⬆️ Bump the npm_and_yarn group across 1 directory with 29 updates

Open

Number: #1
Type: Pull Request
State: Open

Author:

dependabot[bot]
Association: None
Comments: 0

Created: May 25, 2025 at 02:07 AM UTC
(4 months ago)

Updated: May 25, 2025 at 02:07 AM UTC
(4 months ago)

Labels:
dependencies javascript

Description:

Bumps the npm_and_yarn group with 23 updates in the / directory:

Package	From	To
bcrypt	`3.0.1`	`5.0.0`
class-validator	`0.9.1`	`0.14.0`
express	`4.16.4`	`4.20.0`
mysql	`2.17.1`	`2.18.0`
type-graphql	`0.15.0`	`0.17.6`
typeorm	`0.2.9`	`0.3.0`
ajv	`6.6.2`	`6.12.6`
async	`2.6.1`	`2.6.4`
color-string	`1.5.3`	`1.9.1`
cookiejar	`2.1.2`	`2.1.4`
decode-uri-component	`0.2.0`	`0.2.2`
dot-prop	`4.2.0`	`4.2.1`
fsevents	`1.2.4`	`1.2.13`
hosted-git-info	`2.7.1`	`2.8.9`
ini	`1.3.5`	`1.3.8`
path-parse	`1.0.6`	`1.0.7`
pathval	`1.1.0`	`1.1.1`
socket.io-parser	`3.3.0`	`3.3.4`
socket.io	`2.2.0`	`2.5.1`
thenify	`3.3.0`	`3.3.1`
tmpl	`1.0.4`	`1.0.5`
tree-kill	`1.2.1`	`1.2.2`
undefsafe	`2.0.2`	`2.0.5`

Updates bcrypt from 3.0.1 to 5.0.0

Release notes

Sourced from bcrypt's releases.

v5.0.0

Fix the bcrypt "wrap-around" bug. It affects passwords with lengths >= 255. It is uncommon but it's a bug nevertheless. Previous attempts to fix the bug was unsuccessful.

Experimental support for z/OS

Fix a bug related to NUL in password input

Update node-pre-gyp to 0.15.0

v4.0.1

bcrypt 4.0.1

v4.0.0

NAPI support

v3.0.8

Update node-pre-gyp to 0.14

Pre-built binaries for NodeJS 13

v3.0.7

bcrypt 3.0.7

v3.0.6

bcrypt 3.0.6

v3.0.5

Update nan to 2.13.1

NodeJS 12 (nightly) support

v3.0.4

Fix GCC, NAN and V8 deprecation warnings

NodeJS 12 compatibility

v3.0.4-napi

bcrypt 3.0.4-napi

v3.0.3

Update nan to 2.12.1

v3.0.2

Update nan to 2.11.1

Changelog

Sourced from bcrypt's changelog.

5.0.0 (2020-06-02)

Fix the bcrypt "wrap-around" bug. It affects passwords with lengths >= 255. It is uncommon but it's a bug nevertheless. Previous attempts to fix the bug was unsuccessful.

Experimental support for z/OS

Fix a bug related to NUL in password input

Update node-pre-gyp to 0.15.0

4.0.1 (2020-02-27)

Fix compilation errors in Alpine linux

4.0.0 (2020-02-17)

Switch to NAPI bcrypt

Drop support for NodeJS 8

3.0.8 (2019-12-31)

Update node-pre-gyp to 0.14

Pre-built binaries for NodeJS 13

3.0.7 (2019-10-18)

Update nan to 2.14.0

Update node-pre-gyp to 0.13

3.0.6 (2019-04-11)

Update nan to 2.13.2

3.0.5 (2019-03-19)

Update nan to 2.13.1

NodeJS 12 compatibility

Remove node-pre-gyp from bundled dependencies

3.0.4-napi (2019-03-08)

Sync N-API bcrypt with NAN bcrypt

3.0.4 (2019-02-07)

Fix GCC, NAN and V8 deprecation warnings

3.0.3 (2018-12-19)

Update nan to 2.12.1

... (truncated)

Commits

61139e6 v5.0.0
1bde62c Update node-pre-gyp to 0.15.0
40770d6 Add NodeJS 14 to appveyor CI
5916a46 Merge pull request #807 from techhead/known_length
f28e916 Reword comment
ca1e43b Add test for embedded NULs
1a81858 Pass key_len to bcrypt(). Fix for issues #774, #776
cf4efd9 Merge pull request #647 from ilatypov/master
15febd1 Allow using an enterprise artifactory.
96c41e2 Mark z/OS compatibility code as such
Additional commits viewable in compare view

Updates class-validator from 0.9.1 to 0.14.0

Changelog

Sourced from class-validator's changelog.

0.14.0 (2022-12-09)

Added

add @IsTimeZone decorator to check if given string is valid IANA time zone

add @IsISO4217CurrencyCode decorator to check if the string is an ISO 4217 currency code

add @IsStrongPassword decorator to check if given password matches specific complexity criteria

add @IsBase58 decorator to check if a string is base58 encoded

add @IsTaxId decorator to check if a given string is a valid tax ID in a given locale

add support for passing function as date generator in @MinDate and @MaxDate decorators

add option to print constraint error message instead of constraint type in validation error

improve decorator metadata lookup performance

return possible values in error message for @IsEnum decorator

Fixed

re-added @types/validator as dependency

fix error generation when using @NestedValidation

pass validation options correctly to validator in @IsDateString decorator

support passing Symbol as parameter in error message generation

specify supported locales for @IsAlphanumeric decorator

correctly assign decorator name in metadata instead of loosing it

fix various spelling errors in documentation

fix various spelling errors and inconsistencies in JSDoc for decorators

Changed

enable forbidUnknownValues option by default

remove documentation about deprecated schema based validation and added warning

update warning message logged about missing decorator metadata

update libphonenumber-js to ^1.10.14 from ^1.9.43

update various dev-dependencies

BREAKING CHANGES

forbidUnknownValues option is enabled by default

From this release the forbidUnknownValues is enabled by default. This is the desired behavior for majority of use-cases, but this change may break validation for some. The two scenarios that results in failed validation:

when attempting to validate a class instance without metadata for it

when using group validation and the specified validation group results in zero validation applied

The old behavior can be restored via specifying forbidUnknownValues: false option when calling the validate functions.

For more details see [PR #1798](typestack/class-validator#1798) and #1422 (comment).

@NestedValidation decorator correctly assigns validation errors

Until now the errors from a nested validation in some cases were incorrectly assigned

... (truncated)

Commits

5f0d424 merge: release 0.14.0 (#1841)
e3d0708 build: bump version to 0.14.0
ad76890 docs: add changelog for 0.14.0
9a775c5 build(deps-dev): bump @types/node from 18.11.11 to 18.11.12 (#1840)
53bc9f6 build(deps-dev): bump @typescript-eslint/eslint-plugin (#1837)
d9b4072 build(deps-dev): bump @typescript-eslint/parser from 5.45.1 to 5.46.0 (#1838)
f993e9e build(deps-dev): bump typescript from 4.9.3 to 4.9.4 (#1835)
ad1a41d build(deps-dev): bump @rollup/plugin-commonjs from 23.0.3 to 23.0.4 (#1836)
42b4f7f build(deps-dev): bump prettier from 2.8.0 to 2.8.1 (#1834)
0c986d4 build(deps-dev): bump @types/node from 18.11.10 to 18.11.11 (#1833)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by typestack-release-bot, a new releaser for class-validator since your current version.

Updates express from 4.16.4 to 4.20.0

Release notes

Sourced from express's releases.

4.20.0

What's Changed

Important

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

Other Changes

4.19.2 Staging by @wesleytodd in expressjs/express#5561

remove duplicate location test for data uri by @wesleytodd in expressjs/express#5562

feat: document beta releases expectations by @marco-ippolito in expressjs/express#5565

Cut down on duplicated CI runs by @jonchurch in expressjs/express#5564

Add a Threat Model by @UlisesGascon in expressjs/express#5526

Assign captain of encodeurl by @blakeembrey in expressjs/express#5579

Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @jonchurch in expressjs/express#5587

docs: update Security.md by @inigomarquinez in expressjs/express#5590

docs: update triage nomination policy by @UlisesGascon in expressjs/express#5600

Add CodeQL (SAST) by @UlisesGascon in expressjs/express#5433

docs: add UlisesGascon as triage initiative captain by @UlisesGascon in expressjs/express#5605

deps: encodeurl@~2.0.0 by @blakeembrey in expressjs/express#5569

skip QUERY method test by @jonchurch in expressjs/express#5628

ignore ETAG query test on 21 and 22, reuse skip util by @jonchurch in expressjs/express#5639

add support Node.js@22 in the CI by @mertcanaltin in expressjs/express#5627

doc: add table of contents, tc/triager lists to readme by @mertcanaltin in expressjs/express#5619

List and sort all projects, add captains by @blakeembrey in expressjs/express#5653

docs: add @UlisesGascon as captain for cookie-parser by @UlisesGascon in expressjs/express#5666

✨ bring back query tests for node 21 by @ctcpip in expressjs/express#5690

[v4] Deprecate res.clearCookie accepting options.maxAge and options.expires by @jonchurch in expressjs/express#5672

skip QUERY tests for Node 21 only, still not supported by @jonchurch in expressjs/express#5695

📝 update people, add ctcpip to TC by @ctcpip in expressjs/express#5683

remove minor version pinning from ci by @jonchurch in expressjs/express#5722

Fix link variable use in attribution section of CODE OF CONDUCT by @IamLizu in expressjs/express#5762

Replace Appveyor windows testing with GHA by @jonchurch in expressjs/express#5599

Add OSSF Scorecard badge by @UlisesGascon in expressjs/express#5436

update scorecard link by @bjohansebas in expressjs/express#5814

Nominate @IamLizu to the triage team by @UlisesGascon in expressjs/express#5836

deps: path-to-regexp@0.1.8 by @blakeembrey in expressjs/express#5603

docs: specify new instructions for question and discuss by @IamLizu in expressjs/express#5835

4.x: Upgrade merge-descriptors dependency by @RobinTail in expressjs/express#5781

path-to-regexp@0.1.10 by @blakeembrey in expressjs/express#5902

New Contributors

@marco-ippolito made their first contribution in expressjs/express#5565

@inigomarquinez made their first contribution in expressjs/express#5590

@mertcanaltin made their first contribution in expressjs/express#5627

@ctcpip made their first contribution in expressjs/express#5690

@bjohansebas made their first contribution in expressjs/express#5814

Full Changelog: https://github.com/expressjs/express/compare/4.19.1...4.20.0

... (truncated)

Changelog

Sourced from express's changelog.

4.20.0 / 2024-09-10

deps: serve-static@0.16.0

Remove link renderization in html while redirecting

deps: send@0.19.0

Remove link renderization in html while redirecting

deps: body-parser@0.6.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

deps: path-to-regexp@0.1.10

Adds support for named matching groups in the routes using a regex

Adds backtracking protection to parameters without regexes defined

deps: encodeurl@~2.0.0

Removes encoding of \, |, and ^ to align better with URL spec

Deprecate passing options.maxAge and options.expires to res.clearCookie

Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: cookie@0.6.0

4.18.3 / 2024-02-29

Fix routing requests without method

deps: body-parser@1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: raw-body@2.5.2

deps: cookie@0.6.0

Add partitioned option

4.18.2 / 2022-10-08

Fix regression routing a large stack in a single route

deps: body-parser@1.20.1

... (truncated)

Commits

21df421 4.20.0
4c9ddc1 feat: upgrade to serve-static@0.16.0
9ebe5d5 feat: upgrade to send@0.19.0 (#5928)
ec4a01b feat: upgrade to body-parser@1.20.3 (#5926)
54271f6 fix: don't render redirect values in anchor href
125bb74 path-to-regexp@0.1.10 (#5902)
2a980ad merge-descriptors@1.0.3 (#5781)
a3e7e05 docs: specify new instructions for question and discuss
c5addb9 deps: path-to-regexp@0.1.8 (#5603)
e35380a docs: add @IamLizu to the triage team (#5836)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express since your current version.

Updates mysql from 2.17.1 to 2.18.0

Changelog

Sourced from mysql's changelog.

v2.18.0 (2020-01-21)

Add localInfile option to control LOAD DATA LOCAL INFILE

Add new Amazon RDS Root 2019 CA to Amazon RDS SSL profile #2280

Add new error codes up to MySQL 5.7.29

Fix early detection of bad callback to connection.query

Support Node.js 12.x #2211

Support Node.js 13.x

Support non-enumerable properties in object argument to connection.query #2253

Update bignumber.js to 9.0.0

Update readable-stream to 2.3.7

Commits

f410f91 2.18.0
dbb07ed Support non-enumerable properties in object argument to connection.query
ca84d0a Fix early detection of bad callback to connection.query
1428049 Add new Amazon RDS Root 2019 CA to Amazon RDS SSL profile
ec382a2 docs: document PoolCluster disconnect behavior
d247eef build: update lts tag in travis
337e87a Add localInfile option to control LOAD DATA LOCAL INFILE
1e2c350 Add new error codes up to MySQL 5.7.29
de253bb Fix early detection of bad callback to connection.query
b6546a0 build: Node.js@13.6
Additional commits viewable in compare view

Updates type-graphql from 0.15.0 to 0.17.6

Release notes

Sourced from type-graphql's releases.

0.17.6

Fixes

fix leaking resolver source code in MissingSubscriptionTopicsError error message (#489)

0.17.5

Features

rename DepreciationOptions interface to DeprecationOptions and deprecate the old one

update deps to newest minor versions (tslib, semver, graphql-query-complexity and glob)

support nested array types (@Field(type => [[Int]])) (#393)

deprecate the direct array syntax for union types

Fixes

fix errors on circular refs in union types (#364) by adding the function syntax (() => TClassTypes)

0.17.4

Features

add support for creating custom parameter decorators (#329)

allow to provide custom subscribe function in @Subscription decorator (#328)

0.17.3

Features

update packages semver to ^6.0.0 and graphql-subscriptions to ^1.1.0

Fixes

fix broken compatibility with newer @types/graphql due to using removed private types (e.g. MaybePromise) (#320)

0.17.2

Features

add support for defining resolveType function for interfaces and unions (#319)

add support for setting default nullability for fields and return types (#297)

add skipCheck option in buildSchema to disable checking the correctness of a schema

add postinstall script for printing info on console about supporting the project

Fixes

fix generating plain resolvers for queries and mutations (compatibility with Apollo client state)

0.17.1

Features

add support for emitting schema file in not existing directory (#269)

drop support for Node.js v6 (end of LTS in April 2019)

Fixes

fix typings discovery support for WebStorm (#276)

allow for returning plain objects when using ObjectTypes that implements InterfaceTypes or extends other classes (#160)

0.17.0

Features

Breaking Change: make graphql-js packages a peer dependencies, bump graphql to ^14.1.1 and @types/graphql to ^14.0.7 (#239)

Breaking Change: remove useContainer function and allow to register container by buildSchema options (#241)

Breaking Change: change the default PrintSchemaOptions option commentDescriptions to false (no more # comments in SDL)

add support for passing PrintSchemaOptions in buildSchema.emitSchemaFile (e.g. commentDescriptions: true to restore previous behavior)

add buildTypeDefsAndResolvers utils function for generating apollo-like typeDefs and resolvers pair (#233)

add support for generic types (#255)

... (truncated)

Changelog

Sourced from type-graphql's changelog.

v0.17.6

Fixes

fix leaking resolver source code in MissingSubscriptionTopicsError error message (#489)

v0.17.5

Features

rename DepreciationOptions interface to DeprecationOptions and deprecate the old one

update deps to newest minor versions (tslib, semver, graphql-query-complexity and glob)

support nested array types (@Field(type => [[Int]])) (#393)

deprecate the direct array syntax for union types

Fixes

fix errors on circular refs in union types (#364) by adding the function syntax (() => TClassTypes)

v0.17.4

Features

add support for creating custom parameter decorators (#329)

allow to provide custom subscribe function in @Subscription decorator (#328)

v0.17.3

Features

update packages semver to ^6.0.0 and graphql-subscriptions to ^1.1.0

Fixes

fix broken compatibility with newer @types/graphql due to using removed private types (e.g. MaybePromise) (#320)

v0.17.2

Features

add support for defining resolveType function for interfaces and unions (#319)

add support for setting default nullability for fields and return types (#297)

add skipCheck option in buildSchema to disable checking the correctness of a schema

add postinstall script for printing info on console about supporting the project

Fixes

fix generating plain resolvers for queries and mutations (compatibility with Apollo client state)

v0.17.1

... (truncated)

Commits

eb9f8ef release: 0.17.6
26ee0ce fix(errors): fix leaking resolver source code in message
2a39116 release: 0.17.5
b7d2e6b docs(unions): update docs and examples with function syntax for types
63f480b fix(unions): add function syntax for union types
b86f660 fix(changelog): fix wrong "Features" header type and pr link
44e12ee feat(fields): add support for nested arrays (#393)
ae71d29 docs(readme): update sponsors logo
0103091 chore(website): update docusaurus
9cceac1 chore(examples): update apollo client example deps
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by michallytek, a new releaser for type-graphql since your current version.

Updates typeorm from 0.2.9 to 0.3.0

Release notes

Sourced from typeorm's releases.

0.3.0

Changes in the version includes changes from the next branch and typeorm@next version. They were pending their migration from 2018. Finally, they are in the master branch and master version.

Features

compilation target now is es2020. This requires Node.JS version 14+

TypeORM now properly works when installed within different node_modules contexts (often happen if TypeORM is a dependency of another library or TypeORM is heavily used in monorepo projects)

Connection was renamed to DataSource. Old Connection is still there, but now it's deprecated. It will be completely removed in next version. New API:
export const dataSource = new DataSource({
    // ... options ...
})
// load entities, establish db connection, sync schema, etc.

await dataSource.connect()
Previously, you could use new Connection(), createConnection(), getConnectionManager().create(), etc. They all deprecated in favour of new syntax you can see above.

New way gives you more flexibility and simplicity in usage.

new custom repositories syntax:
export const UserRepository = myDataSource.getRepository(UserEntity).extend({
    findUsersWithPhotos() {
        return this.find({
            relations: {
                photos: true
            }
        })
    }
})
Old ways of custom repository creation were dropped.

added new option on relation load strategy called relationLoadStrategy. Relation load strategy is used on entity load and determines how relations must be loaded when you query entities and their relations from the database. Used on find* methods and QueryBuilder. Value can be set to join or query.

join - loads relations using SQL JOIN expression

... (truncated)

Changelog

Sourced from typeorm's changelog.

0.3.0 (2022-03-17)

Changes in the version includes changes from the next branch and typeorm@next version. They were pending their migration from 2018. Finally, they are in the master branch and master version.

Features

compilation target now is es2020. This requires Node.JS version 14+

TypeORM now properly works when installed within different node_modules contexts (often happen if TypeORM is a dependency of another library or TypeORM is heavily used in monorepo projects)

Connection was renamed to DataSource. Old Connection is still there, but now it's deprecated. It will be completely removed in next version. New API:
export const dataSource = new DataSource({
    // ... options ...
})
// load entities, establish db connection, sync schema, etc.

await dataSource.connect()
Previously, you could use new Connection(), createConnection(), getConnectionManager().create(), etc. They all deprecated in favour of new syntax you can see above.

New way gives you more flexibility and simplicity in usage.

new custom repositories syntax:
export const UserRepository = myDataSource.getRepository(UserEntity).extend({
    findUsersWithPhotos() {
        return this.find({
            relations: {
                photos: true,
            },
        })
    },
})
Old ways of custom repository creation were dropped.

added new option on relation load strategy called relationLoadStrategy. Relation load strategy is used on entity load and determines how relations must be loaded when you query entities and their relations from the database. Used on find* methods and QueryBuilder. Value can be set to join or query.

... (truncated)

Commits

941b584 version bump
3b8a031 0.3.0 (#8616)
5608956 refactor: remove spaces for consistency (#8751)
486f8c5 version bump
0fc093d fix: discard duplicated columns on update (#8724)
f3cfdd2 fix: allow clearing database inside a transaction (#8712)
96ac8f7 feat: add transformer to ViewColumnOptions (#8717)
32549fe refactor: DefaultNamingStrategy#getTableName should be protected, not private...
411fa54 fix: force web bundlers to ignore index.mjs and use the browser ESM version d...
10f46d9 fixing failing test
Additional commits viewable in compare view

Updates ajv from 6.6.2 to 6.12.6

Release notes

Sourced from ajv's releases.

v6.12.6

Fix performance issue of "url" format.

v6.12.5

Fix uri scheme validation (@ChALkeR). Fix boolean schemas with strictKeywords option (#1270)

v6.12.4

Fix: coercion of one-item arrays to scalar that should fail validation (failing example).

v6.12.3

Pass schema object to processCode function Option for strictNumbers (@issacgerges, #1128) Fixed vulnerability related to untrusted schemas (CVE-2020-15366)

v6.12.2

Removed post-install script

v6.12.1

Docs and dependency updates

v6.12.0

Improved hostname validation (@sambauers, #1143) Option keywords to add custom keywords (@franciscomorais, #1137) Types fixes (@boenrobot, @MattiAstedrone) Docs:

error logging example (@RadiationSickness)

TypeScript usage notes (@thetric)

v6.11.0

Time formats support two digit and colon-less variants of timezone offset (#1061 , @cjpillsbury) Docs: RegExp related security considerations Tests: Disabled failing typescript test

v6.10.2

Fix: the unknown keywords were ignored with the option strictKeywords: true (instead of failing compilation) in some sub-schemas (e.g. anyOf), when the sub-schema didn't have known keywords.

v6.10.1

Fix types Fix addSchema (#1001) Update dependencies

v6.10.0

Option strictDefaults to report ignored defaults (#957, @not-an-aardvark) Option strictKeywords to report unknown keywords (#781)

v6.9.0

OpenAPI keyword nullable can be any boolean (and not only true). Custom keyword definition changes:

dependencies option in to require the presence of keywords in the same schema.

... (truncated)

Commits

fe59143 6.12.6
d580d3e Merge pull request #1298 from ajv-validator/fix-url
fd36389 fix: regular expression for "url" format
490e34c docs: link to v7-beta branch
9cd93a1 docs: note about v7 in readme
877d286 Merge pull request #1262 from b4h0-c4t/refactor-opt-object-type
f1c8e45 6.12.5
764035e Merge branch 'ChALkeR-chalker/fix-comma'
3798160 Merge branch 'chalker/fix-comma' of git://github.com/ChALkeR/ajv into ChALkeR...
a3c7eba Merge branch 'refactor-opt-object-type' of github.com:b4h0-c4t/ajv into refac...
Additional commits viewable in compare view

Updates async from 2.6.1 to 2.6.4

Changelog

Sourced from async's changelog.

v2.6.4

Fix potential prototype pollution exploit (#1828)

v2.6.3

Updated lodash to squelch a security warning (#1675)

v2.6.2

Updated lodash to squelch a security warning (#1620)

Commits

c6bdaca Version 2.6.4
8870da9 Update built files
4df6754 update changelog
8f7f903 Fix prototype pollution vulnerability (#1828)
f1d8383 Version 2.6.3
2b674c1 update changelog
eab740f fix: udpate lodash. closes #1675
eaf32be Version 2.6.2
684b42e Update built files
e1bd3da update changelog
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by hargasinski, a new releaser for async since your current version.

