Skip to content

Comments

build(deps): bump the minor-and-patch group across 1 directory with 7 updates#65

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/minor-and-patch-74eb2ba4d2
Open

build(deps): bump the minor-and-patch group across 1 directory with 7 updates#65
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/minor-and-patch-74eb2ba4d2

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 1, 2026

Bumps the minor-and-patch group with 7 updates in the / directory:

Package From To
compression 1.7.4 1.8.1
cookie-parser 1.4.6 1.4.7
cors 2.8.5 2.8.6
debug 4.3.4 4.4.3
morgan 1.10.0 1.10.1
pug 3.0.2 3.0.3
serve-favicon 2.5.0 2.5.1

Updates compression from 1.7.4 to 1.8.1

Release notes

Sourced from compression's releases.

v1.8.1

What's Changed

New Contributors

Full Changelog: expressjs/compression@1.8.0...v1.8.1

v1.8.0

What's Changed

New Contributors

Full Changelog: expressjs/compression@1.7.5...v1.8.0

1.7.5

What's Changed

... (truncated)

Changelog

Sourced from compression's changelog.

1.8.1 / 2025-07-17

1.8.0 / 2025-02-10

  • Use res.headersSent when available
  • Replace _implicitHeader with writeHead property
  • add brotli support for versions of node that support it
  • Add the enforceEncoding option for requests without Accept-Encoding header

1.7.5 / 2024-10-31

  • deps: Replace accepts with negotiator@~0.6.4
    • Add preference option
  • deps: bytes@3.1.2
    • Add petabyte (pb) support
    • Fix "thousandsSeparator" incorrecting formatting fractional part
    • Fix return value for un-parsable strings
  • deps: compressible@~2.0.18
    • Mark font/ttf as compressible
    • Remove compressible from multipart/mixed
    • deps: mime-db@'>= 1.43.0 < 2'
  • deps: safe-buffer@5.2.1
Commits
  • 83a0c45 1.8.1
  • ce62713 deps: on-headers@1.1.0 (#246)
  • f4acb23 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#244)
  • 6eaebe6 build(deps): bump actions/checkout from 4.1.1 to 4.2.2 (#241)
  • 37e0623 build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 (#240)
  • bc436b2 build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (#239)
  • 2f9f572 build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 (#243)
  • 5f13b14 [StepSecurity] ci: Harden GitHub Actions (#235)
  • 76e0945 build(deps-dev): bump supertest from 6.2.3 to 6.3.4 (#231)
  • ae6ee80 build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 (#230)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for compression since your current version.


Updates cookie-parser from 1.4.6 to 1.4.7

Release notes

Sourced from cookie-parser's releases.

1.4.7

What's Changed

New Contributors

Full Changelog: expressjs/cookie-parser@1.4.6...1.4.7

Changelog

Sourced from cookie-parser's changelog.

1.4.7 / 2024-10-08

  • deps: cookie@0.7.2
    • Fix object assignment of hasOwnProperty
  • deps: cookie@0.7.1
    • Allow leading dot for domain
      • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
    • Add fast path for serialize without options, use obj.hasOwnProperty when parsing
  • deps: cookie@0.7.0
    • perf: parse cookies ~10% faster
    • fix: narrow the validation of cookies to match RFC6265
    • fix: add main to package.json for rspack
  • deps: cookie@0.6.0
    • Add partitioned option
  • deps: cookie@0.5.0
    • Add priority option
    • Fix expires option to reject invalid dates
    • pref: improve default decode speed
    • pref: remove slow string split in parse
  • deps: cookie@0.4.2
    • pref: read value only when assigning in parse
    • pref: remove unnecessary regexp in parse
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for cookie-parser since your current version.


Updates cors from 2.8.5 to 2.8.6

Release notes

Sourced from cors's releases.

v2.8.6

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from cors's changelog.

2.8.6 / 2026-01-22

  • Improve documentation (API, context, examples...)
  • Remove additional markdown files from tarball
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for cors since your current version.


Updates debug from 4.3.4 to 4.4.3

Release notes

Sourced from debug's releases.

4.4.3

Functionally identical release to 4.4.1.

Version 4.4.2 is compromised. Please see debug-js/debug#1005.

4.4.1

What's Changed

New Contributors

Full Changelog: debug-js/debug@4.4.0...4.4.1

4.4.0

Fixes (hopefully) the inefficient regex warnings in .enable().

Minor version as this is invariably going to break certain users who misuse the .enable() API and expected it to work with regexes, which was never supported nor documented. That's on you, sorry - that functionality won't be added back.

Full Changelog: debug-js/debug@4.3.7...4.4.0

4.3.7

What's Changed

Full Changelog: debug-js/debug@4.3.6...4.3.7

4.3.6

What's Changed

New Contributors

Full Changelog: debug-js/debug@4.3.5...4.3.6

4.3.5

Patch

  • cac39b1c5b018b0fe93a53a05f084eee543d17f5 Fix/debug depth (#926)

Thank you @​calvintwr for the fix.

Commits

Updates morgan from 1.10.0 to 1.10.1

Release notes

Sourced from morgan's releases.

1.10.1

What's Changed

New Contributors

Full Changelog: expressjs/morgan@1.10.0...1.10.1

Changelog

Sourced from morgan's changelog.

1.10.1 / 2025-07-17

Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for morgan since your current version.


Updates pug from 3.0.2 to 3.0.3

Release notes

Sourced from pug's releases.

pug-code-gen@3.0.3

Bug Fixes

  • Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options (#3438)

pug@3.0.3

Bug Fixes

  • Update pug-code-gen with the following fix: (#3438)

    Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options

Commits

Updates serve-favicon from 2.5.0 to 2.5.1

Release notes

Sourced from serve-favicon's releases.

2.5.1

What's Changed

New Contributors

Full Changelog: expressjs/serve-favicon@2.5.0...2.5.1

Changelog

Sourced from serve-favicon's changelog.

2.5.1 / 2025-06-10

  • deps:
    • safe-buffer@5.2.1
    • ms@2.1.3
Commits
  • 83da8d5 2.5.1 (#68)
  • c03a88b feat: adopt flexible deps policy (#69)
  • 262b7bf docs: include scorecard badge (#67)
  • 47663ae feat: remove appveyor (#66)
  • d83f56c build(deps-dev): bump eslint-plugin-promise from 3.7.0 to 3.8.0 (#61)
  • 872a751 build(deps-dev): bump eslint-plugin-import from 2.10.0 to 2.31.0 (#62)
  • 19e8af3 build(deps-dev): bump mocha from 10.4.0 to 10.8.2 (#60)
  • d976602 ci: upgrade Node versions (#64)
  • 623e26e build(deps-dev): bump eslint-plugin-markdown from 1.0.0-beta.6 to 1.0.2 (#63)
  • 14fae4f build(deps-dev): bump eslint-plugin-standard from 3.0.1 to 3.1.0 (#59)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for serve-favicon since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 7…
c460c06 
… updates

Bumps the minor-and-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [compression](https://github.com/expressjs/compression) | `1.7.4` | `1.8.1` |
| [cookie-parser](https://github.com/expressjs/cookie-parser) | `1.4.6` | `1.4.7` |
| [cors](https://github.com/expressjs/cors) | `2.8.5` | `2.8.6` |
| [debug](https://github.com/debug-js/debug) | `4.3.4` | `4.4.3` |
| [morgan](https://github.com/expressjs/morgan) | `1.10.0` | `1.10.1` |
| [pug](https://github.com/pugjs/pug) | `3.0.2` | `3.0.3` |
| [serve-favicon](https://github.com/expressjs/serve-favicon) | `2.5.0` | `2.5.1` |



Updates `compression` from 1.7.4 to 1.8.1
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](expressjs/compression@1.7.4...v1.8.1)

Updates `cookie-parser` from 1.4.6 to 1.4.7
- [Release notes](https://github.com/expressjs/cookie-parser/releases)
- [Changelog](https://github.com/expressjs/cookie-parser/blob/master/HISTORY.md)
- [Commits](expressjs/cookie-parser@1.4.6...1.4.7)

Updates `cors` from 2.8.5 to 2.8.6
- [Release notes](https://github.com/expressjs/cors/releases)
- [Changelog](https://github.com/expressjs/cors/blob/master/HISTORY.md)
- [Commits](expressjs/cors@v2.8.5...v2.8.6)

Updates `debug` from 4.3.4 to 4.4.3
- [Release notes](https://github.com/debug-js/debug/releases)
- [Commits](debug-js/debug@4.3.4...4.4.3)

Updates `morgan` from 1.10.0 to 1.10.1
- [Release notes](https://github.com/expressjs/morgan/releases)
- [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md)
- [Commits](expressjs/morgan@1.10.0...1.10.1)

Updates `pug` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/pugjs/pug/releases)
- [Commits](https://github.com/pugjs/pug/compare/pug@3.0.2...pug@3.0.3)

Updates `serve-favicon` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/expressjs/serve-favicon/releases)
- [Changelog](https://github.com/expressjs/serve-favicon/blob/master/HISTORY.md)
- [Commits](expressjs/serve-favicon@2.5.0...2.5.1)

---
updated-dependencies:
- dependency-name: compression
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: cookie-parser
  dependency-version: 1.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: cors
  dependency-version: 2.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: debug
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: morgan
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pug
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: serve-favicon
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file frontend labels Feb 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file frontend

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants