[PR] build(deps-dev): bump express from 5.2.1 to 5.3.0 in /storm-webapp (storm)

Sat, 31 Oct 2026 21:07:01 -0700 


dependabot[bot] opened a new pull request, #9245:
URL: https://github.com/apache/storm/pull/9245

   Bumps [express](https://github.com/expressjs/express) from 5.2.1 to 5.3.0.
   <details>
   <summary>Release notes</summary>
   <p><em>Sourced from <a 
href="https://github.com/expressjs/express/releases";>express's 
releases</a>.</em></p>
   <blockquote>
   <h2>v5.3.0</h2>
   <h2>Highlights</h2>
   <h3>🐞 Bug fixes</h3>
   <ul>
   <li>
   <p>Fixed HTTP header conflict between Content-Length and Transfer-Encoding 
in res.send - by <a 
href="https://github.com/YuryShkoda";><code>@​YuryShkoda</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/4893";>#4893</a></p>
   <p>Fixed the behavior of <code>res.send()</code> to prevent conflicts 
between <code>Content-Length</code> and <code>Transfer-Encoding</code> HTTP 
headers in responses. The <code>Content-Length</code> header in 
<code>res.send()</code> is now only added when a <code>Transfer-Encoding</code> 
header is not present, complying with the HTTP specification that states both 
headers should not coexist in the same response. ETag generation is unaffected 
by the presence of a <code>Transfer-Encoding</code> header - by <a 
href="https://github.com/cuishuang";><code>@​cuishuang</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7459";>#7459</a></p>
   </li>
   </ul>
   <ul>
   <li>
   <p>Upgrade <code>qs</code> to <code>^6.16.0</code>, which fixes <a 
href="https://www.cve.org/CVERecord?id=CVE-2026-2391";>CVE-2026-2391</a> (<a 
href="https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883";>GHSA-w7fw-mjwx-w883</a>),
 <a href="https://www.cve.org/CVERecord?id=CVE-2026-82417";>CVE-2026-82417</a> 
(<a 
href="https://github.com/advisories/GHSA-4mjr-xmp4-gh2g";>GHSA-4mjr-xmp4-gh2g</a>)
 and <a 
href="https://www.cve.org/CVERecord?id=CVE-2026-82562";>CVE-2026-82562</a> (<a 
href="https://github.com/advisories/GHSA-x5fp-wj9c-mxmx";>GHSA-x5fp-wj9c-mxmx</a>):
 <code>arrayLimit</code> bypasses in comma parsing and a denial of service via 
an attacker-controlled <code>isBuffer</code> - by <a 
href="https://github.com/davetashner";><code>@​davetashner</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7057";>#7057</a> and <a 
href="https://redirect.github.com/expressjs/express/pull/7478";>#7478</a>, and 
<a href="https://github.com/cyphercodes";><code>@​cy
 phercodes</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7305";>#7305</a></p>
   </li>
   <li>
   <p>Upgrade <code>proxy-addr</code> to <code>^2.0.8</code>, which fixes <a 
href="https://www.cve.org/CVERecord?id=CVE-2026-90711";>CVE-2026-90711</a> - by 
<a href="https://github.com/lazerg";><code>@​lazerg</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7474";>#7474</a></p>
   </li>
   </ul>
   <h3>🚀 Improvements</h3>
   <ul>
   <li>
   <p>Allow conditional revalidation for QUERY requests. <code>req.fresh</code> 
previously only validated freshness for GET and HEAD requests, so QUERY 
responses never returned 304 despite a matching validator. Since QUERY is a 
safe, idempotent, and cacheable method that supports conditional requests, it 
is now included in the freshness check - by <a 
href="https://github.com/Cherry";><code>@​Cherry</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7366";>#7366</a></p>
   <pre lang="js"><code>// QUERY /reports with If-None-Match: &quot;12345&quot;
   app.query('/reports', (req, res) =&gt; {
     res.set('ETag', '&quot;12345&quot;');
     res.send(results); // now responds 304 Not Modified
   });
   </code></pre>
   </li>
   <li>
   <p>Improve HTML structure in <code>res.redirect()</code> responses when HTML 
format is accepted by adding <code>&lt;!DOCTYPE html&gt;</code>, 
<code>&lt;title&gt;</code>, and <code>&lt;body&gt;</code> tags for better 
browser compatibility - by <a 
href="https://github.com/Bernice55231";><code>@​Bernice55231</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/5167";>#5167</a></p>
   </li>
   <li>
   <p>When calling <code>app.render</code> with options set to null, the locals 
object is handled correctly, preventing unexpected errors and making the method 
behave the same as when options is omitted or an empty object is passed - by <a 
href="https://github.com/AkaHarshit";>AkaHarshit</a> in <a 
href="https://redirect.github.com/expressjs/express/pull/6903";>#6903</a></p>
   <pre lang="js"><code>app.render('index', null, callback); // now works as 
expected
   </code></pre>
   </li>
   <li>
   <p>Upgrade <code>content-type</code> to <code>^2.0.0</code>, bringing a 
faster parser (~1.5x quicker <code>Content-Type</code> parsing/formatting in 
<code>res.send()</code>) along with a behavior change: <code>res.send()</code> 
now keeps any existing parameters when adding the charset and no longer throws 
on a <code>Content-Type</code> that fails to parse. <code>type-is</code> is 
upgraded to <code>^2.1.0</code> as part of the same change - by <a 
href="https://github.com/blakeembrey";><code>@​blakeembrey</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7234";>#7234</a></p>
   <pre lang="js"><code>res.set('Content-Type', 'text/plain; 
foo=bar').send('hey');
   // -&gt; Content-Type: text/plain; foo=bar; charset=utf-8
   </code></pre>
   </li>
   <li>
   <p>The default error handler now logs the full error object instead of only 
its stack trace, so nested details such as <code>Error.cause</code> and 
library-specific properties (e.g. Sequelize's 
<code>parent</code>/<code>original</code>) are no longer swallowed - by <a 
href="https://github.com/Nitin-Mohapatra";><code>@​Nitin-Mohapatra</code></a> in 
<a href="https://redirect.github.com/expressjs/express/pull/6464";>#6464</a></p>
   </li>
   <li>
   <p>Upgrade <code>content-disposition</code> to <code>^2.0.1</code>, which 
changes the <code>Content-Disposition</code> header emitted by 
<code>res.download()</code>, <code>res.attachment()</code>, and 
<code>res.sendFile()</code>: file names that are valid HTTP tokens are no 
longer wrapped in quotes. This is equivalent per RFC 6266, but applications 
asserting on the exact header bytes should update their expectations - by <a 
href="https://github.com/blakeembrey";><code>@​blakeembrey</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7233";>#7233</a></p>
   <pre lang="js"><code>res.attachment('user.html');
   // before -&gt; Content-Disposition: attachment; 
filename=&quot;user.html&quot;
   // after  -&gt; Content-Disposition: attachment; filename=user.html
   </code></pre>
   </li>
   </ul>
   <!-- raw HTML omitted -->
   </blockquote>
   <p>... (truncated)</p>
   </details>
   <details>
   <summary>Changelog</summary>
   <p><em>Sourced from <a 
href="https://github.com/expressjs/express/blob/master/History.md";>express's 
changelog</a>.</em></p>
   <blockquote>
   <h1>5.3.0</h1>
   <h2>🐞 Bug fixes</h2>
   <ul>
   <li>
   <p>Fixed HTTP header conflict between Content-Length and Transfer-Encoding 
in res.send - by <a 
href="https://github.com/YuryShkoda";><code>@​YuryShkoda</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/4893";>#4893</a></p>
   <p>Fixed the behavior of <code>res.send()</code> to prevent conflicts 
between <code>Content-Length</code> and <code>Transfer-Encoding</code> HTTP 
headers in responses. The <code>Content-Length</code> header in 
<code>res.send()</code> is now only added when a <code>Transfer-Encoding</code> 
header is not present, complying with the HTTP specification that states both 
headers should not coexist in the same response. ETag generation is unaffected 
by the presence of a <code>Transfer-Encoding</code> header - by <a 
href="https://github.com/cuishuang";><code>@​cuishuang</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7459";>#7459</a></p>
   </li>
   </ul>
   <ul>
   <li>
   <p>Upgrade <code>qs</code> to <code>^6.16.0</code>, which fixes <a 
href="https://www.cve.org/CVERecord?id=CVE-2026-2391";>CVE-2026-2391</a> (<a 
href="https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883";>GHSA-w7fw-mjwx-w883</a>),
 <a href="https://www.cve.org/CVERecord?id=CVE-2026-82417";>CVE-2026-82417</a> 
(<a 
href="https://github.com/advisories/GHSA-4mjr-xmp4-gh2g";>GHSA-4mjr-xmp4-gh2g</a>)
 and <a 
href="https://www.cve.org/CVERecord?id=CVE-2026-82562";>CVE-2026-82562</a> (<a 
href="https://github.com/advisories/GHSA-x5fp-wj9c-mxmx";>GHSA-x5fp-wj9c-mxmx</a>):
 <code>arrayLimit</code> bypasses in comma parsing and a denial of service via 
an attacker-controlled <code>isBuffer</code> - by <a 
href="https://github.com/davetashner";><code>@​davetashner</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7057";>#7057</a> and <a 
href="https://redirect.github.com/expressjs/express/pull/7478";>#7478</a>, and 
<a href="https://github.com/cyphercodes";><code>@​cy
 phercodes</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7305";>#7305</a></p>
   </li>
   <li>
   <p>Upgrade <code>proxy-addr</code> to <code>^2.0.8</code>, which fixes <a 
href="https://www.cve.org/CVERecord?id=CVE-2026-90711";>CVE-2026-90711</a> - by 
<a href="https://github.com/lazerg";><code>@​lazerg</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7474";>#7474</a></p>
   </li>
   </ul>
   <h2>🚀 Improvements</h2>
   <ul>
   <li>
   <p>Allow conditional revalidation for QUERY requests. <code>req.fresh</code> 
previously only validated freshness for GET and HEAD requests, so QUERY 
responses never returned 304 despite a matching validator. Since QUERY is a 
safe, idempotent, and cacheable method that supports conditional requests, it 
is now included in the freshness check - by <a 
href="https://github.com/Cherry";><code>@​Cherry</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7366";>#7366</a></p>
   <pre lang="js"><code>// QUERY /reports with If-None-Match: &quot;12345&quot;
   app.query('/reports', (req, res) =&gt; {
     res.set('ETag', '&quot;12345&quot;');
     res.send(results); // now responds 304 Not Modified
   });
   </code></pre>
   </li>
   <li>
   <p>Improve HTML structure in <code>res.redirect()</code> responses when HTML 
format is accepted by adding <code>&lt;!DOCTYPE html&gt;</code>, 
<code>&lt;title&gt;</code>, and <code>&lt;body&gt;</code> tags for better 
browser compatibility - by <a 
href="https://github.com/Bernice55231";><code>@​Bernice55231</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/5167";>#5167</a></p>
   </li>
   <li>
   <p>When calling <code>app.render</code> with options set to null, the locals 
object is handled correctly, preventing unexpected errors and making the method 
behave the same as when options is omitted or an empty object is passed - by <a 
href="https://github.com/AkaHarshit";>AkaHarshit</a> in <a 
href="https://redirect.github.com/expressjs/express/pull/6903";>#6903</a></p>
   <pre lang="js"><code>app.render('index', null, callback); // now works as 
expected
   </code></pre>
   </li>
   <li>
   <p>Upgrade <code>content-type</code> to <code>^2.0.0</code>, bringing a 
faster parser (~1.5x quicker <code>Content-Type</code> parsing/formatting in 
<code>res.send()</code>) along with a behavior change: <code>res.send()</code> 
now keeps any existing parameters when adding the charset and no longer throws 
on a <code>Content-Type</code> that fails to parse. <code>type-is</code> is 
upgraded to <code>^2.1.0</code> as part of the same change - by <a 
href="https://github.com/blakeembrey";><code>@​blakeembrey</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7234";>#7234</a></p>
   <pre lang="js"><code>res.set('Content-Type', 'text/plain; 
foo=bar').send('hey');
   // -&gt; Content-Type: text/plain; foo=bar; charset=utf-8
   </code></pre>
   </li>
   <li>
   <p>The default error handler now logs the full error object instead of only 
its stack trace, so nested details such as <code>Error.cause</code> and 
library-specific properties (e.g. Sequelize's 
<code>parent</code>/<code>original</code>) are no longer swallowed - by <a 
href="https://github.com/Nitin-Mohapatra";><code>@​Nitin-Mohapatra</code></a> in 
<a href="https://redirect.github.com/expressjs/express/pull/6464";>#6464</a></p>
   </li>
   <li>
   <p>Upgrade <code>content-disposition</code> to <code>^2.0.1</code>, which 
changes the <code>Content-Disposition</code> header emitted by 
<code>res.download()</code>, <code>res.attachment()</code>, and 
<code>res.sendFile()</code>: file names that are valid HTTP tokens are no 
longer wrapped in quotes. This is equivalent per RFC 6266, but applications 
asserting on the exact header bytes should update their expectations - by <a 
href="https://github.com/blakeembrey";><code>@​blakeembrey</code></a> in <a 
href="https://redirect.github.com/expressjs/express/pull/7233";>#7233</a></p>
   <pre lang="js"><code>res.attachment('user.html');
   // before -&gt; Content-Disposition: attachment; 
filename=&quot;user.html&quot;
   // after  -&gt; Content-Disposition: attachment; filename=user.html
   </code></pre>
   </li>
   </ul>
   <!-- raw HTML omitted -->
   </blockquote>
   <p>... (truncated)</p>
   </details>
   <details>
   <summary>Commits</summary>
   <ul>
   <li><a 
href="https://github.com/expressjs/express/commit/cf6722bf89a86905281d9160b6482e08166b5ef0";><code>cf6722b</code></a>
 5.3.0 (<a 
href="https://redirect.github.com/expressjs/express/issues/7468";>#7468</a>)</li>
   <li><a 
href="https://github.com/expressjs/express/commit/8c2fcfcb7d37c9c2e89363b7b86a092768c3a8a3";><code>8c2fcfc</code></a>
 docs: fix typos and a stale API reference in lib comments (<a 
href="https://redirect.github.com/expressjs/express/issues/7512";>#7512</a>)</li>
   <li><a 
href="https://github.com/expressjs/express/commit/9efc29e280018dafc1f0617f3a3d28f4e463b7be";><code>9efc29e</code></a>
 docs: fix pass-through typos (<a 
href="https://redirect.github.com/expressjs/express/issues/7509";>#7509</a>)</li>
   <li><a 
href="https://github.com/expressjs/express/commit/2717ae3cbf2bdc3f946d22ea6a4e0b5bd438b87b";><code>2717ae3</code></a>
 build(deps): bump the github-actions group with 3 updates (<a 
href="https://redirect.github.com/expressjs/express/issues/7499";>#7499</a>)</li>
   <li><a 
href="https://github.com/expressjs/express/commit/de777714df3fb1e81ac2d95f509c421478ab1e56";><code>de77771</code></a>
 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (<a 
href="https://redirect.github.com/expressjs/express/issues/7500";>#7500</a>)</li>
   <li><a 
href="https://github.com/expressjs/express/commit/9169cbe1127ed1f9bc4f80a70b82c412467dd156";><code>9169cbe</code></a>
 docs: add missing apostrophe in example (<a 
href="https://redirect.github.com/expressjs/express/issues/7483";>#7483</a>)</li>
   <li><a 
href="https://github.com/expressjs/express/commit/7ef98448f8b38099ab1ded55e458538ad47a51e7";><code>7ef9844</code></a>
 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (<a 
href="https://redirect.github.com/expressjs/express/issues/7493";>#7493</a>)</li>
   <li><a 
href="https://github.com/expressjs/express/commit/3b7e39fe74371ddabc77fed736dd22aa71c14f5c";><code>3b7e39f</code></a>
 deps: bump qs minimum to 6.16.0 (<a 
href="https://redirect.github.com/expressjs/express/issues/7478";>#7478</a>)</li>
   <li><a 
href="https://github.com/expressjs/express/commit/98bd4cd96b250d25e1672c36f49cfc743bc801e7";><code>98bd4cd</code></a>
 deps: proxy-addr@^2.0.8 (<a 
href="https://redirect.github.com/expressjs/express/issues/7474";>#7474</a>)</li>
   <li><a 
href="https://github.com/expressjs/express/commit/9a34acf03cb818ff3f8bc40e44176e277a25cbb9";><code>9a34acf</code></a>
 fix(res.send): preserve ETag generation with Transfer-Encoding (<a 
href="https://redirect.github.com/expressjs/express/issues/7459";>#7459</a>)</li>
   <li>Additional commits viewable in <a 
href="https://github.com/expressjs/express/compare/v5.2.1...v5.3.0";>compare 
view</a></li>
   </ul>
   </details>
   <details>
   <summary>Maintainer changes</summary>
   <p>This version was pushed to npm by <a 
href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new 
releaser for express since your current version.</p>
   </details>
   <br />
   
   
   [![Dependabot compatibility 
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=express&package-manager=npm_and_yarn&previous-version=5.2.1&new-version=5.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
   
   Dependabot will resolve any conflicts with this PR as long as you don't 
alter it yourself. You can also trigger a rebase manually by commenting 
`@dependabot rebase`.
   
   [//]: # (dependabot-automerge-start)
   [//]: # (dependabot-automerge-end)
   
   ---
   
   <details>
   <summary>Dependabot commands and options</summary>
   <br />
   
   You can trigger Dependabot actions by commenting on this PR:
   - `@dependabot rebase` will rebase this PR
   - `@dependabot recreate` will recreate this PR, overwriting any edits that 
have been made to it
   - `@dependabot show <dependency name> ignore conditions` will show all of 
the ignore conditions of the specified dependency
   - `@dependabot ignore this major version` will close this PR and stop 
Dependabot creating any more for this major version (unless you reopen the PR 
or upgrade to it yourself)
   - `@dependabot ignore this minor version` will close this PR and stop 
Dependabot creating any more for this minor version (unless you reopen the PR 
or upgrade to it yourself)
   - `@dependabot ignore this dependency` will close this PR and stop 
Dependabot creating any more for this dependency (unless you reopen the PR or 
upgrade to it yourself)
   
   
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to