Skip to content

chore(deps): bump express from 4.22.2 to 5.2.1 - #240

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/express-5.2.1
Closed

chore(deps): bump express from 4.22.2 to 5.2.1#240
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/express-5.2.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps express from 4.22.2 to 5.2.1.

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

5.0.1 / 2024-10-08

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 14, 2026
@dependabot dependabot Bot mentioned this pull request May 14, 2026
Closed
@ejscribner

ejscribner commented Sep 29, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
chore(deps): bump express from 4.22.2 to 5.2.1
9578d42 
Bumps [express](https://github.com/expressjs/express) from 4.22.2 to 5.2.1.
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v4.22.2...v5.2.1)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump express from 4.22.1 to 5.2.1 chore(deps): bump express from 4.22.2 to 5.2.1 Sep 29, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/express-5.2.1 branch from d884ba7 to 9578d42 Compare September 29, 2026 16:28
@dex-the-ai dex-the-ai mentioned this pull request Sep 29, 2026
Merged
dex-the-ai added a commit that referenced this pull request Sep 29, 2026
@dex-the-ai @claude
chore(deps): update express to 5.2.1 and refresh transitive deps
3b0d033 
Consolidates the open Dependabot updates into this PR:
- express ^4.22.2 -> ^5.2.1 (supersedes #240, #256; overlaps #252)
- transitive refresh via npm update: qs 6.16.0, tar 7.5.22,
  brace-expansion 1.1.21 / 2.1.7 / 5.0.12, body-parser 2.3.0 via
  express 5 (supersedes #253, #254, #255)
- Express 5 / path-to-regexp v8: catch-all route '*' -> '/{*splat}'
- add a test covering the catch-all 404 route

Lockfile kept at v2 and regenerated with npm 10.8.2 on Node 20.20.2.
Babel 8 (#239) is still out: it needs Node ^22.18 || >=24.11 and
the repo stays on Node 20.

Hermes task: t_5e4f3c90

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ejscribner

ejscribner commented Sep 29, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Looks like express is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 29, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/express-5.2.1 branch September 29, 2026 21:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ejscribner ejscribner Awaiting requested review from ejscribner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ejscribner