[dependabot]

Bumps the nodejs-minor-patch group with 5 updates in the /reference-apps/nodejs directory:

Package	From	To
express	5.2.1	5.3.0
express-rate-limit	8.7.0	8.7.1
mysql2	3.24.5	3.24.6
node-vault	0.12.0	0.13.0
eslint	10.12.0	10.13.0

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

• cf6722b 5.3.0 (#7468)
• 8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
• 9efc29e docs: fix pass-through typos (#7509)
• 2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
• de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
• 9169cbe docs: add missing apostrophe in example (#7483)
• 7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
• 3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
• 98bd4cd deps: proxy-addr@^2.0.8 (#7474)
• 9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits

• c2e30b3 8.7.1
• b40a390 v8.7.1 changelog
• ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
• 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
• 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
• 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
• 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
• 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
• 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
• 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
• Additional commits viewable in compare view

Updates mysql2 from 3.24.5 to 3.24.6

Changelog

Sourced from mysql2's changelog.

3.24.6 (2026-10-13)

Bug Fixes

• allocate a new LOCAL INFILE terminator packet per write (#4580) (8c068ef), closes #4568

Commits

• 7f65d9a chore(master): release 3.24.6 (#4592)
• ded9be2 build(deps-dev): bump rollup from 4.64.0 to 4.64.4 in the rollup group (#4605)
• 30201a2 build(deps-dev): bump @​types/node from 26.6.4 to 26.6.5 (#4606)
• 5eb21f4 build(deps-dev): bump prettier (#4604)
• 477ca97 build(deps): bump lucide-react from 1.52.0 to 1.55.0 in /website (#4609)
• 9ea9345 build(deps-dev): bump prettier from 3.9.9 to 3.9.10 in /website (#4608)
• c52e961 build(deps-dev): bump @​types/node from 26.6.4 to 26.6.5 in /website (#4607)
• 1cdba3c build(deps-dev): bump @​biomejs/biome from 2.5.14 to 2.5.15 (#4585)
• a270608 build(deps-dev): bump @​types/node from 26.6.3 to 26.6.4 (#4584)
• 51e02b3 build(deps-dev): bump brace-expansion from 5.0.9 to 5.0.12 (#4601)
• Additional commits viewable in compare view

Updates node-vault from 0.12.0 to 0.13.0

Release notes

Sourced from node-vault's releases.

Release 0.13.0

TL;DR

• The axios dependency is now ^1.20.0 (was ^1.13.6), fixing 34 advisories that affect 1.13.6; with axios 1.20, HTTPS requests via HTTPS_PROXY tunnel through CONNECT, so proxies no longer see X-Vault-Token.
• Proxies must therefore allow CONNECT to Vault's port (Squid's defaults block 8200), and one that never answers hangs requests despite timeout (workarounds: NO_PROXY, requestOptions.agentOptions.timeout).
• kubernetesLogin, addKubernetesRole, getKubernetesRole and deleteKubernetesRole without mount_point now use the client's kubernetesPath (default kubernetes) instead of requesting auth//…, broken since 0.10.3.
• addKubernetesRole (now taking Vault's token_* fields) and certLogin no longer reject with a TypeError when given arguments, and generateRootStatus is back with its typing; all three had been broken since 0.10.0.
• Maintenance: dev-only nyc 18.0.0 (was 15.1.0), dropping the transitive uuid; dev lockfile security updates; CI test image moved to Debian bookworm. Docs: README and example/unseal.js cover unsealing an initialized vault.

Pull requests

• Add unseal example and docs for already-initialized vaults (#295)
• fix: pass kubernetesPath into the mustache path context (#302)
• build(deps): bump form-data from 4.0.5 to 4.0.6 (#304)
• Fix Node 20 CI job by moving Docker base image to Debian bookworm (#305)
• fix(deps): bump axios to 1.20.0 and patch vulnerable transitive deps (#308)
• build(deps): bump uuid and nyc (#309)
• fix: restore generateRootStatus and repair addKubernetesRole/certLogin schemas (#312)
• chore(release): bump version (#313)

Commits

• 928fcae Merge pull request #313 from nodevault/release-minor-1791718193
• da02c68 chore(release): bump version
• c800393 Merge pull request #312 from nodevault/fix/broken-commands
• c1004ad fix: restore generateRootStatus and repair addKubernetesRole/certLogin schemas
• 435c25d Merge pull request #309 from nodevault/dependabot/npm_and_yarn/multi-ef0f9f31a5
• a3a97d8 build(deps): bump uuid and nyc
• f3ecac2 Merge pull request #308 from nodevault/fix/security-scan-vulns
• 27e315e fix(deps): bump axios to 1.20.0 and patch vulnerable transitive deps
• 6cc256d Apply remaining changes
• a156d27 Merge pull request #304 from nodevault/dependabot/npm_and_yarn/form-data-4.0.6
• Additional commits viewable in compare view

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

Commits

• 4637f98 10.13.0
• 96df05c Build: changelog update for 10.13.0
• 4783a68 docs: Update README
• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
• 317fcb3 chore: update ecosystem plugins (#21409)
• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
• 43f0ac9 docs: clarify parameter description in getText (#21287)
• a39d9fb feat: add globalThis to no-obj-calls (#21382)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions