Skip to content

Bump the deps group across 1 directory with 12 updates#2984

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/express/deps-f8553bda79
Closed

Bump the deps group across 1 directory with 12 updates#2984
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/express/deps-f8553bda79

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 1, 2026 •
edited
Loading

Bumps the deps group with 11 updates in the /express directory:

Package From To
@bufbuild/protobuf 2.6.3 2.10.2
@connectrpc/connect 2.0.3 2.1.1
@connectrpc/connect-express 2.0.3 2.1.1
@connectrpc/connect-web 2.0.3 2.1.1
express 5.1.0 5.2.1
@types/express 5.0.3 5.0.6
tsx 4.20.3 4.21.0
@bufbuild/buf 1.56.0 1.62.1
@bufbuild/protoc-gen-es 2.6.3 2.10.2
@types/node 24.2.0 25.0.3
typescript 5.9.2 5.9.3

Updates @bufbuild/protobuf from 2.6.3 to 2.10.2

Release notes

Sourced from @​bufbuild/protobuf's releases.

v2.10.2

What's Changed

Full Changelog: bufbuild/protobuf-es@v2.10.1...v2.10.2

v2.10.1

What's Changed

New Contributors

Full Changelog: bufbuild/protobuf-es@v2.10.0...v2.10.1

v2.10.0

What's Changed

New Contributors

Full Changelog: bufbuild/protobuf-es@v2.9.0...v2.10.0

v2.9.0

What's Changed

Full Changelog: bufbuild/protobuf-es@v2.8.0...v2.9.0

v2.8.0

What's Changed

Full Changelog: bufbuild/protobuf-es@v2.7.0...v2.8.0

v2.7.0

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by hudlowbuf, a new releaser for @​bufbuild/protobuf since your current version.


Updates @connectrpc/connect from 2.0.3 to 2.1.1

Release notes

Sourced from @​connectrpc/connect's releases.

v2.1.1

What's Changed

New Contributors

Full Changelog: connectrpc/connect-es@v2.1.0...v2.1.1

v2.1.0

What's Changed

[!IMPORTANT]

TypeScript 5.9 includes breaking changes to lib.d.ts, forcing us to change return types for some functions from Uint8Array to Uint8Array<ArrayBuffer>. This is unlikely to affect you, but if it does, see #1560 for details.

Full Changelog: connectrpc/connect-es@v2.0.4...v2.1.0

v2.0.4

What's Changed

Full Changelog: connectrpc/connect-es@v2.0.3...v2.0.4

Commits

Updates @connectrpc/connect-express from 2.0.3 to 2.1.1

Release notes

Sourced from @​connectrpc/connect-express's releases.

v2.1.1

What's Changed

New Contributors

Full Changelog: connectrpc/connect-es@v2.1.0...v2.1.1

v2.1.0

What's Changed

[!IMPORTANT]

TypeScript 5.9 includes breaking changes to lib.d.ts, forcing us to change return types for some functions from Uint8Array to Uint8Array<ArrayBuffer>. This is unlikely to affect you, but if it does, see #1560 for details.

Full Changelog: connectrpc/connect-es@v2.0.4...v2.1.0

v2.0.4

What's Changed

Full Changelog: connectrpc/connect-es@v2.0.3...v2.0.4

Commits

Updates @connectrpc/connect-node from 2.0.3 to 2.1.1

Release notes

Sourced from @​connectrpc/connect-node's releases.

v2.1.1

What's Changed

New Contributors

Full Changelog: connectrpc/connect-es@v2.1.0...v2.1.1

v2.1.0

What's Changed

[!IMPORTANT]

TypeScript 5.9 includes breaking changes to lib.d.ts, forcing us to change return types for some functions from Uint8Array to Uint8Array<ArrayBuffer>. This is unlikely to affect you, but if it does, see #1560 for details.

Full Changelog: connectrpc/connect-es@v2.0.4...v2.1.0

v2.0.4

What's Changed

Full Changelog: connectrpc/connect-es@v2.0.3...v2.0.4

Commits
  • bf6b191 Release 2.1.1 (#1618)
  • 280adb2 Fix memory leak in Http2SessionManager's verify step (#1616)
  • ff99bbe Bump @​types/node from 22.9.3 to 24.9.2 (#1606)
  • f27d8bf Bump jasmine and @​types/jasmine (#1611)
  • 4ec4be8 Add Protovalidate recommendation to package READMEs (#1615)
  • 332f9b5 Bump jasmine from 5.10.0 to 5.11.0 (#1590)
  • 78b40ab Bump jasmine and @​types/jasmine (#1572)
  • e1c4728 Do not hold on to HTTP/2 connections after receiving GOAWAY without open stre...
  • 8566675 Release 2.1.0 (#1564)
  • 4eed0ce Update to TypeScript 5.9 and change return types from Uint8Array to `Uint8A...
  • Additional commits viewable in compare view

Updates @connectrpc/connect-web from 2.0.3 to 2.1.1

Release notes

Sourced from @​connectrpc/connect-web's releases.

v2.1.1

What's Changed

New Contributors

Full Changelog: connectrpc/connect-es@v2.1.0...v2.1.1

v2.1.0

What's Changed

[!IMPORTANT]

TypeScript 5.9 includes breaking changes to lib.d.ts, forcing us to change return types for some functions from Uint8Array to Uint8Array<ArrayBuffer>. This is unlikely to affect you, but if it does, see #1560 for details.

Full Changelog: connectrpc/connect-es@v2.0.4...v2.1.0

v2.0.4

What's Changed

Full Changelog: connectrpc/connect-es@v2.0.3...v2.0.4

Commits

Updates express from 5.1.0 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
Commits

Updates @types/express from 5.0.3 to 5.0.6

Commits

Updates tsx from 4.20.3 to 4.21.0

Release notes

Sourced from tsx's releases.

v4.21.0

4.21.0 (2025-11-30)

Features

This release is also available on:

v4.20.6

4.20.6 (2025-09-26)

Bug Fixes

  • properly hide relaySignal from process.listeners() (#741) (710a424)

This release is also available on:

v4.20.5

4.20.5 (2025-08-24)

Bug Fixes

  • handle ambiguous packages (796053a)

This release is also available on:

v4.20.4

4.20.4 (2025-08-12)

Bug Fixes

... (truncated)

Commits
  • f6284cd ci: lock in semantic-release v24
  • 048fb62 feat: upgrade esbuild (#748)
  • 710a424 fix: properly hide relaySignal from process.listeners() (#741)
  • 20b91c4 docs: make sponsors dynamic
  • 08dcd59 chore: move vercel settings to root
  • e6d1a47 docs: obfuscate aside classname
  • de2719d style: remove unused variable
  • 13f2954 chore: upgrade docs deps
  • 0504525 chore: upgrade manten
  • 132fdd8 test: assert require.cache
  • Additional commits viewable in compare view

Updates @bufbuild/buf from 1.56.0 to 1.62.1

Release notes

Sourced from @​bufbuild/buf's releases.

v1.62.1

  • Fix default behavior for swift_prefix to remain unset when no override is provided in managed mode.

v1.62.0

  • Add swift_prefix to managed mode.
  • Add textDocument/rename and textDocument/prepareRename support for buf lsp serve.
  • Fix panic in LSP for empty option paths.
  • Fix support for multi-arch image manifests for buf beta registry plugin push.

v1.61.0

  • Disable format on unknown or invalid syntax.
  • Fix regression in LSP functionality for well-known types.
  • Fix browser open for buf registry login in WSL2.
  • Fix panic in LSP for EOF lookups.
  • Fix --create flag for buf push to avoid errors on already existing modules if create is disallowed.

v1.60.0

  • Fix LSP published diagnostics to filter to the opened file.
  • Add textDocument/documentSymbol support for buf lsp serve.
  • Fix LSP navigation for cached modules which could cause import paths to become unresolvable.
  • Update default value of --timeout flag to 0, which results in no timeout by default.

v1.59.0

  • Promote buf beta lsp to buf lsp serve. Command buf beta lsp is now deprecated.
  • Add textDocument/References support for buf lsp serve.
  • Add autocompletion for basic keywords, syntax, package and imports for buf lsp serve.
  • Add workspace symbol queries for buf lsp serve.
  • Fix positional encoding for diagnostics in buf lsp serve.
  • Fix format updates for buf lsp serve.
  • Fix syntax highlighting on semantic tokens for buf lsp serve.
  • Fix buf format to remove extraneous whitespace before the first header node (syntax/package declarations).

v1.58.0

  • Update PROTOVALIDATE lint rule to check IGNORE_IF_ZERO_VALUE on fields that track presence.
  • Fix buf format on fields with missing field number tags.
  • Optimize include and exclude path handling for workspaces to avoid unnecessary file system operations. This change can result in a performance improvement for large workspaces.
  • Fix buf curl for HTTP/2 services with --http2-prior-knowledge flag set.

v1.57.2

  • Fix buf curl for HTTP/2 services.

v1.57.1

  • Minor bug fixes and dependency upgrades.

v1.57.0

  • Update exclude types to remove unused options reducing the size of generated code.
  • Add gitlab-code-quality error format to print errors in the GitLab Code Quality format for buf lint and buf breaking.
  • Add source_control_url to json outputs for buf registry {module, plugin} commit commands.
Changelog

Sourced from @​bufbuild/buf's changelog.

[v1.62.1] - 2025-12-29

  • Fix default behavior for swift_prefix to remain unset when no override is provided in managed mode.

[v1.62.0] - 2025-12-29

  • Add swift_prefix to managed mode.
  • Add textDocument/rename and textDocument/prepareRename support for buf lsp serve.
  • Fix panic in LSP for empty option paths.
  • Fix support for multi-arch image manifests for buf beta registry plugin push.

[v1.61.0] - 2025-11-25

  • Disable format on unknown or invalid syntax.
  • Fix regression in LSP functionality for well-known types.
  • Fix browser open for buf registry login in WSL2.
  • Fix panic in LSP for EOF lookups.
  • Fix --create flag for buf push to avoid errors on already existing modules if create is disallowed.

[v1.60.0] - 2025-11-14

  • Fix LSP published diagnostics to filter to the opened file.
  • Add textDocument/documentSymbol support for buf lsp serve.
  • Fix LSP navigation for cached modules which could cause import paths to become unresolvable.
  • Update default value of --timeout flag to 0, which results in no timeout by default.
  • Update PROTOVALIDATE lint rule to allow for custom rules that do not have id or message fields.

[v1.59.0] - 2025-10-20

  • Promote buf beta lsp to buf lsp serve. Command buf beta lsp is now deprecated.
  • Add textDocument/References support for buf lsp serve.
  • Add autocompletion for basic keywords, syntax, package and imports for buf lsp serve.
  • Add workspace symbol queries for buf lsp serve.
  • Fix positional encoding for diagnostics in buf lsp serve.
  • Fix format updates for buf lsp serve.
  • Fix syntax highlighting on semantic tokens for buf lsp serve.
  • Fix buf format to remove extraneous whitespace before the first header node (syntax/package declarations).

[v1.58.0] - 2025-10-09

  • Update PROTOVALIDATE lint rule to check IGNORE_IF_ZERO_VALUE on fields that track presence.
  • Fix buf format on fields with missing field number tags.
  • Optimize include and exclude path handling for workspaces to avoid unnecessary file system operations. This change can result in a performance improvement for large workspaces.
  • Fix buf curl for HTTP/2 services with --http2-prior-knowledge flag set.

[v1.57.2] - 2025-09-16

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​bufbuild/buf since your current version.


Updates @bufbuild/protoc-gen-es from 2.6.3 to 2.10.2

Release notes

Sourced from @​bufbuild/protoc-gen-es's releases.

v2.10.2

What's Changed

Full Changelog: bufbuild/protobuf-es@v2.10.1...v2.10.2

v2.10.1

What's Changed

New Contributors

Full Changelog: bufbuild/protobuf-es@v2.10.0...v2.10.1

v2.10.0

What's Changed

New Contributors

Full Changelog: bufbuild/protobuf-es@v2.9.0...v2.10.0

v2.9.0

What's Changed

Full Changelog: bufbuild/protobuf-es@v2.8.0...v2.9.0

v2.8.0

What's ChangedDescription has been truncated

@dependabot
Bump the deps group across 1 directory with 12 updates
ebbb85b 
Bumps the deps group with 11 updates in the /express directory:

| Package | From | To |
| --- | --- | --- |
| [@bufbuild/protobuf](https://github.com/bufbuild/protobuf-es/tree/HEAD/packages/protobuf) | `2.6.3` | `2.10.2` |
| [@connectrpc/connect](https://github.com/connectrpc/connect-es/tree/HEAD/packages/connect) | `2.0.3` | `2.1.1` |
| [@connectrpc/connect-express](https://github.com/connectrpc/connect-es/tree/HEAD/packages/connect-express) | `2.0.3` | `2.1.1` |
| [@connectrpc/connect-web](https://github.com/connectrpc/connect-es/tree/HEAD/packages/connect-web) | `2.0.3` | `2.1.1` |
| [express](https://github.com/expressjs/express) | `5.1.0` | `5.2.1` |
| [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express) | `5.0.3` | `5.0.6` |
| [tsx](https://github.com/privatenumber/tsx) | `4.20.3` | `4.21.0` |
| [@bufbuild/buf](https://github.com/bufbuild/buf) | `1.56.0` | `1.62.1` |
| [@bufbuild/protoc-gen-es](https://github.com/bufbuild/protobuf-es/tree/HEAD/packages/protoc-gen-es) | `2.6.3` | `2.10.2` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.2.0` | `25.0.3` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.2` | `5.9.3` |



Updates `@bufbuild/protobuf` from 2.6.3 to 2.10.2
- [Release notes](https://github.com/bufbuild/protobuf-es/releases)
- [Commits](https://github.com/bufbuild/protobuf-es/commits/v2.10.2/packages/protobuf)

Updates `@connectrpc/connect` from 2.0.3 to 2.1.1
- [Release notes](https://github.com/connectrpc/connect-es/releases)
- [Commits](https://github.com/connectrpc/connect-es/commits/v2.1.1/packages/connect)

Updates `@connectrpc/connect-express` from 2.0.3 to 2.1.1
- [Release notes](https://github.com/connectrpc/connect-es/releases)
- [Commits](https://github.com/connectrpc/connect-es/commits/v2.1.1/packages/connect-express)

Updates `@connectrpc/connect-node` from 2.0.3 to 2.1.1
- [Release notes](https://github.com/connectrpc/connect-es/releases)
- [Commits](https://github.com/connectrpc/connect-es/commits/v2.1.1/packages/connect-node)

Updates `@connectrpc/connect-web` from 2.0.3 to 2.1.1
- [Release notes](https://github.com/connectrpc/connect-es/releases)
- [Commits](https://github.com/connectrpc/connect-es/commits/v2.1.1/packages/connect-web)

Updates `express` from 5.1.0 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.1.0...v5.2.1)

Updates `@types/express` from 5.0.3 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

Updates `tsx` from 4.20.3 to 4.21.0
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.20.3...v4.21.0)

Updates `@bufbuild/buf` from 1.56.0 to 1.62.1
- [Release notes](https://github.com/bufbuild/buf/releases)
- [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md)
- [Commits](bufbuild/buf@v1.56.0...v1.62.1)

Updates `@bufbuild/protoc-gen-es` from 2.6.3 to 2.10.2
- [Release notes](https://github.com/bufbuild/protobuf-es/releases)
- [Commits](https://github.com/bufbuild/protobuf-es/commits/v2.10.2/packages/protoc-gen-es)

Updates `@types/express` from 5.0.3 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

Updates `@types/node` from 24.2.0 to 25.0.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript` from 5.9.2 to 5.9.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.2...v5.9.3)

---
updated-dependencies:
- dependency-name: "@bufbuild/protobuf"
  dependency-version: 2.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@connectrpc/connect"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@connectrpc/connect-express"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@connectrpc/connect-node"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@connectrpc/connect-web"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: tsx
  dependency-version: 4.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@bufbuild/buf"
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@bufbuild/protoc-gen-es"
  dependency-version: 2.10.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: "@types/node"
  dependency-version: 25.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: deps
- dependency-name: typescript
  dependency-version: 5.9.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jan 1, 2026
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 1, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Feb 1, 2026
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/express/deps-f8553bda79 branch February 1, 2026 07:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants