- deps: send@0.11.0

`v4.10.8`

Compare Source

===================

Fix crash from error within OPTIONS response handler
deps: proxy-addr@~1.0.5
- deps: ipaddr.js@0.1.6

`v4.10.7`

Compare Source

===================

Fix Allow header for OPTIONS to not contain duplicate methods
Fix incorrect "Request aborted" for res.sendFile when HEAD or 304
deps: debug@~2.1.1
deps: finalhandler@0.3.3
- deps: debug@~2.1.1
- deps: on-finished@~2.2.0
deps: methods@~1.1.1
deps: on-finished@~2.2.0
deps: serve-static@~1.7.2
- Fix potential open redirect when mounted at root
deps: type-is@~1.5.5
- deps: mime-types@~2.0.7

`v4.10.6`

Compare Source

===================

Fix exception in req.fresh/req.stale without response headers

`v4.10.5`

Compare Source

===================

Fix res.send double-calling res.end for HEAD requests
deps: accepts@~1.1.4
- deps: mime-types@~2.0.4
deps: type-is@~1.5.4
- deps: mime-types@~2.0.4

`v4.10.4`

Compare Source

===================

Fix res.sendfile logging standard write errors

`v4.10.3`

Compare Source

===================

Fix res.sendFile logging standard write errors
deps: etag@~1.5.1
deps: proxy-addr@~1.0.4
- deps: ipaddr.js@0.1.5
deps: qs@2.3.3
- Fix arrayLimit behavior

`v4.10.2`

Compare Source

===================

Correctly invoke async router callback asynchronously
deps: accepts@~1.1.3
- deps: mime-types@~2.0.3
deps: type-is@~1.5.3
- deps: mime-types@~2.0.3

`v4.10.1`

Compare Source

===================

Fix handling of URLs containing :// in the path
deps: qs@2.3.2
- Fix parsing of mixed objects and values

`v4.10.0`

Compare Source

===================

Add support for app.set('views', array)
- Views are looked up in sequence in array of directories
Fix res.send(status) to mention res.sendStatus(status)
Fix handling of invalid empty URLs
Use content-disposition module for res.attachment/res.download
- Sends standards-compliant Content-Disposition header
- Full Unicode support
Use path.resolve in view lookup
deps: debug@~2.1.0
- Implement DEBUG_FD env variable support
deps: depd@~1.0.0
deps: etag@~1.5.0
- Improve string performance
- Slightly improve speed for weak ETags over 1KB
deps: finalhandler@0.3.2
- Terminate in progress response only on error
- Use on-finished to determine request status
- deps: debug@~2.1.0
- deps: on-finished@~2.1.1
deps: on-finished@~2.1.1
- Fix handling of pipelined requests
deps: qs@2.3.0
- Fix parsing of mixed implicit and explicit arrays
deps: send@0.10.1
- deps: debug@~2.1.0
- deps: depd@~1.0.0
- deps: etag@~1.5.0
- deps: on-finished@~2.1.1
deps: serve-static@~1.7.1
- deps: send@0.10.1

`v4.9.8`

Compare Source

==================

Fix res.redirect body when redirect status specified
deps: accepts@~1.1.2
- Fix error when media type has invalid parameter
- deps: negotiator@0.4.9

`v4.9.7`

Compare Source

==================

Fix using same param name in array of paths

`v4.9.6`

Compare Source

==================

deps: accepts@~1.1.1
- deps: mime-types@~2.0.2
- deps: negotiator@0.4.8
deps: serve-static@~1.6.4
- Fix redirect loop when index file serving disabled
deps: type-is@~1.5.2
- deps: mime-types@~2.0.2

`v4.9.5`

Compare Source

==================

deps: etag@~1.4.0
deps: proxy-addr@~1.0.3
- Use forwarded npm module
deps: send@0.9.3
- deps: etag@~1.4.0
deps: serve-static@~1.6.3
- deps: send@0.9.3

`v4.9.4`

Compare Source

==================

deps: qs@2.2.4
- Fix issue with object keys starting with numbers truncated

`v4.9.3`

Compare Source

==================

deps: proxy-addr@~1.0.2
- Fix a global leak when multiple subnets are trusted
- deps: ipaddr.js@0.1.3

`v4.9.2`

Compare Source

==================

Fix regression for empty string path in app.use
Fix router.use to accept array of middleware without path
Improve error message for bad app.use arguments

`v4.9.1`

Compare Source

==================

Fix app.use to accept array of middleware without path
deps: depd@0.4.5
deps: etag@~1.3.1
deps: send@0.9.2
- deps: depd@0.4.5
- deps: etag@~1.3.1
- deps: range-parser@~1.0.2
deps: serve-static@~1.6.2
- deps: send@0.9.2

`v4.9.0`

Compare Source

==================

Add res.sendStatus
Invoke callback for sendfile when client aborts
- Applies to res.sendFile, res.sendfile, and res.download
- err will be populated with request aborted error
Support IP address host in req.subdomains
Use etag to generate ETag headers
deps: accepts@~1.1.0
- update mime-types
deps: cookie-signature@1.0.5
deps: debug@~2.0.0
deps: finalhandler@0.2.0
- Set X-Content-Type-Options: nosniff header
- deps: debug@~2.0.0
deps: fresh@0.2.4
deps: media-typer@0.3.0
- Throw error when parameter format invalid on parse
deps: qs@2.2.3
- Fix issue where first empty value in array is discarded
deps: range-parser@~1.0.2
deps: send@0.9.1
- Add lastModified option
- Use etag to generate ETag header
- deps: debug@~2.0.0
- deps: fresh@0.2.4
deps: serve-static@~1.6.1
- Add lastModified option
- deps: send@0.9.1
deps: type-is@~1.5.1
- fix hasbody to be true for content-length: 0
- deps: media-typer@0.3.0
- deps: mime-types@~2.0.1
deps: vary@~1.0.0
- Accept valid Vary header string as field

`v4.8.8`

Compare Source

==================

deps: send@0.8.5
- Fix a path traversal issue when using root
- Fix malicious path detection for empty string path
deps: serve-static@~1.5.4
- deps: send@0.8.5

`v4.8.7`

Compare Source

==================

deps: qs@2.2.2
- Remove unnecessary cloning

`v4.8.6`

Compare Source

==================

deps: qs@2.2.0
- Array parsing fix
- Performance improvements

`v4.8.5`

Compare Source

==================

deps: send@0.8.3
- deps: destroy@1.0.3
- deps: on-finished@2.1.0
deps: serve-static@~1.5.3
- deps: send@0.8.3

`v4.8.4`

Compare Source

==================

deps: qs@1.2.2
deps: send@0.8.2
- Work around fd leak in Node.js 0.10 for fs.ReadStream
deps: serve-static@~1.5.2
- deps: send@0.8.2

`v4.8.3`

Compare Source

==================

deps: parseurl@~1.3.0
deps: qs@1.2.1
deps: serve-static@~1.5.1
- Fix parsing of weird req.originalUrl values
- deps: parseurl@~1.3.0
- deps: utils-merge@1.0.0

`v4.8.2`

Compare Source

==================

deps: qs@1.2.0
- Fix parsing array of objects

`v4.8.1`

Compare Source

==================

fix incorrect deprecation warnings on res.download
deps: qs@1.1.0
- Accept urlencoded square brackets
- Accept empty values in implicit array notation

`v4.8.0`

Compare Source

==================

add res.sendFile
- accepts a file system path instead of a URL
- requires an absolute path or root option specified
deprecate res.sendfile -- use res.sendFile instead
support mounted app as any argument to app.use()
deps: qs@1.0.2
- Complete rewrite
- Limits array length to 20
- Limits object depth to 5
- Limits parameters to 1,000
deps: send@0.8.1
- Add extensions option
deps: serve-static@~1.5.0
- Add extensions option
- deps: send@0.8.1

`v4.7.4`

Compare Source

==================

fix res.sendfile regression for serving directory index files
deps: send@0.7.4
- Fix incorrect 403 on Windows and Node.js 0.11
- Fix serving index files without root dir
deps: serve-static@~1.4.4
- deps: send@0.7.4

`v4.7.3`

Compare Source

==================

deps: send@0.7.3
- Fix incorrect 403 on Windows and Node.js 0.11
deps: serve-static@~1.4.3
- Fix incorrect 403 on Windows and Node.js 0.11
- deps: send@0.7.3

`v4.7.2`

Compare Source

==================

deps: depd@0.4.4
- Work-around v8 generating empty stack traces
deps: send@0.7.2
- deps: depd@0.4.4
deps: serve-static@~1.4.2

`v4.7.1`

Compare Source

==================

deps: depd@0.4.3
- Fix exception when global Error.stackTraceLimit is too low
deps: send@0.7.1
- deps: depd@0.4.3
deps: serve-static@~1.4.1

`v4.7.0`

Compare Source

==================

fix req.protocol for proxy-direct connections
configurable query parser with app.set('query parser', parser)
- app.set('query parser', 'extended') parse with "qs" module
- app.set('query parser', 'simple') parse with "querystring" core module
- app.set('query parser', false) disable query string parsing
- app.set('query parser', true) enable simple parsing
deprecate res.json(status, obj) -- use `res.status(status).json(

Configuration

📅 Schedule: Branch creation - "before 5am every weekday" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

mend-for-github-com bot added the security fix Security fix generated by Mend label Feb 21, 2024

mend-for-github-com bot force-pushed the whitesource-remediate/master-express-4.x branch from b3b7f3e to 846b7ad Compare May 5, 2024 18:54

mend-for-github-com bot force-pushed the whitesource-remediate/master-express-4.x branch from 846b7ad to 93df74a Compare September 24, 2024 12:47

fix(deps): update dependency express to v4

19d612e

mend-for-github-com bot force-pushed the whitesource-remediate/master-express-4.x branch from 93df74a to 19d612e Compare September 8, 2025 18:36

mend-for-github-com bot changed the title ~~Update dependency express to v4 (master)~~ fix(deps): update dependency express to v4 (master) Sep 8, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency express to v4 (master)#85

fix(deps): update dependency express to v4 (master)#85
mend-for-github-com[bot] wants to merge 1 commit intomasterfrom
whitesource-remediate/master-express-4.x

mend-for-github-com bot commented Feb 21, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

mend-for-github-com bot commented Feb 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

Important: Security

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

mend-for-github-com bot commented Feb 21, 2024 •

edited

Loading