search

freeCodeCamp / demo-projects

Example certification projects for our programming curriculum
https://www.freecodecamp.org/learn
BSD 3-Clause "New" or "Revised" License
143 stars 90 forks source link

fix(deps): update dependency express to v5.0.0 [security] - autoclosed #614

Closed renovate[bot] closed 1 month ago

renovate[bot] commented 2 months ago

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
express (source) 5.0.0-beta.3 -> 5.0.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-43796

Impact

In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code

Patches

this issue is patched in express 4.20.0

Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

Details

successful exploitation of this vector requires the following:

  1. The attacker MUST control the input to response.redirect()
  2. express MUST NOT redirect before the template appears
  3. the browser MUST NOT complete redirection before:
  4. the user MUST click on the link in the template

Release Notes

expressjs/express (express) ### [`v5.0.0`](https://redirect.github.com/expressjs/express/releases/tag/v5.0.0): 5.0.0 [Compare Source](https://redirect.github.com/expressjs/express/compare/v5.0.0-beta.3...v5.0.0) #### What's Changed - 4.19.2 Staging by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5561](https://redirect.github.com/expressjs/express/pull/5561) - remove duplicate location test for data uri by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5562](https://redirect.github.com/expressjs/express/pull/5562) - feat: document beta releases expectations by [@​marco-ippolito](https://redirect.github.com/marco-ippolito) in [https://github.com/expressjs/express/pull/5565](https://redirect.github.com/expressjs/express/pull/5565) - Cut down on duplicated CI runs by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5564](https://redirect.github.com/expressjs/express/pull/5564) - Add a Threat Model by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5526](https://redirect.github.com/expressjs/express/pull/5526) - Assign captain of encodeurl by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5579](https://redirect.github.com/expressjs/express/pull/5579) - Nominate jonchurch as repo captain for `http-errors`, `expressjs.com`, `morgan`, `cors`, `body-parser` by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5587](https://redirect.github.com/expressjs/express/pull/5587) - docs: update Security.md by [@​inigomarquinez](https://redirect.github.com/inigomarquinez) in [https://github.com/expressjs/express/pull/5590](https://redirect.github.com/expressjs/express/pull/5590) - docs: update triage nomination policy by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5600](https://redirect.github.com/expressjs/express/pull/5600) - Add CodeQL (SAST) by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5433](https://redirect.github.com/expressjs/express/pull/5433) - docs: add UlisesGascon as triage initiative captain by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5605](https://redirect.github.com/expressjs/express/pull/5605) - Use object with null prototype for various app properties by [@​EvanHahn](https://redirect.github.com/EvanHahn) in [https://github.com/expressjs/express/pull/4861](https://redirect.github.com/expressjs/express/pull/4861) - deps: encodeurl@~2.0.0 by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5569](https://redirect.github.com/expressjs/express/pull/5569) - skip QUERY method test by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5628](https://redirect.github.com/expressjs/express/pull/5628) - ignore ETAG query test on 21 and 22, reuse skip util by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5639](https://redirect.github.com/expressjs/express/pull/5639) - add support Node.js@22 in the CI by [@​mertcanaltin](https://redirect.github.com/mertcanaltin) in [https://github.com/expressjs/express/pull/5627](https://redirect.github.com/expressjs/express/pull/5627) - doc: add table of contents, tc/triager lists to readme by [@​mertcanaltin](https://redirect.github.com/mertcanaltin) in [https://github.com/expressjs/express/pull/5619](https://redirect.github.com/expressjs/express/pull/5619) - List and sort all projects, add captains by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5653](https://redirect.github.com/expressjs/express/pull/5653) - Call callback once on listen error by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/3216](https://redirect.github.com/expressjs/express/pull/3216) - docs: add [@​UlisesGascon](https://redirect.github.com/UlisesGascon) as captain for cookie-parser by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5666](https://redirect.github.com/expressjs/express/pull/5666) - ✨ bring back query tests for node 21 by [@​ctcpip](https://redirect.github.com/ctcpip) in [https://github.com/expressjs/express/pull/5690](https://redirect.github.com/expressjs/express/pull/5690) - \[v4] Deprecate `res.clearCookie` accepting `options.maxAge` and `options.expires` by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5672](https://redirect.github.com/expressjs/express/pull/5672) - skip QUERY tests for Node 21 only, still not supported by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5695](https://redirect.github.com/expressjs/express/pull/5695) - 📝 update people, add ctcpip to TC by [@​ctcpip](https://redirect.github.com/ctcpip) in [https://github.com/expressjs/express/pull/5683](https://redirect.github.com/expressjs/express/pull/5683) - remove minor version pinning from ci by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5722](https://redirect.github.com/expressjs/express/pull/5722) - Fix link variable use in attribution section of CODE OF CONDUCT by [@​IamLizu](https://redirect.github.com/IamLizu) in [https://github.com/expressjs/express/pull/5762](https://redirect.github.com/expressjs/express/pull/5762) - Replace Appveyor windows testing with GHA by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5599](https://redirect.github.com/expressjs/express/pull/5599) - Add OSSF Scorecard badge by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5436](https://redirect.github.com/expressjs/express/pull/5436) - Throw on invalid status codes by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/4212](https://redirect.github.com/expressjs/express/pull/4212) - Use Array.flat instead of array-flatten by [@​almic](https://redirect.github.com/almic) in [https://github.com/expressjs/express/pull/5677](https://redirect.github.com/expressjs/express/pull/5677) - Adopt Node@18 as the minimum supported version by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5803](https://redirect.github.com/expressjs/express/pull/5803) - Ignore `expires` and `maxAge` in `res.clearCookie()` by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5792](https://redirect.github.com/expressjs/express/pull/5792) - send@1.0.0 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5786](https://redirect.github.com/expressjs/express/pull/5786) - chore: upgrade `debug` dep from 3.10 to 4.3.6 by [@​carpasse](https://redirect.github.com/carpasse) in [https://github.com/expressjs/express/pull/5829](https://redirect.github.com/expressjs/express/pull/5829) - refactor: replace 'path-is-absolute' dep with node:path isAbsolute method by [@​carpasse](https://redirect.github.com/carpasse) in [https://github.com/expressjs/express/pull/5830](https://redirect.github.com/expressjs/express/pull/5830) - update scorecard link by [@​bjohansebas](https://redirect.github.com/bjohansebas) in [https://github.com/expressjs/express/pull/5814](https://redirect.github.com/expressjs/express/pull/5814) - Nominate [@​IamLizu](https://redirect.github.com/IamLizu) to the triage team by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5836](https://redirect.github.com/expressjs/express/pull/5836) - deps: path-to-regexp@0.1.8 by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5603](https://redirect.github.com/expressjs/express/pull/5603) - docs: specify new instructions for `question` and `discuss` by [@​IamLizu](https://redirect.github.com/IamLizu) in [https://github.com/expressjs/express/pull/5835](https://redirect.github.com/expressjs/express/pull/5835) - 5.x: Upgrading `merge-descriptors` with allowing minors by [@​RobinTail](https://redirect.github.com/RobinTail) in [https://github.com/expressjs/express/pull/5782](https://redirect.github.com/expressjs/express/pull/5782) - 4.x: Upgrade `merge-descriptors` dependency by [@​RobinTail](https://redirect.github.com/RobinTail) in [https://github.com/expressjs/express/pull/5781](https://redirect.github.com/expressjs/express/pull/5781) - WIP: serve-static@2 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5790](https://redirect.github.com/expressjs/express/pull/5790) - chore: upgrade qs dp from 6.11.0 to 6.13.0 by [@​carpasse](https://redirect.github.com/carpasse) in [https://github.com/expressjs/express/pull/5847](https://redirect.github.com/expressjs/express/pull/5847) - Upgrade cookie signature by [@​IamLizu](https://redirect.github.com/IamLizu) in [https://github.com/expressjs/express/pull/5833](https://redirect.github.com/expressjs/express/pull/5833) - accepts@2 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5881](https://redirect.github.com/expressjs/express/pull/5881) - mime-types@3 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5882](https://redirect.github.com/expressjs/express/pull/5882) - type-is@^2.0.0 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5883](https://redirect.github.com/expressjs/express/pull/5883) - content-disposition@^1.0.0 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5884](https://redirect.github.com/expressjs/express/pull/5884) - fix(deps): finalhandler@^2.0.0 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5899](https://redirect.github.com/expressjs/express/pull/5899) - path-to-regexp@0.1.10 by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5902](https://redirect.github.com/expressjs/express/pull/5902) - update to `fresh@^2.0.0` by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5916](https://redirect.github.com/expressjs/express/pull/5916) - router@^2.0.0 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5885](https://redirect.github.com/expressjs/express/pull/5885) - Adopt