Bump the npm_and_yarn group across 1 directory with 3 updates #702

dependabot · 2025-06-29T00:12:23Z

Bumps the npm_and_yarn group with 3 updates in the /src/dashboard directory: body-parser, express and pbkdf2.

Updates body-parser from 1.20.3 to 2.0.0

Release notes

2.0.0

What's Changed

Important

add brotli support #406

Breaking Change: Node.js 18 is the minimum supported version

Details

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/body-parser#522

ci: fix errors in ci github action for node 8 and 9 by @inigomarquinez in expressjs/body-parser#523

fix: pin to [email protected] by @wesleytodd in expressjs/body-parser#527

deps: [email protected] by @melikhov-dev in expressjs/body-parser#521

Drop support for less than LTS node versions in v2 by @wesleytodd in expressjs/body-parser#528

Also use the qs module for the simple parser by @papandreou in expressjs/body-parser#387

raw-body@3 by @wesleytodd in expressjs/body-parser#529

urlencoded: Support iso-8859-1, utf8 sentinel, and numeric entities by @papandreou in expressjs/body-parser#326

Added support for brotli ('br') content-encoding by @danielgindi in expressjs/body-parser#406

Add OSSF Scorecard badge by @bjohansebas in expressjs/body-parser#531

Linter by @UlisesGascon in expressjs/body-parser#534

Release: 1.20.3 by @UlisesGascon in expressjs/body-parser#535

New Contributors

@inigomarquinez made their first contribution in expressjs/body-parser#522

@wesleytodd made their first contribution in expressjs/body-parser#527

@melikhov-dev made their first contribution in expressjs/body-parser#521

@papandreou made their first contribution in expressjs/body-parser#387

@danielgindi made their first contribution in expressjs/body-parser#406

@bjohansebas made their first contribution in expressjs/body-parser#531

@UlisesGascon made their first contribution in expressjs/body-parser#534

Full Changelog: expressjs/body-parser@1.20.2...2.0.0

2.0.0-beta.2

This incorporates all changes after 1.19.1 up to 1.20.2.

Remove deprecated bodyParser() combination middleware

deps: [email protected]

Add DEBUG_HIDE_DATE environment variable

Change timer to per-namespace instead of global

Change non-TTY date format

Remove DEBUG_FD environment variable support

Support 256 namespace colors

deps: [email protected]

Add encoding cp720

Add encoding UTF-32

deps: [email protected]

2.0.0-beta.1

req.body is no longer always initialized to {}

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.0.0 / 2024-09-10

Propagate changes from 1.20.3

add brotli support #406

Breaking Change: Node.js 18 is the minimum supported version

2.0.0-beta.2 / 2023-02-23

This incorporates all changes after 1.19.1 up to 1.20.2.

Remove deprecated bodyParser() combination middleware

deps: [email protected]

Add DEBUG_HIDE_DATE environment variable

Change timer to per-namespace instead of global

Change non-TTY date format

Remove DEBUG_FD environment variable support

Support 256 namespace colors

deps: [email protected]

Add encoding cp720

Add encoding UTF-32

deps: [email protected]

2.0.0-beta.1 / 2021-12-17

Drop support for Node.js 0.8

req.body is no longer always initialized to {}

it is left undefined unless a body is parsed

urlencoded parser now defaults extended to false

Use on-finished to determine when body read

Commits

9e06a79 2.0.0
9232c77 Merge branch 'master' into 2.x
afd0f39 feat: add option to customize the depth with a default value of 32
07ce14d Added support for brotli ('br') content-encoding (#406)
6cea6bd urlencoded: Support iso-8859-1, utf8 sentinel, and numeric entities (#326)
35b50b5 fix(deps): raw-body@^3.0.0 (#529)
7eb00cd Also use the qs module for the simple parser (#387)
ddf9b75 feat!: remove node less than 18 from ci
fccaf48 2.0.0-beta.2
b53363c docs: add missing history entry
Additional commits viewable in compare view

Updates express from 4.21.2 to 5.0.0

Release notes

Sourced from express's releases.

5.0.0

Express v5.0.0

🎉 Express v5 is finally here! 🎉

After years of development, the long-awaited Express v5 has been officially released. This version focuses on simplifying the codebase, improving security, and dropping support for older Node.js versions to enable better performance and maintainability.

For detailed information, please check out the official Express v5 release blog post.

Most relevant details

Major Changes in v5

Node.js version support: Dropped support for Node.js versions before v18.

Routing changes: Updated to [email protected], removing sub-expression regex patterns for security reasons (ReDoS mitigation).

Promise support: Middleware can now return rejected promises, caught by the router as errors.

body-parser changes: Several improvements including the ability to customize urlencoded body depth and defaulting extended to false.

Deprecated API methods removed: Removed old, deprecated API method signatures from Express v3/v4.

For a complete list of breaking changes and API deprecations, see the migration guide.

Security Updates

This release includes important security fixes, including improvements to prevent ReDoS attacks and mitigation for CVE-2024-45590. Full details can be found in the security release notes.

Migration

Be sure to check out our migration guide for instructions on how to update your applications from Express v4 to v5.

Security Guidance

For best practices, we recommend reviewing the Threat Model which outlines Express' approach to securing your applications, including tips for user input validation and other critical aspects.

What's Changed

4.19.2 Staging by @wesleytodd in expressjs/express#5561

remove duplicate location test for data uri by @wesleytodd in expressjs/express#5562

feat: document beta releases expectations by @marco-ippolito in expressjs/express#5565

Cut down on duplicated CI runs by @jonchurch in expressjs/express#5564

Add a Threat Model by @UlisesGascon in expressjs/express#5526

Assign captain of encodeurl by @blakeembrey in expressjs/express#5579

Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @jonchurch in expressjs/express#5587

docs: update Security.md by @inigomarquinez in expressjs/express#5590

docs: update triage nomination policy by @UlisesGascon in expressjs/express#5600

Add CodeQL (SAST) by @UlisesGascon in expressjs/express#5433

docs: add UlisesGascon as triage initiative captain by @UlisesGascon in expressjs/express#5605

Use object with null prototype for various app properties by @EvanHahn in expressjs/express#4861

deps: encodeurl@~2.0.0 by @blakeembrey in expressjs/express#5569

skip QUERY method test by @jonchurch in expressjs/express#5628

ignore ETAG query test on 21 and 22, reuse skip util by @jonchurch in expressjs/express#5639

... (truncated)

Changelog

Sourced from express's changelog.

5.0.0 / 2024-09-10

remove:

path-is-absolute dependency - use path.isAbsolute instead

breaking:

res.status() accepts only integers, and input must be greater than 99 and less than 1000

will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range

will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs

deps: [email protected]

res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.

change:

res.clearCookie will ignore user provided maxAge and expires options

deps: cookie-signature@^1.2.1

deps: [email protected]

deps: merge-descriptors@^2.0.0

deps: serve-static@^2.1.0

deps: [email protected]

deps: accepts@^2.0.0

deps: mime-types@^3.0.0

application/javascript => text/javascript

deps: type-is@^2.0.0

deps: content-disposition@^1.0.0

deps: finalhandler@^2.0.0

deps: fresh@^2.0.0

deps: body-parser@^2.0.1

deps: send@^1.1.0

5.0.0-beta.3 / 2024-03-25

This incorporates all changes after 4.19.1 up to 4.19.2.

5.0.0-beta.2 / 2024-03-20

This incorporates all changes after 4.17.2 up to 4.19.1.

5.0.0-beta.1 / 2022-02-14

This is the first Express 5.0 beta release, based off 4.17.2 and includes changes from 5.0.0-alpha.8.

change:

Default "query parser" setting to 'simple'

Requires Node.js 4+

Use mime-types for file to content type mapping

deps: [email protected]

deps: [email protected]

req.body is no longer always initialized to {}

... (truncated)

Commits

344b022 5.0.0
0c49926 fix(deps): send@^1.1.0
b3906cb fix(deps): serve-static@^2.1.0
fed8c2a fix(deps): body-parser@^2.0.1
bdd81f8 Delete back as a magic string (#5933)
6c98f80 🔧 update CI, remove unsupported versions, clean up
f9256ef Merge branch '5.0' into 5-merge
e5feb9f Merge tag '4.20.0' into 5.0
0264908 feat(deps)!: router@^2.0.0 (#5885)
4d713d2 update to [email protected] (#5916)
Additional commits viewable in compare view

Updates pbkdf2 from 3.1.2 to 3.1.3

Changelog

Sourced from pbkdf2's changelog.

v3.1.3 - 2025-06-20

Commits

Only apps should have lockfiles 8b06730

[lint] fix whitespace 9a76e2f

[lint] fix parens/curlies/semis/etc 6fd84bf

[meta] add auto-changelog 796c38d

[Tests] fix tests in node 17 3661fb0

Revert "[Tests] fix tests in node < 3" 7431b57

[Tests] fix tests in node < 3 eb9f97a

[Fix] ensure unknown algorithms throw + known ones match node 26d4fd3

[Tests] add GHA, always run nyc 513906a

[lint] fix a few more rules ab04da8

[lint] switch to eslint 89694cf

[Tests] add coverage d0d534b

[Refactor] use to-buffer e3102a8

[readme] improve badges fca0c9d

[Tests] remove unused travis file a2c7d93

[meta] switch from files to npmignore 7f31fbc

[Tests] use .nycrc 8d628e8

[Refactor] minor tweaks fc61005

[Deps] update create-hmac, safe-buffer, sha.js ae2a7d0

[Fix] pin create-hash, ripemd160 due to breaking changes e079968

[Tests] fix tests in node 3 45fbcf3

[meta] skip publishing benchmarks 19ea57b

[Dev Deps] add missing peer dep 645e252

Commits

3e40827 v3.1.3
e3102a8 [Refactor] use to-buffer
7431b57 Revert "[Tests] fix tests in node < 3"
19ea57b [meta] skip publishing benchmarks
a2c7d93 [Tests] remove unused travis file
645e252 [Dev Deps] add missing peer dep
796c38d [meta] add auto-changelog
d0d534b [Tests] add coverage
7f31fbc [meta] switch from files to npmignore
fca0c9d [readme] improve badges
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for pbkdf2 since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 3 updates in the /src/dashboard directory: [body-parser](https://github.com/expressjs/body-parser), [express](https://github.com/expressjs/express) and [pbkdf2](https://github.com/crypto-browserify/pbkdf2). Updates `body-parser` from 1.20.3 to 2.0.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.3...2.0.0) Updates `express` from 4.21.2 to 5.0.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.21.2...v5.0.0) Updates `pbkdf2` from 3.1.2 to 3.1.3 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.2...v3.1.3) --- updated-dependencies: - dependency-name: body-parser dependency-version: 2.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: express dependency-version: 5.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

…d_yarn-ef04924de5

yeasy · 2025-06-29T02:49:27Z

@dodo920306 , pls review this.

dodo920306 · 2025-06-29T03:44:44Z

@dodo920306 , pls review this.

I've checked out the branch and rebuild the dashboard successfully. LGTM.

dependabot bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 29, 2025

yeasy requested a review from YoungHypo June 29, 2025 01:16

Merge branch 'main' into dependabot/npm_and_yarn/src/dashboard/npm_an…

7486484

…d_yarn-ef04924de5

yeasy approved these changes Jun 29, 2025

View reviewed changes

yeasy merged commit d2d78b0 into main Jun 29, 2025
3 checks passed

yeasy deleted the dependabot/npm_and_yarn/src/dashboard/npm_and_yarn-ef04924de5 branch June 29, 2025 12:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 3 updates #702

Bump the npm_and_yarn group across 1 directory with 3 updates #702

dependabot bot commented on behalf of github Jun 29, 2025

Uh oh!

yeasy commented Jun 29, 2025

Uh oh!

dodo920306 commented Jun 29, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Bump the npm_and_yarn group across 1 directory with 3 updates #702

Bump the npm_and_yarn group across 1 directory with 3 updates #702

Conversation

dependabot bot commented on behalf of github Jun 29, 2025

2.0.0

What's Changed

Important

Details

New Contributors

2.0.0-beta.2

2.0.0-beta.1

2.0.0 / 2024-09-10

2.0.0-beta.2 / 2023-02-23

2.0.0-beta.1 / 2021-12-17

5.0.0

Express v5.0.0

Most relevant details

Major Changes in v5

Security Updates

Migration

Security Guidance

What's Changed

5.0.0 / 2024-09-10

5.0.0-beta.3 / 2024-03-25

5.0.0-beta.2 / 2024-03-20

5.0.0-beta.1 / 2022-02-14

v3.1.3 - 2025-06-20

Commits

Uh oh!

yeasy commented Jun 29, 2025

Uh oh!

dodo920306 commented Jun 29, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants