[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
morgan	1.10.1 → 1.12.1

---

Release Notes

expressjs/morgan (morgan)

v1.12.1

Compare Source

======

• Security fix for CVE-2026-87859(GHSA-9f6g-j8ch-79g4)

v1.12.0

Compare Source

======

• Security fix for CVE-2026-15603(GHSA-jxfw-x594-9x9m)
• Allow format functions to return objects for streams in objectMode
• Respect the NO_COLOR environment variable in the dev format

v1.11.0

Compare Source

======

• add :pid token

Security Fix:

• Escape control characters in :remote-user token to prevent log injection
  • Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.