Skip to content

Bump the npm_and_yarn group across 1 directory with 17 updates - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-72f8b065d3
Open

Bump the npm_and_yarn group across 1 directory with 17 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-72f8b065d3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 11 updates in the / directory:

Package From To
express 4.18.2 4.22.0
mongoose 6.12.6 6.13.10
multer 1.4.5-lts.1 2.2.0
pug 3.0.2 3.0.3
validator 13.11.0 13.15.22
@messageformat/runtime 3.0.1 3.0.2
@smithy/config-resolver 2.1.1 2.2.0
bn.js 4.12.0 4.12.5
cookie 0.4.1 0.7.2
es5-ext 0.10.62 0.10.64
fast-xml-parser 4.2.5 removed

Updates express from 4.18.2 to 4.22.0

Release notes

Sourced from express's releases.

4.22.0

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Full Changelog: expressjs/express@4.21.0...4.21.1

4.21.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from express's changelog.

4.22.0 / 2025-12-01

4.21.2 / 2024-11-06

  • deps: path-to-regexp@0.1.12
    • Fix backtracking protection
  • deps: path-to-regexp@0.1.11
    • Throws an error on invalid path values

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express since your current version.


Updates mongoose from 6.12.6 to 6.13.10

Release notes

Sourced from mongoose's releases.

6.13.9 / 2026-02-04

  • fix: handle other top-level query operators in sanitizeFilter
  • types(aggregate): add $firstN, $lastN, $bottom, $bottomN, $minN and $maxN operators #15303 #15299
  • docs(compatibility): add note that Mongoose ^6.5 works with MongoDB server 7.x #15427
Changelog

Sourced from mongoose's changelog.

6.13.10 / 2026-06-22

  • fix(document): add additional defensive checks for special properties in Document.prototype.get()
  • fix(schema): avoid returning inherited properties from schema path lookups

6.13.9 / 2026-02-04

  • fix: handle other top-level query operators in sanitizeFilter
  • types(aggregate): add $firstN, $lastN, $bottom, $bottomN, $minN and $maxN operators #15303 #15299
  • docs(compatibility): add note that Mongoose ^6.5 works with MongoDB server 7.x #15427

6.13.8 / 2025-01-20

  • chore: remove coverage output from bundle

6.13.7 / 2025-01-20

  • chore: re-release to force npm audit to pick up 6.x fix for CVE-2025-23061

6.13.6 / 2025-01-13

6.13.5 / 2024-11-26

  • fix: disallow using $where in match

6.13.4 / 2024-11-15

  • fix: save execution stack in query as string #15043 #15039
  • docs: clarify strictQuery default will flip-flop in "Migrating to 6.x" #14998 markstos

6.13.3 / 2024-09-23

  • docs(migrating_to_6): document that Lodash _.isEmpty() with ObjectId() as a parameter returns true in Mongoose 6 #11152

6.13.2 / 2024-09-12

  • fix(document): make set() respect merge option on deeply nested objects #14870 #14878

6.13.1 / 2024-09-06

  • fix: remove empty $and, $or, $not that were made empty by scrict mode #14749 #13086 0x0a0d

6.13.0 / 2024-06-06

  • feat(model): add throwOnValidationError option for opting into getting MongooseBulkWriteError if all valid operations succeed in bulkWrite() and insertMany() #14599 #14587 #14572 #13410

6.12.9 / 2024-05-24

... (truncated)

Commits

Updates multer from 1.4.5-lts.1 to 2.2.0

Release notes

Sourced from multer's releases.

v2.2.0

Important

What's Changed

New Contributors

Full Changelog: expressjs/multer@v2.1.1...v2.2.0

v2.1.1

Important

What's Changed

New Contributors

Full Changelog: expressjs/multer@v2.1.0...v2.1.1

v2.1.0

Important

What's Changed

... (truncated)

Changelog

Sourced from multer's changelog.

2.2.0

2.1.1

2.1.0

2.0.2

2.0.1

2.0.0

1.4.5-lts.2

  • Fix out-of-band error event from busboy (#1177)
Commits
  • 2e2af08 2.2.0 (#1412)
  • a192b52 feat: add fieldNestingDepth limit option
  • 9c801c7 fix: clean up in-progress disk writes on abort
  • 0adb21d ci: add Node 26 to test matrix (#1404)
  • f5e17c3 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1410)
  • de1fefd chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 (#1409)
  • 67abfc8 chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1397)
  • 368c8a1 2.1.1 (#1380)
  • 7e66481 🐛 fix recursion issue
  • 643571e ✅ add explicit test for client able to send body without abrupt disconnect
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for multer since your current version.


Updates pug from 3.0.2 to 3.0.3

Release notes

Sourced from pug's releases.

pug-code-gen@3.0.3

Bug Fixes

  • Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options (#3438)

pug@3.0.3

Bug Fixes

  • Update pug-code-gen with the following fix: (#3438)

    Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options

Commits

Updates validator from 13.11.0 to 13.15.22

Release notes

Sourced from validator's releases.

13.15.22

Fixes, New Locales and Enhancements

New Contributors

Full Changelog: validatorjs/validator.js@13.15.20...13.15.22

13.15.20

Fixes, New Locales and Enhancements

New Contributors

Full Changelog: validatorjs/validator.js@13.15.15...13.15.20

13.15.15

Fixes, New Locales and Enhancements

... (truncated)

Changelog

Sourced from validator's changelog.

13.15.22

Fixes, New Locales and Enhancements

13.15.20

Fixes, New Locales and Enhancements

13.15.15

Fixes, New Locales and Enhancements

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by wikirik, a new releaser for validator since your current version.


Updates @messageformat/runtime from 3.0.1 to 3.0.2

Commits

Updates @smithy/config-resolver from 2.1.1 to 2.2.0

Release notes

Sourced from @​smithy/config-resolver's releases.

@​smithy/signature-v4@​5.7.3

Patch Changes

  • a825452: switch for-in loops to guarded
  • Updated dependencies [e82a22b]
  • Updated dependencies [a825452]
    • @​smithy/core@​3.33.3

@​smithy/signature-v4a@​3.6.2

Patch Changes

  • 99c3f91: Restore npm provenance attestations. No functional changes.
  • Updated dependencies [99c3f91]
    • @​smithy/core@​3.33.2
    • @​smithy/signature-v4@​5.7.2
    • @​smithy/types@​4.17.2

@​smithy/util-utf8@​4.5.2

Patch Changes

  • 99c3f91: Restore npm provenance attestations. No functional changes.
  • Updated dependencies [99c3f91]
    • @​smithy/core@​3.33.2

@​smithy/util-base64@​4.6.2

Patch Changes

  • 99c3f91: Restore npm provenance attestations. No functional changes.
  • Updated dependencies [99c3f91]
    • @​smithy/core@​3.33.2

@​smithy/signature-v4@​5.7.2

Patch Changes

  • 99c3f91: Restore npm provenance attestations. No functional changes.
  • Updated dependencies [99c3f91]
    • @​smithy/core@​3.33.2
    • @​smithy/types@​4.17.2

@​smithy/md5-js@​4.5.2

Patch Changes

  • 99c3f91: Restore npm provenance attestations. No functional changes.
  • Updated dependencies [99c3f91]
    • @​smithy/core@​3.33.2

@​smithy/signature-v4a@​3.6.1

Patch Changes

  • d774f8d: chore: build packages with typescript 7. Packages continue to be compatible with TypeScript 3.4 through 7.0 in consumer applications.

... (truncated)

Changelog

Sourced from @​smithy/config-resolver's changelog.

2.2.0

Minor Changes

  • 38f9a61f: Update package dependencies

Patch Changes

  • Updated dependencies [38f9a61f]
  • Updated dependencies [661f1d60]
    • @​smithy/node-config-provider@​2.3.0
    • @​smithy/util-config-provider@​2.3.0
    • @​smithy/util-middleware@​2.2.0
    • @​smithy/types@​2.12.0

2.1.5

Patch Changes

  • Updated dependencies [43f3e1e2]
    • @​smithy/types@​2.11.0
    • @​smithy/node-config-provider@​2.2.5
    • @​smithy/util-middleware@​2.1.4

2.1.4

Patch Changes

  • @​smithy/node-config-provider@​2.2.4

2.1.3

Patch Changes

  • Updated dependencies [dd0d9b4b]
    • @​smithy/types@​2.10.1
    • @​smithy/node-config-provider@​2.2.3
    • @​smithy/util-middleware@​2.1.3

2.1.2

Patch Changes

  • Updated dependencies [d70a00ac]
  • Updated dependencies [1e23f967]
    • @​smithy/types@​2.10.0
    • @​smithy/node-config-provider@​2.2.2
    • @​smithy/util-middleware@​2.1.2
Commits

Updates bn.js from 4.12.0 to 4.12.5

Commits

Updates body-parser from 1.20.1 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

New Contributors

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

1.20.4

What's Changed

Full Changelog: expressjs/body-parser@1.20.3...1.20.4

1.20.3

What's Changed

Important

  • deps: qs@6.13.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforceme...

      Description has been truncated

@dependabot
Bump the npm_and_yarn group across 1 directory with 17 updates
39fb04d 
Bumps the npm_and_yarn group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [express](https://github.com/expressjs/express) | `4.18.2` | `4.22.0` |
| [mongoose](https://github.com/Automattic/mongoose) | `6.12.6` | `6.13.10` |
| [multer](https://github.com/expressjs/multer) | `1.4.5-lts.1` | `2.2.0` |
| [pug](https://github.com/pugjs/pug) | `3.0.2` | `3.0.3` |
| [validator](https://github.com/validatorjs/validator.js) | `13.11.0` | `13.15.22` |
| [@messageformat/runtime](https://github.com/messageformat/messageformat/tree/HEAD/packages/runtime) | `3.0.1` | `3.0.2` |
| [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver) | `2.1.1` | `2.2.0` |
| [bn.js](https://github.com/indutny/bn.js) | `4.12.0` | `4.12.5` |
| [cookie](https://github.com/jshttp/cookie) | `0.4.1` | `0.7.2` |
| [es5-ext](https://github.com/medikoo/es5-ext) | `0.10.62` | `0.10.64` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `4.2.5` | `removed` |



Updates `express` from 4.18.2 to 4.22.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md)
- [Commits](expressjs/express@4.18.2...4.22.0)

Updates `mongoose` from 6.12.6 to 6.13.10
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/6.13.10/CHANGELOG.md)
- [Commits](Automattic/mongoose@6.12.6...6.13.10)

Updates `multer` from 1.4.5-lts.1 to 2.2.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v1.4.5-lts.1...v2.2.0)

Updates `pug` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/pugjs/pug/releases)
- [Commits](https://github.com/pugjs/pug/compare/pug@3.0.2...pug@3.0.3)

Updates `validator` from 13.11.0 to 13.15.22
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.22)

Updates `@messageformat/runtime` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/messageformat/messageformat/releases)
- [Commits](https://github.com/messageformat/messageformat/commits/@messageformat/runtime@3.0.2/packages/runtime)

Updates `@smithy/config-resolver` from 2.1.1 to 2.2.0
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/@smithy/config-resolver@2.2.0/packages/config-resolver/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@2.2.0/packages/config-resolver)

Updates `bn.js` from 4.12.0 to 4.12.5
- [Release notes](https://github.com/indutny/bn.js/releases)
- [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md)
- [Commits](indutny/bn.js@v4.12.0...v4.12.5)

Updates `body-parser` from 1.20.1 to 1.20.6
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.1...1.20.6)

Updates `cookie` from 0.4.1 to 0.7.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.4.1...v0.7.2)

Updates `es5-ext` from 0.10.62 to 0.10.64
- [Release notes](https://github.com/medikoo/es5-ext/releases)
- [Changelog](https://github.com/medikoo/es5-ext/blob/main/CHANGELOG.md)
- [Commits](medikoo/es5-ext@v0.10.62...v0.10.64)

Removes `fast-xml-parser`

Updates `on-headers` from 1.0.2 to 1.1.0
- [Release notes](https://github.com/jshttp/on-headers/releases)
- [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md)
- [Commits](jshttp/on-headers@v1.0.2...v1.1.0)

Updates `path-to-regexp` from 0.1.7 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.7...v.0.1.13)

Updates `qs` from 6.11.0 to 6.14.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.11.0...v6.14.2)

Updates `send` from 0.18.0 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.18.0...0.19.2)

Updates `serve-static` from 1.15.0 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.15.0...v1.16.3)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 4.22.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: mongoose
  dependency-version: 6.13.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: multer
  dependency-version: 2.2.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: pug
  dependency-version: 3.0.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: validator
  dependency-version: 13.15.22
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@messageformat/runtime"
  dependency-version: 3.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@smithy/config-resolver"
  dependency-version: 2.2.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: bn.js
  dependency-version: 4.12.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version: 0.7.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: es5-ext
  dependency-version: 0.10.64
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: on-headers
  dependency-version: 1.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 4, 2026
This was referenced Sep 4, 2026
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants