Skip to content

Bump express from 4.22.2 to 5.2.1#157

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/express-5.1.0
Closed

Bump express from 4.22.2 to 5.2.1#157
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/express-5.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 13, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps express from 4.22.2 to 5.2.1.

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

5.0.1 / 2024-10-08

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 13, 2025
@VirajAgarwal1 VirajAgarwal1 self-requested a review May 14, 2025 05:51
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/express-5.1.0 branch from 9dc594f to 5fba116 Compare May 14, 2025 10:26
@VirajAgarwal1

VirajAgarwal1 commented May 14, 2025 •
edited
Loading

Copy link
Copy Markdown

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github May 14, 2025

Copy link
Copy Markdown
Contributor Author

Looks like this PR is already up-to-date with master! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/express-5.1.0 branch from 5fba116 to 3a914f9 Compare May 15, 2025 05:43
@ejscribner

ejscribner commented May 28, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
Bump express from 4.22.2 to 5.2.1
908c67d 
Bumps [express](https://github.com/expressjs/express) from 4.22.2 to 5.2.1.
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v4.22.2...v5.2.1)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump express from 4.21.2 to 5.1.0 Bump express from 4.22.2 to 5.2.1 May 28, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/express-5.1.0 branch from 3a914f9 to 908c67d Compare May 28, 2026 00:20
@ejscribner

ejscribner commented May 28, 2026

Copy link
Copy Markdown
Contributor

Hey @dex-the-ai can you take a look at this and raise a new PR that handles this upgrade, and fixes issues with the tests?

@dex-the-ai dex-the-ai mentioned this pull request May 28, 2026
Merged
@dex-the-ai

dex-the-ai commented May 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

I reproduced the failure from this Dependabot branch: Express 5 is choking on the legacy catch-all route in src/app.js (app.get('*', ...)). I opened #169 with the same Express upgrade plus the route fix on a repo-owned branch so we can iterate on it and let CI re-run there. The replacement PR is green now.

@dependabot @github

dependabot Bot commented on behalf of github May 28, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #172.

@dependabot dependabot Bot closed this May 28, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/express-5.1.0 branch May 28, 2026 02:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@VirajAgarwal1 VirajAgarwal1 Awaiting requested review from VirajAgarwal1

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@VirajAgarwal1 @ejscribner @dex-the-ai