Bumps [express](https://github.com/expressjs/express) and [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express). These dependencies needed to be updated together. Updates `express` from 5.1.0 to 5.2.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/express/releases">express's releases</a>.</em></p> <blockquote> <h2>v5.2.1</h2> <h2>What's Changed</h2> <blockquote> <p>[!IMPORTANT]<br /> The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.</p> </blockquote> <ul> <li>Release: 5.2.1 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6933">expressjs/express#6933</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/express/compare/v5.2.0...v5.2.1">https://github.com/expressjs/express/compare/v5.2.0...v5.2.1</a></p> <h2>v5.2.0</h2> <h2>Important: Security</h2> <ul> <li>Security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2024-51999">CVE-2024-51999</a> (<a href="https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6">GHSA-pj86-cfqh-vqx6</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>build(deps): bump github/codeql-action from 3.28.11 to 3.28.13 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/express/pull/6429">expressjs/express#6429</a></li> <li>Refactor: simplify <code>acceptsLanguages</code> implementation using spread operator by <a href="https://github.com/Ayoub-Mabrouk"><code>@Ayoub-Mabrouk</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6137">expressjs/express#6137</a></li> <li>increased code coverage of utils.js file by <a href="https://github.com/ashish3011"><code>@ashish3011</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6386">expressjs/express#6386</a></li> <li>chore: remove duplicate word by <a href="https://github.com/dufucun"><code>@dufucun</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6456">expressjs/express#6456</a></li> <li>build(deps): bump github/codeql-action from 3.28.13 to 3.28.16 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/express/pull/6498">expressjs/express#6498</a></li> <li>build(deps): bump actions/setup-node from 4.3.0 to 4.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/express/pull/6497">expressjs/express#6497</a></li> <li>build(deps): bump actions/download-artifact from 4.2.1 to 4.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/express/pull/6496">expressjs/express#6496</a></li> <li>ci: add node.js 24 to test matrix by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6504">expressjs/express#6504</a></li> <li>ci: update codeql config by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6488">expressjs/express#6488</a></li> <li>chore: wider range for query test skip by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6512">expressjs/express#6512</a></li> <li>chore: fix typos in test by <a href="https://github.com/noritaka1166"><code>@noritaka1166</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6535">expressjs/express#6535</a></li> <li>ci: disable credential persistence for checkout actions by <a href="https://github.com/mertssmnoglu"><code>@mertssmnoglu</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6522">expressjs/express#6522</a></li> <li>ci: allow manual triggering of workflow by <a href="https://github.com/shivarm"><code>@shivarm</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6515">expressjs/express#6515</a></li> <li>test: add coverage for app.listen() variants by <a href="https://github.com/kgarg1"><code>@kgarg1</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6476">expressjs/express#6476</a></li> <li>docs: move documentation and charters to the discussions and .github … by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6427">expressjs/express#6427</a></li> <li>build(deps): bump github/codeql-action from 3.28.16 to 3.28.18 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/express/pull/6549">expressjs/express#6549</a></li> <li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/express/pull/6548">expressjs/express#6548</a></li> <li>chore: enforce explicit <code>Buffer</code> import and add lint rule by <a href="https://github.com/shivarm"><code>@shivarm</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6525">expressjs/express#6525</a></li> <li>chore: use node protocol for querystring by <a href="https://github.com/shivarm"><code>@shivarm</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6520">expressjs/express#6520</a></li> <li>chore: fix typo by <a href="https://github.com/mountdisk"><code>@mountdisk</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6609">expressjs/express#6609</a></li> <li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/express/pull/6618">expressjs/express#6618</a></li> <li>add deprecation warnings for redirect arguments undefined by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6405">expressjs/express#6405</a></li> <li>ci: run CI when the markdown changes by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6632">expressjs/express#6632</a></li> <li>doc: fix CONTRIBUTING link by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6653">expressjs/express#6653</a></li> <li>doc: update contributing guidelines and code of conduct links by <a href="https://github.com/ShubhamOulkar"><code>@ShubhamOulkar</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6601">expressjs/express#6601</a></li> <li>build(deps-dev): bump morgan from 1.10.0 to 1.10.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/express/pull/6679">expressjs/express#6679</a></li> <li>build(deps-dev): bump cookie-session from 2.1.0 to 2.1.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/express/pull/6678">expressjs/express#6678</a></li> <li>lint: add --fix flag to automatic fix linting issue by <a href="https://github.com/shivarm"><code>@shivarm</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6644">expressjs/express#6644</a></li> <li>chore: ignore yarn.lock file and update example by <a href="https://github.com/shivarm"><code>@shivarm</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6588">expressjs/express#6588</a></li> <li>lib: use req.socket over deprecated req.connection by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6705">expressjs/express#6705</a></li> <li>doc: update express app example by <a href="https://github.com/shivarm"><code>@shivarm</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6718">expressjs/express#6718</a></li> <li>build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/express/pull/6675">expressjs/express#6675</a></li> <li>Remove history.md from being packaged on publish by <a href="https://github.com/sheplu"><code>@sheplu</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6780">expressjs/express#6780</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/express/blob/master/History.md">express's changelog</a>.</em></p> <blockquote> <h1>5.2.1 / 2025-12-01</h1> <ul> <li>Revert security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2024-51999">CVE-2024-51999</a> (<a href="https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6">GHSA-pj86-cfqh-vqx6</a>) <ul> <li>The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.</li> </ul> </li> </ul> <h1>5.2.0 / 2025-12-01</h1> <ul> <li>Security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2024-51999">CVE-2024-51999</a> (<a href="https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6">GHSA-pj86-cfqh-vqx6</a>)</li> <li>deps: <code>body-parser@^2.2.1</code></li> <li>A deprecation warning was added when using <code>res.redirect</code> with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/express/commit/dbac741a49a5a64336b70c06e85c2e2706e36336"><code>dbac741</code></a> 5.2.1</li> <li><a href="https://github.com/expressjs/express/commit/697547cde621d8b0a47b4fff6e98b29337f8c980"><code>697547c</code></a> Revert "sec: security patch for CVE-2024-51999"</li> <li><a href="https://github.com/expressjs/express/commit/4007ad103ba29f6426b2ec9eccfb1ceb792682a8"><code>4007ad1</code></a> Release: 5.2.0 (<a href="https://redirect.github.com/expressjs/express/issues/6920">#6920</a>)</li> <li><a href="https://github.com/expressjs/express/commit/2f64f68c37c64ae333e41ff38032d21860f22255"><code>2f64f68</code></a> sec: security patch for CVE-2024-51999</li> <li><a href="https://github.com/expressjs/express/commit/ed0ba3f1dc905d6b62eabf23bd383abcae4901ba"><code>ed0ba3f</code></a> build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (<a href="https://redirect.github.com/expressjs/express/issues/6928">#6928</a>)</li> <li><a href="https://github.com/expressjs/express/commit/8eace4603cb2547608578a4fbb259dc984216f71"><code>8eace46</code></a> build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 (<a href="https://redirect.github.com/expressjs/express/issues/6929">#6929</a>)</li> <li><a href="https://github.com/expressjs/express/commit/30bae810279b2ea162bed5b14ce6c35a110a87f5"><code>30bae81</code></a> build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 (<a href="https://redirect.github.com/expressjs/express/issues/6930">#6930</a>)</li> <li><a href="https://github.com/expressjs/express/commit/758d4355d45322b4c8cd347ebcefbf3b154c7e7f"><code>758d435</code></a> deps: body-parser@^2.2.1 (<a href="https://redirect.github.com/expressjs/express/issues/6922">#6922</a>)</li> <li><a href="https://github.com/expressjs/express/commit/77bcd5274a87047e5b3fe2f17f6c342db3909c53"><code>77bcd52</code></a> docs: update emeritus triagers (<a href="https://redirect.github.com/expressjs/express/issues/6890">#6890</a>)</li> <li><a href="https://github.com/expressjs/express/commit/f33caf1f89a028f0ea98ff5a156a68e65a2eabdd"><code>f33caf1</code></a> Nominate to <a href="https://github.com/efekrskl"><code>@efekrskl</code></a> for triage team (<a href="https://redirect.github.com/expressjs/express/issues/6888">#6888</a>)</li> <li>Additional commits viewable in <a href="https://github.com/expressjs/express/compare/v5.1.0...v5.2.1">compare view</a></li> </ul> </details> <br /> Updates `@types/express` from 5.0.5 to 5.0.6 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>