This repository was archived by the owner on Jun 24, 2025. It is now read-only.
fix(deps): update dependency express to v5#1888
Merged
eliandoran merged 7 commits intodevelopfrom Jun 7, 2025
Merged
Conversation
|
renovate
Bot
force-pushed
the
renovate/express-5.x
branch
3 times, most recently
from
fadbe2e to
22b7afc
Compare
renovate
Bot
force-pushed
the
renovate/express-5.x
branch
9 times, most recently
from
0e4891f to
26e318d
Compare
renovate
Bot
force-pushed
the
renovate/express-5.x
branch
6 times, most recently
from
9191c0a to
9daa0dc
Compare
renovate
Bot
force-pushed
the
renovate/express-5.x
branch
3 times, most recently
from
ce3495c to
a60610a
Compare
renovate
Bot
force-pushed
the
renovate/express-5.x
branch
2 times, most recently
from
ea882a6 to
2093366
Compare
renovate
Bot
force-pushed
the
renovate/express-5.x
branch
15 times, most recently
from
e567ee5 to
e9adbbd
Compare
renovate
Bot
force-pushed
the
renovate/express-5.x
branch
from
e9adbbd to
086bd10
Compare
…value*"
the updateOption function that handles the req.param is just destructuring `const { name, value } = req.params;` and does nothing else with the path or any params.
The remaining parts of the wildcard (which can be accessed via req.param[0]) are just ignored here.
even with express v4, this would *always* just take and process the very first part of the path, in the exact wildcard's place, e.g.
`/api/options/locale/de` and
`/api/options/locale/de/test/whatever`
would *both* end up destructuring "value" from req.param as "de" (because it is in the exact place of the 'value' wildcard)
in express v5 the wildcard behaviour changes -> here req.param.value would return an array with the paths split into separate string.
but since the code previously regarded only the first part of the path -> we can just get rid of the wildcard and use a named route param
the only thing to keep in mind: if a request with more than one "value" is received, (e.g. `/api/options/locale/de/test/whatever`) -> since we don't have the wildcard anymore -> this will turn to a 404.
IMHO that is actually desirable here though
Contributor
eliandoran
approved these changes
Jun 7, 2025
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
dosubot
Bot
added
the
size:L
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.21.2->^5.0.04.21.2->5.1.0^4.17.21->^5.0.05.0.1->5.0.3Release Notes
expressjs/express (express)
v5.1.0Compare Source
========================
Uint8Arrayinres.send()res.sendFile()res.links()setprototypeofsafe-bufferutils-mergemethodsdepddebug@^4.4.0body-parser@^2.2.0router@^2.2.0content-type@^1.0.5finalhandler@^2.1.0qs@^6.14.0server-static@2.2.0type-is@2.0.1v5.0.1Compare Source
==========
cookiesemver lock to address CVE-2024-47764v5.0.0Compare Source
=========================
path-is-absolutedependency - usepath.isAbsoluteinsteadres.status()accepts only integers, and input must be greater than 99 and less than 1000RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.for inputs outside this rangeTypeError: Invalid status code: ${code}. Status code must be an integer.for non integer inputsres.redirect('back')andres.location('back')is no longer a supported magic string, explicitly usereq.get('Referrer') || '/'.res.clearCookiewill ignore user providedmaxAgeandexpiresoptionsapplication/javascript=>text/javascriptConfiguration
📅 Schedule: Branch creation - "before 3am" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.