Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates - #5620

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-025e7aa5e2
Open

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates#5620
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-025e7aa5e2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package From To
morgan 1.12.0 1.12.1
multer 2.3.0 2.4.0
sharp 0.35.4 0.35.5
simple-git 3.36.0 4.0.1
@simple-git/argv-parser 1.1.1 2.0.1

Updates morgan from 1.12.0 to 1.12.1

Release notes

Sourced from morgan's releases.

1.12.1

Important

What's Changed

New Contributors

Full Changelog: expressjs/morgan@1.12.0...1.12.1

Changelog

Sourced from morgan's changelog.

1.12.1

Commits
  • b1272e7 1.12.1 (#386)
  • 4b695ed fix: escape double quotes in log fields
  • 0f74eca build(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#384)
  • e399e3c build(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#383)
  • 1e86b34 build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.37.9 (#382)
  • 87c0afd build(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#381)
  • 286b000 test: run CI on Windows and macOS (#379)
  • 5a5902a docs: fix typos across documentation (#378)
  • See full diff in compare view

Updates multer from 2.3.0 to 2.4.0

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from multer's changelog.

2.4.0

  • Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
  • Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
  • Accept a function for limits, called with the request, to set limits per request (#1133)
  • Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
  • Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
  • Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
  • Allow multer.diskStorage() to be called without options (#1471)
  • Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
  • Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
  • Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
  • Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
  • Files skipped by fileFilter no longer count towards maxCount (#1426)
  • Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
  • Remove the concat-stream dependency (#1356)
  • Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
  • Docs: add FormData upload examples (#896)
  • Docs: remove the translated READMEs (#1463)
  • Internal: run the test suite on macOS (#1464)
Commits
  • 35979e5 2.4.0 (#1469)
  • b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
  • e6bcd7d chore(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#1475)
  • 00dec43 chore(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#1476)
  • 8d5c3b7 feat: allow diskStorage without options (#1471)
  • 02f6e82 fix: report the decoded filename on LIMIT_FILE_SIZE (#1478)
  • bc3f72d fix: decode escaped field names, not just filenames (#1473)
  • 2661325 docs: add JSDoc to the public API (#1467)
  • 53337f9 fix: remove late-completing uploads aborted before the engine names them
  • 7f2c9ab feat: add streamHandler option to feed busboy from pre-consumed bodies (#1466)
  • Additional commits viewable in compare view

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract and rotate operations. #4606

  • Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract operation. #4606

... (truncated)

Commits
  • 51a990f Release v0.35.5
  • 96de105 Upgrade to sharp-libvips v1.3.4
  • 3a61390 CI: Configure Dependabot with all package.json locations
  • 4940c50 Improve gain map support for rotate/flip/flop ops
  • 20654aa Prerelease v0.35.5-rc.1
  • ef4f934 CI: Upgrade to Ubuntu 26.04
  • 358df95 Upgrade to libvips v8.18.7
  • 49f4903 Improve gain map support for rotate-then-extract #4606
  • 0e2e55e Silence a couple of compiler/static analysis warnings
  • cef3b8c Improve gain map support for extract operation #4606
  • Additional commits viewable in compare view

Updates simple-git from 3.36.0 to 4.0.1

Release notes

Sourced from simple-git's releases.

simple-git@4.0.1

Patch Changes

  • 365f52d: Prepare package.json before publishing.

simple-git@4.0.0

Major Changes

  • 98864c6: Major upgrade to v4. In this version:

    • Removed previously available default export, now uses a consistently named simpleGit export.
    • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
    • Removed legacy gitP export (change to using the main simpleGit export).
    // v3 - previously supported imports
import simpleGit from "simple-git";
import { gitP } from "simple-git";
import simpleGit from "simple-git/promise";
const simpleGit = require("simple-git");
// v4 - consolidates to a single supported import
import { simpleGit } from "simple-git";
const { simpleGit } = require("simple-git");

    • Prevents the use of abbreviated long-form git options:
    // v3 - allowed the use of unambiguous long-form options
git.raw("clone", "--conf=user.name=me", "...");
// v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
git.raw("fetch", "--config=user.name=me", "...");

    • Ambient environment variables are filtered before passing into the git child process.
    // v3
process.env.FOO = "bar";
process.env.GIT_TEMPLATE_DIR = "./some/path";
simpleGit().raw("clone"); // git child process can see both environment variables
// v4
process.env.FOO = "bar";
process.env.GIT_TEMPLATE_DIR = "./some/path";
simpleGit().raw("clone"); // git child process now sees only FOO
simpleGit({

... (truncated)

Changelog

Sourced from simple-git's changelog.

4.0.1

Patch Changes

  • 365f52d: Prepare package.json before publishing.

4.0.0

Major Changes

  • 98864c6: Major upgrade to v4. In this version:

    • Removed previously available default export, now uses a consistently named simpleGit export.
    • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
    • Removed legacy gitP export (change to using the main simpleGit export).
    // v3 - previously supported imports
import simpleGit from "simple-git";
import { gitP } from "simple-git";
import simpleGit from "simple-git/promise";
const simpleGit = require("simple-git");
// v4 - consolidates to a single supported import
import { simpleGit } from "simple-git";
const { simpleGit } = require("simple-git");

    • Prevents the use of abbreviated long-form git options:
    // v3 - allowed the use of unambiguous long-form options
git.raw("clone", "--conf=user.name=me", "...");
// v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
git.raw("fetch", "--config=user.name=me", "...");

    Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev, @​D7EAD, @​dellalibera, @​gdegrange, @​bilguunbicktivism, @​cruzryan, @​b1ue0ceanRun, @​oss-security-shopify for identifying the vulnerability.

    • Ambient environment variables are filtered before passing into the git child process.
    // v3
process.env.FOO = "bar";
process.env.GIT_TEMPLATE_DIR = "./some/path";
simpleGit().raw("clone"); // git child process can see both environment variables

... (truncated)

Commits

Updates @simple-git/argv-parser from 1.1.1 to 2.0.1

Release notes

Sourced from @​simple-git/argv-parser's releases.

@​simple-git/argv-parser@​2.0.1

Patch Changes

  • 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

    Thanks to @​oss-security-shopify for identifying the vulnerability.

@​simple-git/argv-parser@​2.0.0

Major Changes

  • 98864c6: Updates ahead of the v4 release for simple-git.

    • Adds support for TypeScript declaration maps

    • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

    • Adds detection for includeIf.<condition>.path, thanks to @​NotAFlightRisk for identifying the vulnerability

Patch Changes

  • c427fba: Additional argument parser vulnerability checks:

    • Thanks to @​mrillicit for identifying include.path, filter.*.process
    • Thanks to @​tejas619 for identifying url.*.insteadOf

  • 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

    Thanks to @​threalwinky and @​nuc13us for identifying.

  • dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

    • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
    • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

    These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

  • d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

    Thanks to @​gdegrange for the vulnerability report.

  • d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

    Thanks to @​sec-reex for the vulnerability report.

  • Updated dependencies [98864c6]

    • @​simple-git/args-pathspec@​1.0.4
Changelog

Sourced from @​simple-git/argv-parser's changelog.

2.0.1

Patch Changes

  • 68874c2: Add VISUAL environment variable to set of allowUnsafeEditor environment variables.

    Thanks to @​oss-security-shopify for identifying the vulnerability.

2.0.0

Major Changes

  • 98864c6: Updates ahead of the v4 release for simple-git.

    • Adds support for TypeScript declaration maps

    • Exports the isGitEnvKey helper to detect whether an environment variable can be used to configure a git operation

    • Adds detection for includeIf.<condition>.path, thanks to @​bhaswanthc, @​NotAFlightRisk, @​oss-security-shopify for identifying the vulnerability

Patch Changes

  • c427fba: Additional argument parser vulnerability checks:

  • 1bb14df: Vulnerability detection expanded to include pager.*, uploadpack.packObjectsHook, difftool.*.cmd and use of the GIT_CONFIG_PARAMETERS environment variable

    Thanks to @​threalwinky and @​nuc13us for identifying.

  • dfeb116: Vulnerability detection expanded to cover configuration delivered through path-taking global options, where the dangerous value is a file on disk rather than a token simple-git can inspect:

    • --exec-path names the directory git loads built-in commands and remote helpers from, and is blocked under the new allowUnsafeExec category along with the GIT_EXEC_PATH environment variable (previously grouped under allowUnsafeConfigPaths)
    • --git-dir, --work-tree and -C cause git to read the configuration of the repository they name, and are blocked under allowUnsafeConfigPaths

    These options are only detected when supplied before the git sub-command and with a value - used as getters (git.raw('rev-parse', '--git-dir')) or as task options (git.raw('commit', '-C', 'HEAD~1')) they are unaffected.

  • d762810: Add allowUnsafeExec detection to rebase -x and rebase --exec.

    Thanks to @​gdegrange for the vulnerability report.

  • d762810: Add allowUnsafeCommandBinaries detection to configuring trailer.<token>.cmd and trailer.<token>.command.

    Thanks to @​sec-reex for the vulnerability report.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 5 up…
1263872 
…dates

Bumps the npm_and_yarn group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [morgan](https://github.com/expressjs/morgan) | `1.12.0` | `1.12.1` |
| [multer](https://github.com/expressjs/multer) | `2.3.0` | `2.4.0` |
| [sharp](https://github.com/lovell/sharp) | `0.35.4` | `0.35.5` |
| [simple-git](https://github.com/steveukx/git-js/tree/HEAD/simple-git) | `3.36.0` | `4.0.1` |
| [@simple-git/argv-parser](https://github.com/steveukx/git-js/tree/HEAD/packages/argv-parser) | `1.1.1` | `2.0.1` |



Updates `morgan` from 1.12.0 to 1.12.1
- [Release notes](https://github.com/expressjs/morgan/releases)
- [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md)
- [Commits](expressjs/morgan@1.12.0...1.12.1)

Updates `multer` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.3.0...v2.4.0)

Updates `sharp` from 0.35.4 to 0.35.5
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.4...v0.35.5)

Updates `simple-git` from 3.36.0 to 4.0.1
- [Release notes](https://github.com/steveukx/git-js/releases)
- [Changelog](https://github.com/steveukx/git-js/blob/main/simple-git/CHANGELOG.md)
- [Commits](https://github.com/steveukx/git-js/commits/simple-git@4.0.1/simple-git)

Updates `@simple-git/argv-parser` from 1.1.1 to 2.0.1
- [Release notes](https://github.com/steveukx/git-js/releases)
- [Changelog](https://github.com/steveukx/git-js/blob/main/packages/argv-parser/CHANGELOG.md)
- [Commits](https://github.com/steveukx/git-js/commits/@simple-git/argv-parser@2.0.1/packages/argv-parser)

---
updated-dependencies:
- dependency-name: morgan
  dependency-version: 1.12.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: multer
  dependency-version: 2.4.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: simple-git
  dependency-version: 4.0.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@simple-git/argv-parser"
  dependency-version: 2.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot mentioned this pull request Oct 6, 2026
Closed
@azure-pipelines

azure-pipelines Bot commented Oct 6, 2026

Copy link
Copy Markdown
Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@markcowl Mark Cowlishaw (markcowl) Awaiting requested review from markcowl markcowl is a code owner
@timotheeguerin Timothee Guerin (timotheeguerin) Awaiting requested review from timotheeguerin timotheeguerin is a code owner
@xirzec Jeff Fisher (xirzec) Awaiting requested review from xirzec xirzec is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants