Skip to content

Bump express and @types/express#15050

Merged
JamieB-gu merged 1 commit intomainfrom
dependabot/npm_and_yarn/multi-b251156d90
Jan 22, 2026
Merged

Bump express and @types/express#15050
JamieB-gu merged 1 commit intomainfrom
dependabot/npm_and_yarn/multi-b251156d90

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 19, 2025

Bumps express and @types/express. These dependencies needed to be updated together.
Updates express from 5.1.0 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
Commits

Updates @types/express from 5.0.1 to 5.0.6

Commits

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Dec 19, 2025
@dependabot dependabot bot requested a review from a team as a code owner December 19, 2025 18:47
@dependabot dependabot bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Dec 19, 2025
@github-actions
Copy link

Hello 👋! When you're ready to run Chromatic, please apply the run_chromatic label to this PR.

You will need to reapply the label each time you want to run Chromatic.

Click here to see the Chromatic project.

@github-actions
Copy link

github-actions bot commented Dec 19, 2025

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/multi-b251156d90 branch from 1295243 to feff84c Compare January 6, 2026 16:10
@github-actions
Copy link

github-actions bot commented Jan 6, 2026

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/multi-b251156d90 branch from feff84c to fbb8d40 Compare January 14, 2026 11:16
@JamieB-gu
Copy link
Contributor

@dependabot rebase

Bumps [express](https://github.com/expressjs/express) and [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express). These dependencies needed to be updated together.

Updates `express` from 5.1.0 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.1.0...v5.2.1)

Updates `@types/express` from 5.0.1 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/multi-b251156d90 branch from fbb8d40 to 80934e6 Compare January 22, 2026 13:36
@JamieB-gu JamieB-gu added the run_chromatic Runs chromatic when label is applied label Jan 22, 2026
@github-actions github-actions bot removed the run_chromatic Runs chromatic when label is applied label Jan 22, 2026
@JamieB-gu JamieB-gu merged commit 6409761 into main Jan 22, 2026
33 checks passed
@JamieB-gu JamieB-gu deleted the dependabot/npm_and_yarn/multi-b251156d90 branch January 22, 2026 13:57
@gu-prout
Copy link

gu-prout bot commented Jan 22, 2026

Seen on PROD (created by @dependabot[bot] and merged by @JamieB-gu 15 minutes and 17 seconds ago) Please check your changes!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code Seen-on-PROD

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant