chore(deps)(deps): bump the production-dependencies group across 1 directory with 5 updates by dependabot[bot] · Pull Request #158 · FutureSolutionDev/Deploy-Center-Server

dependabot · 2026-10-28T00:45:29Z

Bumps the production-dependencies group with 5 updates in the / directory:

Package	From	To
express	`5.2.1`	`5.3.0`
express-rate-limit	`8.6.2`	`8.7.1`
fs-extra	`11.4.0`	`11.4.1`
mysql2	`3.23.4`	`3.24.6`
socket.io	`4.8.3`	`4.8.4`

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

cf6722b 5.3.0 (#7468)
8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
9efc29e docs: fix pass-through typos (#7509)
2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
9169cbe docs: add missing apostrophe in example (#7483)
7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
98bd4cd deps: proxy-addr@^2.0.8 (#7474)
9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates express-rate-limit from 8.6.2 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

v8.7.0

You can view the changelog here.

Commits

c2e30b3 8.7.1
b40a390 v8.7.1 changelog
ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
Additional commits viewable in compare view

Updates fs-extra from 11.4.0 to 11.4.1

Changelog

Sourced from fs-extra's changelog.

11.4.1 / 2026-09-22

Properly handle read errors (e.g. due to permissions) in emptyDir*() (#1080)

Allow renaming with only Unicode normalization difference in the filename (APFS-specific) (#859, #1079)

Commits

1e223d3 11.4.1
8cfd0a0 Remove obsolete docs note
de72292 Treat Unicode-normalization-only renames like case-only renames (#1079)
7e0ce7f Remove broken link (#1083)
00e858c Update GH Actions versions (#1082)
f829cc9 fix: propagate emptyDir directory read errors (#1080)
See full diff in compare view

Updates mysql2 from 3.23.4 to 3.24.6

Release notes

Sourced from mysql2's releases.

v3.24.6

3.24.6 (2026-10-13)

Bug Fixes

allocate a new LOCAL INFILE terminator packet per write (#4580) (8c068ef), closes #4568

v3.24.5

3.24.5 (2026-09-29)

Bug Fixes

strip the brackets from an IPv6 host in a connection URI (#4570) (b1c39c8)

v3.24.4

3.24.4 (2026-09-07)

Performance Improvements

per-query overhead, local dates, short strings, TLS context and compression (#4522) (2387daf)

reuse TLS sessions across connections to the same server (#4529) (9178c82)

v3.24.3

3.24.3 (2026-09-01)

Bug Fixes

typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

v3.24.2

3.24.2 (2026-08-24)

Bug Fixes

correct length-coded number size for the 3-byte range (#4500) (de56272)

promise: honour trace: false on every promise-API method (#4502) (1dcd8ef), closes #4501

v3.24.1

3.24.1 (2026-08-24)

Performance Improvements

single-pass utf8 string encoding for outgoing packets (#4495) (183e947)

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.24.6 (2026-10-13)

Bug Fixes

allocate a new LOCAL INFILE terminator packet per write (#4580) (8c068ef), closes #4568

3.24.5 (2026-09-29)

Bug Fixes

strip the brackets from an IPv6 host in a connection URI (#4570) (b1c39c8)

3.24.4 (2026-09-07)

Performance Improvements

per-query overhead, local dates, short strings, TLS context and compression (#4522) (2387daf)

reuse TLS sessions across connections to the same server (#4529) (9178c82)

3.24.3 (2026-09-01)

Bug Fixes

typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

3.24.2 (2026-08-24)

Bug Fixes

correct length-coded number size for the 3-byte range (#4500) (de56272)

promise: honour trace: false on every promise-API method (#4502) (1dcd8ef), closes #4501

3.24.1 (2026-08-24)

Performance Improvements

single-pass utf8 string encoding for outgoing packets (#4495) (183e947)

3.24.0 (2026-08-23)

Features

typed parameters, and adopt integer types the server reports (#4488) (8ec20f1)

... (truncated)

Commits

7f65d9a chore(master): release 3.24.6 (#4592)
ded9be2 build(deps-dev): bump rollup from 4.64.0 to 4.64.4 in the rollup group (#4605)
30201a2 build(deps-dev): bump @types/node from 26.6.4 to 26.6.5 (#4606)
5eb21f4 build(deps-dev): bump prettier (#4604)
477ca97 build(deps): bump lucide-react from 1.52.0 to 1.55.0 in /website (#4609)
9ea9345 build(deps-dev): bump prettier from 3.9.9 to 3.9.10 in /website (#4608)
c52e961 build(deps-dev): bump @types/node from 26.6.4 to 26.6.5 in /website (#4607)
1cdba3c build(deps-dev): bump @biomejs/biome from 2.5.14 to 2.5.15 (#4585)
a270608 build(deps-dev): bump @types/node from 26.6.3 to 26.6.4 (#4584)
51e02b3 build(deps-dev): bump brace-expansion from 5.0.9 to 5.0.12 (#4601)
Additional commits viewable in compare view

Updates socket.io from 4.8.3 to 4.8.4

Release notes

Sourced from socket.io's releases.

socket.io@4.8.4

Bug Fixes

cleanup pending acks on timeout to prevent memory leak (37aad11)

prevent uWebSockets.js from serving missing client files (dfb5ab3)

reject stateful regexps for dynamic namespaces (59f4f24)

types: allow emitWithAck() for events with void callbacks (#5453) (8b93a18)

types: properly import http module (74599a6)

Dependencies

engine.io@~6.6.0 (no change)

ws@~8.21.0 (diff)

socket.io-client@4.8.4

Bug Fixes

types: export ExtendedError for connect_error event (#5548) (c0d5450)

types: export reserved event interfaces (#5533) (03945df)

Dependencies

engine.io-client@~6.6.1 (no change)

ws@~8.21.0 (diff)

Commits

c239eb5 chore(release): socket.io@4.8.4
11a6f56 chore(release): socket.io-client@4.8.4
00e4e73 chore(release): engine.io-client@6.6.7
e387ab1 chore: use @rollup/plugin-terser instead of rollup-plugin-terser
9738333 chore(release): engine.io@6.6.11
fc9dd90 docs(eio): rework README
da008a5 fix(eio): refresh ping timeout on incoming packets
3df3fed fix(eio-client): restore default transport resolution
aaf2af3 test: upgrade WebdriverIO to v9
b5da079 refactor(sio): simplify packet handling switch
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…rectory with 5 updates Bumps the production-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.2` | `8.7.1` | | [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.4.0` | `11.4.1` | | [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.4` | `3.24.6` | | [socket.io](https://github.com/socketio/socket.io) | `4.8.3` | `4.8.4` | Updates `express` from 5.2.1 to 5.3.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v5.2.1...v5.3.0) Updates `express-rate-limit` from 8.6.2 to 8.7.1 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.6.2...v8.7.1) Updates `fs-extra` from 11.4.0 to 11.4.1 - [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md) - [Commits](jprichardson/node-fs-extra@11.4.0...11.4.1) Updates `mysql2` from 3.23.4 to 3.24.6 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.23.4...v3.24.6) Updates `socket.io` from 4.8.3 to 4.8.4 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/socket.io@4.8.3...socket.io@4.8.4) --- updated-dependencies: - dependency-name: express dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: express-rate-limit dependency-version: 8.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: fs-extra dependency-version: 11.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: mysql2 dependency-version: 3.24.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: socket.io dependency-version: 4.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-28T00:45:34Z

Assignees

The following users could not be added as assignees: FutureSolutionDev. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

coderabbitai · 2026-10-28T00:45:37Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 8c59bba8-ef90-428e-b614-7cc6209baa5e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 28, 2026

github-actions Bot added the server Changes in server/src/ label Oct 28, 2026

sabrydawood merged commit dd4d204 into master Oct 28, 2026
13 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-02846cfc30 branch October 28, 2026 08:56

sabrydawood mentioned this pull request Oct 28, 2026

chore(release): prepare 3.0.1 #161

Merged

Navigation Menu

Repository navigation

chore(deps)(deps): bump the production-dependencies group across 1 directory with 5 updates - #158

chore(deps)(deps): bump the production-dependencies group across 1 directory with 5 updates#158
sabrydawood merged 1 commit into
masterfrom
dependabot/npm_and_yarn/production-dependencies-02846cfc30

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

coderabbitai Bot commented Oct 28, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 28, 2026

v5.3.0

Highlights

🐞 Bug fixes

🚀 Improvements

5.3.0

🐞 Bug fixes

🚀 Improvements

v8.7.1

v8.7.0

11.4.1 / 2026-09-22

v3.24.6

3.24.6 (2026-10-13)

Bug Fixes

v3.24.5

3.24.5 (2026-09-29)

Bug Fixes

v3.24.4

3.24.4 (2026-09-07)

Performance Improvements

v3.24.3

3.24.3 (2026-09-01)

Bug Fixes

v3.24.2

3.24.2 (2026-08-24)

Bug Fixes

v3.24.1

3.24.1 (2026-08-24)

Performance Improvements

3.24.6 (2026-10-13)

Bug Fixes

3.24.5 (2026-09-29)

Bug Fixes

3.24.4 (2026-09-07)

Performance Improvements

3.24.3 (2026-09-01)

Bug Fixes

3.24.2 (2026-08-24)

Bug Fixes

3.24.1 (2026-08-24)

Performance Improvements

3.24.0 (2026-08-23)

Features

socket.io@4.8.4

Bug Fixes

Dependencies

socket.io-client@4.8.4

Bug Fixes

Dependencies

Uh oh!

dependabot Bot commented on behalf of github Oct 28, 2026

Assignees

Labels

Uh oh!

coderabbitai Bot commented Oct 28, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant