Update path-to-regexp to 0.1.13 to fix CVE-2026-4867

[baryman]

Description

---

To keep projects on version 4.x, you need to update the path-to-regexp package to version 0.1.13 to fix the CVE-2026-4867 vulnerability.

[krzysdz]

FYI ~0.1.12 matches all 0.1.x versions >= 0.1.12. Running npm audit fix, npm update in existing project or npm install in a new one, will install the updated version of path-to-regexp, without requiring a new Express version - #6905.

[baryman]

FYI ~0.1.12 matches all 0.1.x versions >= 0.1.12. Running npm audit fix, npm update in existing project or npm install in a new one, will install the updated version of path-to-regexp, without requiring a new Express version - #6905.

Perfect. Can I close PR ?

[bjohansebas]

As far as I know, there won’t be a release anytime soon, but you can update your application yourself with npm update path-to-regexp. I merged this so that if a release does happen, applications will get the latest version of that package—but as I said, it won’t be anytime soon.

[bjohansebas]

Could you rebase the branch so the CI passes, please?

[krzysdz]

Could you rebase the branch so the CI passes, please?

This test is broken with current 4.x too. It's an unrelated bug with body-parser (expressjs/body-parser#715).