Node@18 as the minimum supported version by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5595](https://redirect.github.com/expressjs/express/pull/5595) - master -> 5.0 by [@​ctcpip](https://redirect.github.com/ctcpip) in [https://github.com/expressjs/express/pull/5785](https://redirect.github.com/expressjs/express/pull/5785) - 🔧 update CI, remove unsupported versions, clean up by [@​ctcpip](https://redirect.github.com/ctcpip) in [https://github.com/expressjs/express/pull/5931](https://redirect.github.com/expressjs/express/pull/5931) - Delete `back` as a magic string by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5933](https://redirect.github.com/expressjs/express/pull/5933) - Release 5.0 by [@​dougwilson](https://redirect.github.com/dougwilson) in [https://github.com/expressjs/express/pull/2237](https://redirect.github.com/expressjs/express/pull/2237) #### New Contributors - [@​marco-ippolito](https://redirect.github.com/marco-ippolito) made their first contribution in [https://github.com/expressjs/express/pull/5565](https://redirect.github.com/expressjs/express/pull/5565) - [@​inigomarquinez](https://redirect.github.com/inigomarquinez) made their first contribution in [https://github.com/expressjs/express/pull/5590](https://redirect.github.com/expressjs/express/pull/5590) - [@​mertcanaltin](https://redirect.github.com/mertcanaltin) made their first contribution in [https://github.com/expressjs/express/pull/5627](https://redirect.github.com/expressjs/express/pull/5627) - [@​ctcpip](https://redirect.github.com/ctcpip) made their first contribution in [https://github.com/expressjs/express/pull/5690](https://redirect.github.com/expressjs/express/pull/5690) - [@​IamLizu](https://redirect.github.com/IamLizu) made their first contribution in [https://github.com/expressjs/express/pull/5762](https://redirect.github.com/expressjs/express/pull/5762) - [@​almic](https://redirect.github.com/almic) made their first contribution in [https://github.com/expressjs/express/pull/5677](https://redirect.github.com/expressjs/express/pull/5677) - [@​carpasse](https://redirect.github.com/carpasse) made their first contribution in [https://github.com/expressjs/express/pull/5829](https://redirect.github.com/expressjs/express/pull/5829) - [@​bjohansebas](https://redirect.github.com/bjohansebas) made their first contribution in [https://github.com/expressjs/express/pull/5814](https://redirect.github.com/expressjs/express/pull/5814) - [@​RobinTail](https://redirect.github.com/RobinTail) made their first contribution in [https://github.com/expressjs/express/pull/5782](https://redirect.github.com/expressjs/express/pull/5782) **Full Changelog**: https://github.com/expressjs/express/compare/v5.0.0-beta.3...v5.0.0 #### What's Changed - 4.19.2 Staging by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5561](https://redirect.github.com/expressjs/express/pull/5561) - remove duplicate location test for data uri by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5562](https://redirect.github.com/expressjs/express/pull/5562) - feat: document beta releases expectations by [@​marco-ippolito](https://redirect.github.com/marco-ippolito) in [https://github.com/expressjs/express/pull/5565](https://redirect.github.com/expressjs/express/pull/5565) - Cut down on duplicated CI runs by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5564](https://redirect.github.com/expressjs/express/pull/5564) - Add a Threat Model by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5526](https://redirect.github.com/expressjs/express/pull/5526) - Assign captain of encodeurl by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5579](https://redirect.github.com/expressjs/express/pull/5579) - Nominate jonchurch as repo captain for `http-errors`, `expressjs.com`, `morgan`, `cors`, `body-parser` by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5587](https://redirect.github.com/expressjs/express/pull/5587) - docs: update Security.md by [@​inigomarquinez](https://redirect.github.com/inigomarquinez) in [https://github.com/expressjs/express/pull/5590](https://redirect.github.com/expressjs/express/pull/5590) - docs: update triage nomination policy by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5600](https://redirect.github.com/expressjs/express/pull/5600) - Add CodeQL (SAST) by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5433](https://redirect.github.com/expressjs/express/pull/5433) - docs: add UlisesGascon as triage initiative captain by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5605](https://redirect.github.com/expressjs/express/pull/5605) - Use object with null prototype for various app properties by [@​EvanHahn](https://redirect.github.com/EvanHahn) in [https://github.com/expressjs/express/pull/4861](https://redirect.github.com/expressjs/express/pull/4861) - deps: encodeurl@~2.0.0 by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5569](https://redirect.github.com/expressjs/express/pull/5569) - skip QUERY method test by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5628](https://redirect.github.com/expressjs/express/pull/5628) - ignore ETAG query test on 21 and 22, reuse skip util by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5639](https://redirect.github.com/expressjs/express/pull/5639) - add support Node.js@22 in the CI by [@​mertcanaltin](https://redirect.github.com/mertcanaltin) in [https://github.com/expressjs/express/pull/5627](https://redirect.github.com/expressjs/express/pull/5627) - doc: add table of contents, tc/triager lists to readme by [@​mertcanaltin](https://redirect.github.com/mertcanaltin) in [https://github.com/expressjs/express/pull/5619](https://redirect.github.com/expressjs/express/pull/5619) - List and sort all projects, add captains by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5653](https://redirect.github.com/expressjs/express/pull/5653) - Call callback once on listen error by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/3216](https://redirect.github.com/expressjs/express/pull/3216) - docs: add [@​UlisesGascon](https://redirect.github.com/UlisesGascon) as captain for cookie-parser by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5666](https://redirect.github.com/expressjs/express/pull/5666) - ✨ bring back query tests for node 21 by [@​ctcpip](https://redirect.github.com/ctcpip) in [https://github.com/expressjs/express/pull/5690](https://redirect.github.com/expressjs/express/pull/5690) - \[v4] Deprecate `res.clearCookie` accepting `options.maxAge` and `options.expires` by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5672](https://redirect.github.com/expressjs/express/pull/5672) - skip QUERY tests for Node 21 only, still not supported by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5695](https://redirect.github.com/expressjs/express/pull/5695) - 📝 update people, add ctcpip to TC by [@​ctcpip](https://redirect.github.com/ctcpip) in [https://github.com/expressjs/express/pull/5683](https://redirect.github.com/expressjs/express/pull/5683) - remove minor version pinning from ci by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5722](https://redirect.github.com/expressjs/express/pull/5722) - Fix link variable use in attribution section of CODE OF CONDUCT by [@​IamLizu](https://redirect.github.com/IamLizu) in [https://github.com/expressjs/express/pull/5762](https://redirect.github.com/expressjs/express/pull/5762) - Replace Appveyor windows testing with GHA by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5599](https://redirect.github.com/expressjs/express/pull/5599) - Add OSSF Scorecard badge by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5436](https://redirect.github.com/expressjs/express/pull/5436) - Throw on invalid status codes by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/4212](https://redirect.github.com/expressjs/express/pull/4212) - Use Array.flat instead of array-flatten by [@​almic](https://redirect.github.com/almic) in [https://github.com/expressjs/express/pull/5677](https://redirect.github.com/expressjs/express/pull/5677) - Adopt Node@18 as the minimum supported version by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5803](https://redirect.github.com/expressjs/express/pull/5803) - Ignore `expires` and `maxAge` in `res.clearCookie()` by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5792](https://redirect.github.com/expressjs/express/pull/5792) - send@1.0.0 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5786](https://redirect.github.com/expressjs/express/pull/5786) - chore: upgrade `debug` dep from 3.10 to 4.3.6 by [@​carpasse](https://redirect.github.com/carpasse) in [https://github.com/expressjs/express/pull/5829](https://redirect.github.com/expressjs/express/pull/5829) - refactor: replace 'path-is-absolute' dep with node:path isAbsolute method by [@​carpasse](https://redirect.github.com/carpasse) in [https://github.com/expressjs/express/pull/5830](https://redirect.github.com/expressjs/express/pull/5830) - update scorecard link by [@​bjohansebas](https://redirect.github.com/bjohansebas) in [https://github.com/expressjs/express/pull/5814](https://redirect.github.com/expressjs/express/pull/5814) - Nominate [@​IamLizu](https://redirect.github.com/IamLizu) to the triage team by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5836](https://redirect.github.com/expressjs/express/pull/5836) - deps: path-to-regexp@0.1.8 by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5603](https://redirect.github.com/expressjs/express/pull/5603) - docs: specify new instructions for `question` and `discuss` by [@​IamLizu](https://redirect.github.com/IamLizu) in [https://github.com/expressjs/express/pull/5835](https://redirect.github.com/expressjs/express/pull/5835) - 5.x: Upgrading `merge-descriptors` with allowing minors by [@​RobinTail](https://redirect.github.com/RobinTail) in [https://github.com/expressjs/express/pull/5782](https://redirect.github.com/expressjs/express/pull/5782) - 4.x: Upgrade `merge-descriptors` dependency by [@​RobinTail](https://redirect.github.com/RobinTail) in [https://github.com/expressjs/express/pull/5781](https://redirect.github.com/expressjs/express/pull/5781) - WIP: serve-static@2 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5790](https://redirect.github.com/expressjs/express/pull/5790) - chore: upgrade qs dp from 6.11.0 to 6.13.0 by [@​carpasse](https://redirect.github.com/carpasse) in [https://github.com/expressjs/express/pull/5847](https://redirect.github.com/expressjs/express/pull/5847) - Upgrade cookie signature by [@​IamLizu](https://redirect.github.com/IamLizu) in [https://github.com/expressjs/express/pull/5833](https://redirect.github.com/expressjs/express/pull/5833) - accepts@2 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5881](https://redirect.github.com/expressjs/express/pull/5881) - mime-types@3 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5882](https://redirect.github.com/expressjs/express/pull/5882) - type-is@^2.0.0 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5883](https://redirect.github.com/expressjs/express/pull/5883) - content-disposition@^1.0.0 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5884](https://redirect.github.com/expressjs/express/pull/5884) - fix(deps): finalhandler@^2.0.0 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5899](https://redirect.github.com/expressjs/express/pull/5899) - path-to-regexp@0.1.10 by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5902](https://redirect.github.com/expressjs/express/pull/5902) - update to `fresh@^2.0.0` by [@​jonchurch](https://redirect.github.com/jonchurch) in [https://github.com/expressjs/express/pull/5916](https://redirect.github.com/expressjs/express/pull/5916) - router@^2.0.0 by [@​wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5885](https://redirect.github.com/expressjs/express/pull/5885) - Adopt Node@18 as the minimum supported version by [@​UlisesGascon](https://redirect.github.com/UlisesGascon) in [https://github.com/expressjs/express/pull/5595](https://redirect.github.com/expressjs/express/pull/5595) - master -> 5.0 by [@​ctcpip](https://redirect.github.com/ctcpip) in [https://github.com/expressjs/express/pull/5785](https://redirect.github.com/expressjs/express/pull/5785) - 🔧 update CI, remove unsupported versions, clean up by [@​ctcpip](https://redirect.github.com/ctcpip) in [https://github.com/expressjs/express/pull/5931](https://redirect.github.com/expressjs/express/pull/5931) - Delete `back` as a magic string by [@​blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5933](https://redirect.github.com/expressjs/express/pull/5933) - Release 5.0 by [@​dougwilson](https://redirect.github.com/dougwilson) in [https://github.com/expressjs/express/pull/2237](https://redirect.github.com/expressjs/express/pull/2237) #### New Contributors - [@​marco-ippolito](https://redirect.github.com/marco-ippolito) made their first contribution in [https://github.com/expressjs/express/pull/5565](https://redirect.github.com/expressjs/express/pull/5565) - [@​inigomarquinez](https://redirect.github.com/inigomarquinez) made their first contribution in [https://github.com/expressjs/express/pull/5590](https://redirect.github.com/expressjs/express/pull/5590) - [@​mertcanaltin](https://redirect.github.com/mertcanaltin) made their first contribution in [https://github.com/expressjs/express/pull/5627](https://redirect.github.com/expressjs/express/pull/5627) - [@​ctcpip](https://redirect.github.com/ctcpip) made their first contribution in [https://github.com/expressjs/express/pull/5690](https://redirect.github.com/expressjs/express/pull/5690) - [@​IamLizu](https://redirect.github.com/IamLizu) made their first contribution in [https://github.com/expressjs/express/pull/5762](https://redirect.github.com/expressjs/express/pull/5762) - [@​almic](https://redirect.github.com/almic) made their first contribution in [https://github.com/expressjs/express/pull/5677](https://redirect.github.com/expressjs/express/pull/5677) - [@​carpasse](https://redirect.github.com/carpasse) made their first contribution in [https://github.com/expressjs/express/pull/5829](https://redirect.github.com/expressjs/express/pull/5829) - [@​bjohansebas](https://redirect.github.com/bjohansebas) made their first contribution in [https://github.com/expressjs/express/pull/5814](https://redirect.github.com/expressjs/express/pull/5814) - [@​RobinTail](https://redirect.github.com/RobinTail) made their first contribution in [https://github.com/expressjs/express/pull/5782](https://redirect.github.com/expressjs/express/pull/5782) **Full Changelog**: https://github.com/expressjs/express/compare/v5.0.0-beta.3...v5.0.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR was generated by Mend Renovate. View the repository job log.

socket-security[bot] commented 2 months ago

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@babel/preset-react@7.23.3 None +5 120 kB nicolo-ribaudo
npm/@rollup/plugin-babel@6.0.4 None +3 166 kB shellscape
npm/@rollup/plugin-commonjs@23.0.7 filesystem +9 923 kB shellscape
npm/@rollup/plugin-node-resolve@15.0.1 filesystem Transitive: environment, unsafe +11 431 kB shellscape
npm/@rollup/plugin-replace@5.0.7 None +5 716 kB shellscape
npm/@rollup/plugin-terser@0.2.0 eval 0 22 kB shellscape
npm/rollup@2.79.1 environment, filesystem, unsafe 0 6.7 MB lukastaegert

🚮 Removed packages: npm/express@5.0.0-beta.3

View full report↗︎