chore: bump express from 4.18.2 to 4.19.2 #1033

dependabot · 2024-03-29T09:09:04Z

Bumps express from 4.18.2 to 4.19.2.

Release notes

4.19.2

What's Changed

Improved fix for open redirect allow list bypass

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

Fix ci after location patch by @wesleytodd in expressjs/express#5552

fixed un-edited version in history.md for 4.19.0 by @wesleytodd in expressjs/express#5556

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

fix typo in release date by @UlisesGascon in expressjs/express#5527

docs: nominating @wesleytodd to be project captian by @wesleytodd in expressjs/express#5511

docs: loosen TC activity rules by @wesleytodd in expressjs/express#5510

Add note on how to update docs for new release by @crandmck in expressjs/express#5541

Prevent open redirect allow list bypass due to encodeurl

Release 4.19.0 by @wesleytodd in expressjs/express#5551

New Contributors

@crandmck made their first contribution in expressjs/express#5541

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

Fix routing requests without method

deps: body-parser@1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: raw-body@2.5.2

Other Changes

Use https: protocol instead of deprecated git: protocol by @vcsjones in expressjs/express#5032

build: Node.js@16.18 and Node.js@18.12 by @abenhamdine in expressjs/express#5034

ci: update actions/checkout to v3 by @armujahid in expressjs/express#5027

test: remove unused function arguments in params by @raksbisht in expressjs/express#5124

Remove unused originalIndex from acceptParams by @raksbisht in expressjs/express#5119

Fixed typos by @raksbisht in expressjs/express#5117

examples: remove unused params by @raksbisht in expressjs/express#5113

fix: parameter str is not described in JSDoc by @raksbisht in expressjs/express#5130

fix: typos in History.md by @raksbisht in expressjs/express#5131

build : add Node.js@19.7 by @abenhamdine in expressjs/express#5028

test: remove unused function arguments in params by @raksbisht in expressjs/express#5137

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: cookie@0.6.0

4.18.3 / 2024-02-29

Fix routing requests without method

deps: body-parser@1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: raw-body@2.5.2

deps: cookie@0.6.0

Add partitioned option

Commits

04bc627 4.19.2
da4d763 Improved fix for open redirect allow list bypass
4f0f6cc 4.19.1
a003cfa Allow passing non-strings to res.location with new encoding handling checks f...
a1fa90f fixed un-edited version in history.md for 4.19.0
11f2b1d build: fix build due to inconsistent supertest behavior in older versions
084e365 4.19.0
0867302 Prevent open redirect allow list bypass due to encodeurl
567c9c6 Add note on how to update docs for new release (#5541)
69a4cf2 deps: cookie@0.6.0
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

no qa required

Bumps [express](https://github.com/expressjs/express) from 4.18.2 to 4.19.2. - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.18.2...4.19.2) --- updated-dependencies: - dependency-name: express dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | [`4.8.5` -> `4.9.0`](https://renovatebot.com/diffs/npm/@axe-core%2fplaywright/4.8.5/4.9.0) | [![age](https://developer.mend.io/api/mc/badges/age/npm/@axe-core%2fplaywright/4.9.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@axe-core%2fplaywright/4.9.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@axe-core%2fplaywright/4.8.5/4.9.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@axe-core%2fplaywright/4.8.5/4.9.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>dequelabs/axe-core-npm (@axe-core/playwright)</summary> ### [`v4.9.0`](https://github.com/dequelabs/axe-core-npm/releases/tag/v4.9.0): Release 4.9.0 [Compare Source](https://github.com/dequelabs/axe-core-npm/compare/v4.8.5...v4.9.0) #### What's Changed - docs(react): Update React support information by [@ballendq](https://github.com/ballendq) in [dequelabs/axe-core-npm#1004 - chore: merge master into develop by [@github-actions](https://github.com/github-actions) in [dequelabs/axe-core-npm#1016 - chore: bump husky from 8.0.3 to 9.0.10 by [@dependabot](https://github.com/dependabot) in [dequelabs/axe-core-npm#1006 - chore: remove circleci badge by [@michael-siek](https://github.com/michael-siek) in [dequelabs/axe-core-npm#1020 - chore: update `@wdio` dep and chromedriver by [@michael-siek](https://github.com/michael-siek) in [dequelabs/axe-core-npm#1029 - chore: bump express from 4.18.2 to 4.19.2 by [@dependabot](https://github.com/dependabot) in [dequelabs/axe-core-npm#1033 - chore: bump undici from 5.24.0 to 5.28.3 by [@dependabot](https://github.com/dependabot) in [dequelabs/axe-core-npm#1022 - chore: bump follow-redirects from 1.15.5 to 1.15.6 by [@dependabot](https://github.com/dependabot) in [dequelabs/axe-core-npm#1026 - ci: use `PAT` instead of GitHub Token when updating axe-core by [@michael-siek](https://github.com/michael-siek) in [dequelabs/axe-core-npm#1030 - feat: Update axe-core to v4.9.0 by [@github-actions](https://github.com/github-actions) in [dequelabs/axe-core-npm#1028 - fix: get correct new window handle with Selenium 3 workaround by [@scottmries](https://github.com/scottmries) in [dequelabs/axe-core-npm#1031 - chore: RC v4.9.0 by [@github-actions](https://github.com/github-actions) in [dequelabs/axe-core-npm#1036 - Release v4.9.0 by [@dequejenn](https://github.com/dequejenn) in [dequelabs/axe-core-npm#1040 #### New Contributors - [@ballendq](https://github.com/ballendq) made their first contribution in [dequelabs/axe-core-npm#1004 - [@scottmries](https://github.com/scottmries) made their first contribution in [dequelabs/axe-core-npm#1031 **Full Changelog**: dequelabs/axe-core-npm@v4.8.5...v4.9.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 10pm every weekday,before 6am every weekday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/camunda/zeebe).

dependabot bot requested a review from a team as a code owner March 29, 2024 09:09

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 29, 2024

Merge branch 'develop' into dependabot/npm_and_yarn/express-4.19.2

517a82a

michael-siek approved these changes Mar 30, 2024

View reviewed changes

michael-siek enabled auto-merge (squash) March 30, 2024 14:41

michael-siek merged commit 000205e into develop Mar 30, 2024
31 of 32 checks passed

michael-siek deleted the dependabot/npm_and_yarn/express-4.19.2 branch March 30, 2024 14:45

data-sync-user mentioned this pull request Jun 3, 2024

Bump @axe-core/react from 4.8.5 to 4.9.0 MozillaFoundation/foundation.mozilla.org#12152

Merged

gurudeep9 mentioned this pull request Jun 23, 2024

[Snyk] Upgrade @axe-core/playwright from 4.9.0 to 4.9.1 gurudeep9/mattermost-test#3

Open

aravindb26 mentioned this pull request Jul 16, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.8.2 to 4.9.1 aravindb26/spark#1

Open

Iir00d mentioned this pull request Jul 17, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.7.3 to 4.9.1 Iir00d/spark#1

Open

n1ghtmar3-6251 mentioned this pull request Jul 17, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.7.3 to 4.9.1 n1ghtmar3-6251/spark#1

Open

cbirdaha mentioned this pull request Jul 20, 2024

[Snyk] Upgrade @axe-core/playwright from 4.7.3 to 4.9.1 cbirdaha/PRfail82930#5

Open

aravindb26 mentioned this pull request Jul 22, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.8.2 to 4.9.1 aravindb26/spark#4

Open

Iir00d mentioned this pull request Jul 23, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.7.3 to 4.9.1 Iir00d/spark#5

Open

n1ghtmar3-6251 mentioned this pull request Jul 23, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.7.3 to 4.9.1 n1ghtmar3-6251/spark#5

Open

This was referenced Sep 8, 2024

[Snyk] Upgrade: , hackme252/spark#2

Open

[Snyk] Upgrade: , hackme252/spark#3

Open

[Snyk] Upgrade: , hackme252/spark#4

Open

[Snyk] Upgrade: , hackme252/spark#5

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump express from 4.18.2 to 4.19.2 #1033

chore: bump express from 4.18.2 to 4.19.2 #1033

dependabot bot commented on behalf of github Mar 29, 2024 •

edited by michael-siek

Loading

chore: bump express from 4.18.2 to 4.19.2 #1033

chore: bump express from 4.18.2 to 4.19.2 #1033

Conversation

dependabot bot commented on behalf of github Mar 29, 2024 • edited by michael-siek Loading

4.19.2

What's Changed

4.19.1

What's Changed

4.19.0

What's Changed

New Contributors

4.18.3

Main Changes

Other Changes

4.19.2 / 2024-03-25

4.19.1 / 2024-03-20

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

dependabot bot commented on behalf of github Mar 29, 2024 •

edited by michael-siek

Loading