Bump the npm_and_yarn group across 6 directories with 29 updates

[dependabot]

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package	From	To
webpack	5.73.0	5.94.0
@babel/traverse	7.23.4	7.25.9
rollup	4.5.2	4.24.4
rollup	3.29.4	4.24.4
body-parser	1.19.2	1.20.3
express	4.17.3	4.21.1
braces	3.0.2	3.0.3
ejs	3.1.9	3.1.10
follow-redirects	1.15.1	1.15.9
micromatch	4.0.4	4.0.8
postcss	8.4.33	8.4.47
ws	8.13.0	8.18.0
ws	6.2.2	8.18.0
terser	5.27.0	5.36.0
tough-cookie	4.1.3	4.1.4
webpack-dev-middleware	6.1.1	6.1.3

Bumps the npm_and_yarn group with 4 updates in the /packages/cells directory: minimatch, braces, micromatch and word-wrap.
Bumps the npm_and_yarn group with 3 updates in the /packages/core directory: braces, micromatch and word-wrap.
Bumps the npm_and_yarn group with 4 updates in the /packages/source directory: minimatch, braces, micromatch and word-wrap.
Bumps the npm_and_yarn group with 20 updates in the /test-projects/cra5-gdg directory:

Package	From	To
webpack	5.70.0	5.96.1
semver	6.3.0	7.6.3
semver	7.3.5	7.6.3
core-js-compat	3.21.1	3.39.0
@babel/traverse	7.17.3	7.25.9
minimatch	3.0.4	3.1.2
recursive-readdir	2.2.2	2.2.3
rollup	2.70.1	2.79.2
async	2.6.3	2.6.4
body-parser	1.19.2	1.20.3
express	4.17.3	4.21.1
braces	3.0.2	3.0.3
ejs	3.1.6	3.1.10
follow-redirects	1.14.9	1.15.9
json5	1.0.1	1.0.2
micromatch	4.0.5	4.0.8
tough-cookie	4.0.0	4.1.4
webpack-dev-middleware	5.3.1	5.3.4
word-wrap	1.2.3	1.2.5
decode-uri-component	0.2.0	0.2.2
http-proxy-middleware	2.0.4	2.0.7

Bumps the npm_and_yarn group with 7 updates in the /test-projects/next-gdg directory:

Package	From	To
semver	7.3.5	7.6.3
semver	6.3.0	7.6.3
braces	3.0.2	3.0.3
json5	1.0.1	1.0.2
micromatch	4.0.5	4.0.8
postcss	8.4.5	8.4.31
next	12.1.0	15.0.2
word-wrap	1.2.3	1.2.5

Updates webpack from 5.73.0 to 5.94.0

Release notes

Sourced from webpack's releases.

v5.94.0

Bug Fixes

• Added runtime condition for harmony reexport checked
• Handle properly data/http/https protocols in source maps
• Make bigint optimistic when browserslist not found
• Move @​types/eslint-scope to dev deps
• Related in asset stats is now always an array when no related found
• Handle ASI for export declarations
• Mangle destruction incorrect with export named default properly
• Fixed unexpected asi generation with sequence expression
• Fixed a lot of types

New Features

• Added new external type "module-import"
• Support webpackIgnore for new URL() construction
• [CSS] @import pathinfo support

Security

• Fixed DOM clobbering in auto public path

v5.93.0

Bug Fixes

• Generate correct relative path to runtime chunks
• Makes DefinePlugin quieter under default log level
• Fixed mangle destructuring default in namespace import
• Fixed consumption of eager shared modules for module federation
• Strip slash for pretty regexp
• Calculate correct contenthash for CSS generator options

New Features

• Added the binary generator option for asset modules to explicitly keep source maps produced by loaders
• Added the modern-module library value for tree shakable output
• Added the overrideStrict option to override strict or non-strict mode for javascript modules

v5.92.1

Bug Fixes

• Doesn't crash with an error when the css experiment is enabled and contenthash is used

v5.92.0

Bug Fixes

• Correct tidle range's comutation for module federation
• Consider runtime for pure expression dependency update hash
• Return value in the subtractRuntime function for runtime logic

... (truncated)

Commits

• eabf85d chore(release): 5.94.0
• 955e057 security: fix DOM clobbering in auto public path
• 9822387 test: fix
• cbb86ed test: fix
• 5ac3d7f fix: unexpected asi generation with sequence expression
• 2411661 security: fix DOM clobbering in auto public path
• b8c03d4 fix: unexpected asi generation with sequence expression
• f46a03c revert: do not use heuristic fallback for "module-import"
• 60f1898 fix: do not use heuristic fallback for "module-import"
• 66306aa Revert "fix: module-import get fallback from externalsPresets"
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by evilebottnawi, a new releaser for webpack since your current version.

Updates @babel/traverse from 7.23.4 to 7.25.9

Release notes

Sourced from @​babel/traverse's releases.

v7.25.9 (2024-10-22)

Thanks @​victorenator for your first PR!

🐛 Bug Fix

• babel-parser, babel-template, babel-types
  • #16905 fix: Keep type annotations in syntacticPlaceholders mode (@​liuxingbaoyu)
• babel-helper-compilation-targets, babel-preset-env
  • #16907 fix: support BROWSERSLIST{,_CONFIG} env (@​JLHwung)
• Other
  • #16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@​victorenator)

🏠 Internal

• babel-helper-transform-fixture-test-runner
  • #16914 remove test options flaky (@​JLHwung)
• Every package
  • #16917 fix: Accidentally published tsconfig files (@​liuxingbaoyu)

🏃‍♀️ Performance

• babel-parser, babel-types
  • #16918 perf: Make VISITOR_KEYS etc. faster to access (@​liuxingbaoyu)

Committers: 4

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• Viktar Vaŭčkievič (@​victorenator)
• @​liuxingbaoyu

v7.25.8 (2024-10-10)

🐛 Bug Fix

• babel-core
  • #16888 Restore public API of resolvePlugin/resolvePreset (@​nicolo-ribaudo)

🏠 Internal

• babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env
  • #16824 Inline one-line syntax plugins (@​nicolo-ribaudo)

Committers: 3

• Babel Bot (@​babel-bot)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu

v7.25.7 (2024-10-02)

Thanks @​DylanPiercey and @​YuHyeonWook for your first PRs!

🐛 Bug Fix

• babel-helper-validator-identifier
  • #16825 fix: update identifier to unicode 16 (@​JLHwung)

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

v7.25.9 (2024-10-22)

🐛 Bug Fix

• babel-parser, babel-template, babel-types
  • #16905 fix: Keep type annotations in syntacticPlaceholders mode (@​liuxingbaoyu)
• babel-helper-compilation-targets, babel-preset-env
  • #16907 fix: support BROWSERSLIST{,_CONFIG} env (@​JLHwung)
• Other
  • #16884 Analyze ClassAccessorProperty to prevent the no-undef rule (@​victorenator)

🏠 Internal

• babel-helper-transform-fixture-test-runner
  • #16914 remove test options flaky (@​JLHwung)

🏃‍♀️ Performance

• babel-parser, babel-types
  • #16918 perf: Make VISITOR_KEYS etc. faster to access (@​liuxingbaoyu)

v7.25.8 (2024-10-10)

🐛 Bug Fix

• babel-core
  • #16888 Restore public API of resolvePlugin/resolvePreset (@​nicolo-ribaudo)

🏠 Internal

• babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env
  • #16824 Inline one-line syntax plugins (@​nicolo-ribaudo)

v7.25.7 (2024-10-02)

🐛 Bug Fix

• babel-helper-validator-identifier
  • #16825 fix: update identifier to unicode 16 (@​JLHwung)
• babel-traverse
  • #16814 fix: issue with node path keys updated on unrelated paths (@​DylanPiercey)
• babel-plugin-transform-classes
  • #16797 Use an inclusion rather than exclusion list for super() check (@​nicolo-ribaudo)
• babel-generator
  • #16788 Fix printing of TS infer in compact mode (@​nicolo-ribaudo)
  • #16785 Print TS type annotations for destructuring in assignment pattern (@​nicolo-ribaudo)
  • #16778 Respect [no LineTerminator here] after nodes (@​nicolo-ribaudo)

💅 Polish

• babel-types
  • #16852 Add deprecated JSDOC for fields (@​liuxingbaoyu)

🏠 Internal

• babel-core
  • #16820 Allow sync loading of ESM when --experimental-require-module (@​nicolo-ribaudo)
• babel-helper-compilation-targets, babel-helper-plugin-utils, babel-preset-env
  • #16858 Add browserslist config to external dependency (@​JLHwung)
• babel-plugin-proposal-destructuring-private, babel-plugin-syntax-decimal, babel-plugin-syntax-import-reflection, babel-standalone

... (truncated)

Commits

• b07957e v7.25.9
• af91759 fix: Accidentally publishing useless files (#16917)
• 2533cfb v7.25.7
• 611d958 [babel 8] Create TSClassImplements|TSInterfaceHeritage nodes (#16731)
• 506bf91 Remove BABEL_TYPES_8_BREAKING flag and enable it by default (#16817)
• 9e14f7d chore: Enable more lint rules (#16827)
• e69a7e5 fix: issue with node path keys updated on unrelated paths (#16814)
• 7467c9d [Babel 8] Remove some Scope methods (#16705)
• 0a55713 [Babel 8] Remove DecimalLiteral AST (#16807)
• 69d65f1 [babel 8] Require Node.js ^18.20.0 || ^20.17.0 || >=22.8.0 (#16800)
• Additional commits viewable in compare view

Updates rollup from 4.5.2 to 4.24.4

Release notes

Sourced from rollup's releases.

v4.24.4

4.24.4

2024-11-04

Bug Fixes

• Ensure mutations by handlers in Proxy definitions are always respected when tree-shaking (#5713)

Pull Requests

• #5708: Update configuration-options document (@​sacru2red, @​lukastaegert)
• #5711: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #5713: fix: Deoptimize the proxied object if its property is reassigned in the handler functions (@​TrickyPi)

v4.24.3

4.24.3

2024-10-29

Bug Fixes

• Slightly reduce memory consumption by specifying fixed array sizes where possible (#5703)

Pull Requests

• #5703: perf: use pre-allocated arrays for known result sizes (@​GalacticHypernova)

v4.24.2

4.24.2

2024-10-27

Bug Fixes

• Add missing build dependency (#5705)

Pull Requests

• #5705: Fix "Couldn't find package" error when installing rollup using yarn (@​tagattie)

v4.24.1

4.24.1

2024-10-27

Bug Fixes

• Support running Rollup natively on FreeBSD (#5698)

... (truncated)

Changelog

Sourced from rollup's changelog.

4.24.4

2024-11-04

Bug Fixes

• Ensure mutations by handlers in Proxy definitions are always respected when tree-shaking (#5713)

Pull Requests

• #5708: Update configuration-options document (@​sacru2red, @​lukastaegert)
• #5711: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #5713: fix: Deoptimize the proxied object if its property is reassigned in the handler functions (@​TrickyPi)

4.24.3

2024-10-29

Bug Fixes

• Slightly reduce memory consumption by specifying fixed array sizes where possible (#5703)

Pull Requests

• #5703: perf: use pre-allocated arrays for known result sizes (@​GalacticHypernova)

4.24.2

2024-10-27

Bug Fixes

• Add missing build dependency (#5705)

Pull Requests

• #5705: Fix "Couldn't find package" error when installing rollup using yarn (@​tagattie)

4.24.1

2024-10-27

Bug Fixes

• Support running Rollup natively on FreeBSD (#5698)

Pull Requests

• #5689: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #5690: chore(deps): update dependency @​inquirer/prompts to v7 (@​renovate[bot])

... (truncated)

Commits

• cdf34ab 4.24.4
• daa6db8 Update configuration-options document (#5708)
• 0776b4e fix: Deoptimize the proxied object if its property is reassigned in the handl...
• d8d6f5a chore(deps): lock file maintenance minor/patch updates (#5711)
• 69353a8 4.24.3
• 4c5cc76 perf: use pre-allocated arrays for known result sizes (#5703)
• 8cc07f9 Refine performance report
• 32d0e7d 4.24.2
• 85226fd Fix "Couldn't find package" error when installing rollup using yarn (#5705)
• 88a54d8 4.24.1
• Additional commits viewable in compare view

Updates rollup from 3.29.4 to 4.24.4

Release notes

Sourced from rollup's releases.

v4.24.4

4.24.4

2024-11-04

Bug Fixes

• Ensure mutations by handlers in Proxy definitions are always respected when tree-shaking (#5713)

Pull Requests

• #5708: Update configuration-options document (@​sacru2red, @​lukastaegert)
• #5711: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #5713: fix: Deoptimize the proxied object if its property is reassigned in the handler functions (@​TrickyPi)

v4.24.3

4.24.3

2024-10-29

Bug Fixes

• Slightly reduce memory consumption by specifying fixed array sizes where possible (#5703)

Pull Requests

• #5703: perf: use pre-allocated arrays for known result sizes (@​GalacticHypernova)

v4.24.2

4.24.2

2024-10-27

Bug Fixes

• Add missing build dependency (#5705)

Pull Requests

• #5705: Fix "Couldn't find package" error when installing rollup using yarn (@​tagattie)

v4.24.1

4.24.1

2024-10-27

Bug Fixes

• Support running Rollup natively on FreeBSD (#5698)

... (truncated)

Changelog

Sourced from rollup's changelog.

4.24.4

2024-11-04

Bug Fixes

• Ensure mutations by handlers in Proxy definitions are always respected when tree-shaking (#5713)

Pull Requests

• #5708: Update configuration-options document (@​sacru2red, @​lukastaegert)
• #5711: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #5713: fix: Deoptimize the proxied object if its property is reassigned in the handler functions (@​TrickyPi)

4.24.3

2024-10-29

Bug Fixes

• Slightly reduce memory consumption by specifying fixed array sizes where possible (#5703)

Pull Requests

• #5703: perf: use pre-allocated arrays for known result sizes (@​GalacticHypernova)

4.24.2

2024-10-27

Bug Fixes

• Add missing build dependency (#5705)

Pull Requests

• #5705: Fix "Couldn't find package" error when installing rollup using yarn (@​tagattie)

4.24.1

2024-10-27

Bug Fixes

• Support running Rollup natively on FreeBSD (#5698)

Pull Requests

• #5689: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #5690: chore(deps): update dependency @​inquirer/prompts to v7 (@​renovate[bot])

... (truncated)

Commits

• cdf34ab 4.24.4
• daa6db8 Update configuration-options document (#5708)
• 0776b4e fix: Deoptimize the proxied object if its property is reassigned in the handl...
• d8d6f5a chore(deps): lock file maintenance minor/patch updates (#5711)
• 69353a8 4.24.3
• 4c5cc76 perf: use pre-allocated arrays for known result sizes (#5703)
• 8cc07f9 Refine performance report
• 32d0e7d 4.24.2
• 85226fd Fix "Couldn't find package" error when installing rollup using yarn (#5705)
• 88a54d8 4.24.1
• Additional commits viewable in compare view

Updates body-parser from 1.19.2 to 1.20.3

Release notes

Sourced from body-parser's releases.

1.20.3

What's Changed

Important

• deps: [email protected]
• add depth option to customize the depth level in the parser
• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

• chore: add support for OSSF scorecard reporting by @​inigomarquinez in expressjs/body-parser#522
• ci: fix errors in ci github action for node 8 and 9 by @​inigomarquinez in expressjs/body-parser#523
• fix: pin to [email protected] by @​wesleytodd in expressjs/body-parser#527
• deps: [email protected] by @​melikhov-dev in expressjs/body-parser#521
• Add OSSF Scorecard badge by @​bjohansebas in expressjs/body-parser#531
• Linter by @​UlisesGascon in expressjs/body-parser#534
• Release: 1.20.3 by @​UlisesGascon in expressjs/body-parser#535

New Contributors

• @​inigomarquinez made their first contribution in expressjs/body-parser#522
• @​melikhov-dev made their first contribution in expressjs/body-parser#521
• @​bjohansebas made their first contribution in expressjs/body-parser#531
• @​UlisesGascon made their first contribution in expressjs/body-parser#534

Full Changelog: expressjs/body-parser@1.20.2...1.20.3

1.20.2

• Fix strict json error message on Node.js 19+
• deps: content-type@~1.0.5
  • perf: skip value escaping when unnecessary
• deps: [email protected]

1.20.1

• deps: [email protected]
• perf: remove unnecessary object clone

1.20.0

• Fix error message for json parse whitespace in strict
• Fix internal error when inflated body exceeds limit
• Prevent loss of async hooks context
• Prevent hanging when request already read
• deps: [email protected]
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: [email protected]
  • deps: [email protected]
  • deps: [email protected]
• deps: [email protected]
• deps: [email protected]

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.3 / 2024-09-10

• deps: [email protected]
• add depth option to customize the depth level in the parser
• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

1.20.2 / 2023-02-21

• Fix strict json error message on Node.js 19+
• deps: content-type@~1.0.5
  • perf: skip value escaping when unnecessary
• deps: [email protected]

1.20.1 / 2022-10-06

• deps: [email protected]
• perf: remove unnecessary object clone

1.20.0 / 2022-04-02

• Fix error message for json parse whitespace in strict
• Fix internal error when inflated body exceeds limit
• Prevent loss of async hooks context
• Prevent hanging when request already read
• deps: [email protected]
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: [email protected]
  • deps: [email protected]
  • deps: [email protected]
• deps: [email protected]
• deps: [email protected]
• deps: [email protected]
  • deps: [email protected]

Commits

• 1752951 1.20.3
• 39744cf chore: linter (#534)
• b2695c4 Merge commit from fork
• ade0f3f add scorecard to readme (#531)
• 99a1bd6 deps: [email protected] (#521)
• 9478591 fix: pin to [email protected]
• 83db46a ci: fix errors in ci github action for node 8 and 9 (#523)
• 9d4e212 chore: add support for OSSF scorecard reporting (#522)
• ee91374 1.20.2
• 368a93a Fix strict json error message on Node.js 19+
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.

Updates express from 4.17.3 to 4.21.1

Release notes

Sourced from express's releases.

4.21.1

What's Changed

• Backport a fix for CVE-2024-47764 to the 4.x branch by @​joshbuker in expressjs/express#6029
• Release: 4.21.1 by @​UlisesGascon in expressjs/express#6031

Full Changelog: expressjs/express@4.21.0...4.21.1

4.21.0

What's Changed

• Deprecate "back" magic string in redirects by @​blakeembrey in expressjs/express#5935
• [email protected] by @​wesleytodd in expressjs/express#5954
• fix(deps): [email protected] by @​wesleytodd in expressjs/express#5951
• Upgraded dependency qs to 6.13.0 to match qs in body-parser by @​agadzinski93 in expressjs/express#5946

New Contributors

• @​agadzinski93 made their first contribution in expressjs/express#5946

Full Changelog: expressjs/express@4.20.0...4.21.0

4.20.0

What's Changed

Important

• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
• Remove link renderization in html while using res.redirect

Other Changes

• 4.19.2 Staging by @​wesleytodd in expressjs/express#5561
• remove duplicate location test for data uri by @​wesleytodd in expressjs/express#5562
• feat: document beta releases expectations by @​marco-ippolito in expressjs/express#5565
• Cut down on duplicated CI runs by @​jonchurch in expressjs/express#5564
• Add a Threat Model by @​UlisesGascon in expressjs/express#5526
• Assign captain of encodeurl by @​blakeembrey in expressjs/express#5579
• Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @​jonchurch in expressjs/express#5587
• docs: update Security.md by @​inigomarquinez in expressjs/express#5590
• docs: update triage nomination policy by @​UlisesGascon in expressjs/express#5600
• Add CodeQL (SAST) by @​UlisesGascon in expressjs/express#5433
• docs: add UlisesGascon as triage initiative captain by @​UlisesGascon in expressjs/express#5605
• deps: encodeurl@~2.0.0 by @​blakeembrey in expressjs/express#5569
• skip QUERY method test by @​jonchurch in expressjs/express#5628
• ignore ETAG query test on 21 and 22, reuse skip util by @​jonchurch in expressjs/express#5639
• add support Node.js@22 in the CI by @​mertcanaltin in expressjs/express#5627
• doc: add table of contents, tc/triager lists to readme by @​mertcanaltin in expressjs/express#5619
• List and sort all projects, add captains by @​blakeembrey in expressjs/express#5653
• docs: add @​UlisesGascon as captain for cookie-parser by @​UlisesGascon in expressjs/express#5666
• ✨ bring back query tests for node 21 by @​ctcpip in expressjs/express#5690
• [v4] Deprecate res.clearCookie accepting options.maxAge and options.expires by @​jonchurch in expressjs/express#5672
• skip QUERY tests for Node 21 only, still not supported by @​jonchurch in expressjs/express#5695

... (truncated)

Changelog

Sourced from express's changelog.

4.21.1 / 2024-10-08

• Backported a fix for CVE-2024-47764

4.21.0 / 2024-09-11

• Deprecate res.location("back") and res.redirect("back") magic string
• deps: [email protected]
  • includes [email protected]
• deps: [email protected]
• deps: [email protected]

4.20.0 / 2024-09-10

• deps: [email protected]
  • Remove link renderization in html while redirecting
• deps: [email protected]
  • Remove link renderization in html while redirecting
• deps: [email protected]
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
• Remove link renderization in html while using res.redirect
• deps: [email protected]
  • Adds support for named matching groups in the routes using a regex
  • Adds backtracking protection to parameters without regexes defined
• deps: encodeurl@~2.0.0
  • Removes encoding of \, |, and ^ to align better with URL spec
• Deprecate passing options.maxAge and options.expires to res.clearCookie
  • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

• Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

• Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

• Prevent open redirect allow list bypass due to encodeurl
• deps: [email protected]

4.18.3 / 2024-02-29

... (truncated)

Commits

• 8e229f9 4.21.1
• a024c8a fix(deps): [email protected]
• 7e562c6 4.21.0
• 1bcde96 fix(deps): [email protected] (#5946)
• 7d36477 fix(deps): [email protected] (#5951)
• 40d2d8f fix(deps): [email protected]
• 77ada90 Deprecate "back" magic string in redirects (#5935)
• 21df421 4.20.0
• 4c9ddc1 feat: upgrade to [email protected]
• 9ebe5d5 feat: upgrade to [email protected] (#5928)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express since your current version.

Updates braces from 3.0.2 to 3.0.3

Commits

• 74b2db2 3.0.3
• 88f1429 update eslint. lint, fix unit tests.
• 415d660 Snyk js braces 6838727 (#40)
• 190510f fix tests, skip 1 test in test/braces.expand
• 716eb9f readme bump
• a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
• 2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
• 9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
• 98414f9 remove funding file
• 665ab5d update keepEscaping doc (#27)
• Additional commits viewable in compare view

Updates cookie from 0.4.2 to 0.7.1

Release notes

Sourced from cookie's releases.

0.7.1

Fixed

• Allow leading dot for domain (#174)
  • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
• Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)

jshttp/cookie@v0.7.0...v0.7.1

0.7.0

• perf: parse cookies ~10% faster (#144 by @​kurtextrem and #170)
• fix: narrow the validation of cookies to match RFC6265 (#167 by @​bewinsnw)
• fix: add main to package.json for rspack (#166 by @​proudparrot2)

jshttp/cookie@v0.6.0...v0.7.0

0.6.0

• Add partitioned option

0.5.0

• Add priority option
• Fix expires option to reject invalid dates
• pref: improve default decode speed
• pref: remove slow string split in parse

Commits

• cf4658f 0.7.1
• 6a8b8f5 Allow leading dot for domain (#174)
• 58015c0 Remove more code and perf wins (#172)
• ab057d6 0.7.0
• 5f02ca8 Migrate history to GitHub releases
• a5d591c Migrate history to GitHub releases
• 51968f9 Skip isNaN
• 9e7ca51 perf(parse): cache length, return early (#144)
• d6f39b0 Fix tests for old node
• 6bb701f Remove failing scorecard
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from