Updates body-parser from 1.18.3 to 1.20.3

Release notes

Sourced from body-parser's releases.

1.20.3

What's Changed

Important

deps: qs@6.13.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/body-parser#522

ci: fix errors in ci github action for node 8 and 9 by @inigomarquinez in expressjs/body-parser#523

fix: pin to node@22.4.1 by @wesleytodd in expressjs/body-parser#527

deps: qs@6.12.3 by @melikhov-dev in expressjs/body-parser#521

Add OSSF Scorecard badge by @bjohansebas in expressjs/body-parser#531

Linter by @UlisesGascon in expressjs/body-parser#534

Release: 1.20.3 by @UlisesGascon in expressjs/body-parser#535

New Contributors

@inigomarquinez made their first contribution in expressjs/body-parser#522

@melikhov-dev made their first contribution in expressjs/body-parser#521

@bjohansebas made their first contribution in expressjs/body-parser#531

@UlisesGascon made their first contribution in expressjs/body-parser#534

Full Changelog: https://github.com/expressjs/body-parser/compare/1.20.2...1.20.3

1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

perf: skip value escaping when unnecessary

deps: raw-body@2.5.2

1.20.1

deps: qs@6.11.0

perf: remove unnecessary object clone

1.20.0

Fix error message for json parse whitespace in strict

Fix internal error when inflated body exceeds limit

Prevent loss of async hooks context

Prevent hanging when request already read

deps: depd@2.0.0

Replace internal eval usage with Function constructor

Use instance methods on process to check for listeners

deps: http-errors@2.0.0

deps: depd@2.0.0

deps: statuses@2.0.1

deps: on-finished@2.4.1

deps: qs@6.10.3

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.3 / 2024-09-10

deps: qs@6.13.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

1.20.2 / 2023-02-21

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

perf: skip value escaping when unnecessary

deps: raw-body@2.5.2

1.20.1 / 2022-10-06

deps: qs@6.11.0

perf: remove unnecessary object clone

1.20.0 / 2022-04-02

Fix error message for json parse whitespace in strict

Fix internal error when inflated body exceeds limit

Prevent loss of async hooks context

Prevent hanging when request already read

deps: depd@2.0.0

Replace internal eval usage with Function constructor

Use instance methods on process to check for listeners

deps: http-errors@2.0.0

deps: depd@2.0.0

deps: statuses@2.0.1

deps: on-finished@2.4.1

deps: qs@6.10.3

deps: raw-body@2.5.1

deps: http-errors@2.0.0

1.19.2 / 2022-02-15

deps: bytes@3.1.2

deps: qs@6.9.7

Fix handling of __proto__ keys

deps: raw-body@2.4.3

deps: bytes@3.1.2

1.19.1 / 2021-12-10

... (truncated)

Commits

1752951 1.20.3
39744cf chore: linter (#534)
b2695c4 Merge commit from fork
ade0f3f add scorecard to readme (#531)
99a1bd6 deps: qs@6.12.3 (#521)
9478591 fix: pin to node@22.4.1
83db46a ci: fix errors in ci github action for node 8 and 9 (#523)
9d4e212 chore: add support for OSSF scorecard reporting (#522)
ee91374 1.20.2
368a93a Fix strict json error message on Node.js 19+
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.

Updates color-string from 1.5.3 to 1.9.1

Release notes

Sourced from color-string's releases.

1.9.0

Minor Release 1.9.0

Add parsing of exponential alpha values for HWB and HSL (#66)

Thanks to @babycannotsay for their contribution!

1.8.2

Patch release 1.8.2

Fix incorrect handling of optional comma in rgb() regex (#65)

Thanks to @gerdasi and @mastertheblaster for reporting and confirming the bug!

1.8.1

Patch release 1.8.1

Fix rgb alpha percentage parsing from int to float (#61)

Thanks to

Pull Request Statistics

Commits:
1

Files Changed:
2

Additions:
+1048

Deletions:
-415

Package Dependencies

Package:
express

Ecosystem:
npm

Version Change:
4.16.4 → 4.20.0

Update Type:
Minor

Package:
decode-uri-component

Ecosystem:
npm

Version Change:
0.2.0 → 0.2.2

Update Type:
Patch

Package:
async

Ecosystem:
npm

Version Change:
2.6.1 → 2.6.4

Update Type:
Patch

Package:
ini

Ecosystem:
npm

Version Change:
1.3.5 → 1.3.8

Update Type:
Patch

Package:
hosted-git-info

Ecosystem:
npm

Version Change:
2.7.1 → 2.8.9

Update Type:
Minor

Package:
color-string

Ecosystem:
npm

Version Change:
1.5.3 → 1.9.1

Update Type:
Minor

Package:
cookiejar

Ecosystem:
npm

Version Change:
2.1.2 → 2.1.4

Update Type:
Patch

Package:
bcrypt

Ecosystem:
npm

Version Change:
3.0.1 → 5.0.0

Update Type:
Major

Package:
type-graphql

Ecosystem:
npm

Version Change:
0.15.0 → 0.17.6

Update Type:
Minor

Package:
class-validator

Ecosystem:
npm

Version Change:
0.9.1 → 0.14.0

Update Type:
Minor

Package:
path-parse

Ecosystem:
npm

Version Change:
1.0.6 → 1.0.7

Update Type:
Patch

Package:
ajv

Ecosystem:
npm

Version Change:
6.6.2 → 6.12.6

Update Type:
Minor

Package:
dot-prop

Ecosystem:
npm

Version Change:
4.2.0 → 4.2.1

Update Type:
Patch

Package:
socket.io

Ecosystem:
npm

Version Change:
2.2.0 → 2.5.1

Update Type:
Minor

Package:
fsevents

Ecosystem:
npm

Version Change:
1.2.4 → 1.2.13

Update Type:
Patch

Package:
tmpl

Ecosystem:
npm

Version Change:
1.0.4 → 1.0.5

Update Type:
Patch

Package:
thenify

Ecosystem:
npm

Version Change:
3.3.0 → 3.3.1

Update Type:
Patch

Package:
socket.io-parser

Ecosystem:
npm

Version Change:
3.3.0 → 3.3.4

Update Type:
Patch

Package:
typeorm

Ecosystem:
npm

Version Change:
0.2.9 → 0.3.0

Update Type:
Minor

Package:
pathval

Ecosystem:
npm

Version Change:
1.1.0 → 1.1.1

Update Type:
Patch

Package:
tree-kill

Ecosystem:
npm

Version Change:
1.2.1 → 1.2.2

Update Type:
Patch

Package:
undefsafe

Ecosystem:
npm

Version Change:
2.0.2 → 2.0.5

Update Type:
Patch

Package:
mysql

Ecosystem:
npm

Version Change:
2.17.1 → 2.18.0

Update Type:
Minor

Security Advisories

Prototype Pollution in Ajv

GHSA-v88g-cgmw-v5xw CVE-2020-15366 MODERATE

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollu...

Actions

View on GitHub View Repository All Dependabot PRs

Technical Details

ID:	`627869`
UUID:	`2542168551`
Node ID:	`PR_kwDOFur1bM6Xhmnn`
Host:	GitHub
Repository:	nasraldin/express-typescript-boilerplate
Merge State:	Unknown