chore(deps): bump the indexer-dependencies group across 1 directory with 10 updates

[dependabot]

Bumps the indexer-dependencies group with 9 updates in the /indexer directory:

Package	From	To
@prisma/client	5.22.0	7.9.1
dotenv	16.6.1	17.4.2
express	4.22.2	5.2.1
@types/express	4.17.25	5.0.6
node-cron	3.0.3	4.6.0
@types/node	20.19.43	26.1.2
prisma	5.22.0	7.9.1
tsx	4.22.4	4.23.1
typescript	5.9.3	7.0.2

Updates @prisma/client from 5.22.0 to 7.9.1

Release notes

Sourced from @​prisma/client's releases.

7.9.1

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

This fixes prisma/prisma#29780.

It does not actually affect @prisma/dev or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab
2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):
echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh
echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash
tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish
tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

prisma.mp4

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

</tr></table> 

... (truncated)

Commits

• b829850 ci: upgrade pnpm to 11 to restore pnpm audit (#29725)
• 280fd56 fix(client): mask each quoted string in maskQuery independently (#29723)
• 4da3774 fix(client): reject invalid raw dates (#29697)
• a7cec97 chore(deps): update engines to 7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6...
• 58f8439 fix(client): pin pg-protocol in prisma-client-imports-postgres e2e test (#29687)
• 918cf5d fix(client): improve adapter-related Prisma 7 error messages (#29624)
• 93da6ea ci(e2e): shard client e2e suite across 3 jobs to fix chronic timeouts (#29619)
• 3937779 fix: remove duplicate 'the the' in test comments (#29610)
• fda8fbc chore(deps): bump @​prisma/dev to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...
• 0036baf fix(client-engine-runtime): surface unmapped driver errors as user-facing P20...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​prisma/client since your current version.

Updates @stellar/stellar-sdk from 11.3.0 to 16.2.0

Release notes

Sourced from @​stellar/stellar-sdk's releases.

v16.2.0

v16.2.0

Added

• rpc.Server.simulateTransaction accepts an optional useUpgradedAuth flag, and contract.AssembledTransaction accepts it as a method option (useUpgradedAuth) or per-call (tx.simulate({ useUpgradedAuth: true })). When set, RPC simulation records v2 address credentials (CAP-71) instead of the legacy v1 credentials. It only affects the recording auth modes and is silently ignored on hosts that cannot emit v2 credentials. The flag is deprecated from the start: it is transitional and becomes a no-op once the network returns v2 credentials by default (protocol 28) (#1562).
• @stellar/stellar-sdk/base subpath export: import offline primitives like StrKey and Keypair without loading Horizon, RPC, or the SEP helpers and their networking dependencies (#1550).
• authorizeEntry / authorizeInvocation signing callbacks now receive the 32-byte signing payload (hash(preimage.toXDR())) as a second argument alongside the preimage, so signers — including HSMs and remote signers that only accept a digest — never have to re-derive it. Existing single-argument callbacks are unaffected (#1532).
• authorizeEntry / authorizeInvocation now support non-Ed25519 signers: the signing callback may return { signatureScVal: xdr.ScVal, address?: string }, and the given ScVal is written verbatim as the credentials' signature — no Ed25519 verification, no {public_key, signature} map, no scvVec wrapping. This lets smart-wallet / custom-account contracts (whose __check_auth expects its own signature structure) use the helper instead of hand-rolling preimage construction and credential assembly. The optional address routes the signature to a specific credential node, like forAddress (#1530).
• contract.Signer: an interface pairing an address with the SEP-43 signTransaction and optional signAuthEntry methods, plus contract.KeypairSigner, a Keypair-backed implementation. The signTransaction and signAuthEntry options — on ClientOptions, MethodOptions, and AssembledTransaction's sign / signAndSend / signAuthEntries — now accept a Signer or a bare Keypair in addition to a callback. Adds the contract.SignTransactionLike and contract.SignAuthEntryLike types. When signAuthEntries gets a Signer or Keypair, its default target address is now the signer's own address rather than publicKey. Existing callbacks work unchanged; one type-only caveat: the option fields are no longer plain function types, so derive callback shapes from contract.SignTransaction / contract.SignAuthEntry instead of the option field (#1567).
• contract.Spec now reads SEP-48 event declarations: events() and findEvent(name, occurrence?) list a contract's declared events, parseEvent(topics, data) decodes a fired event into { name, data }, with topic-carried params merged into data (returns undefined when nothing matches), and eventTopicFilter(name, topicValues?, occurrence?) builds a getEvents filter row, with "*" for any topic param left unset. Generated client bindings gain a typed <Name>Event interface per event, a ContractEvent union, a parseEvent() method, and per-event <name>EventFilter() methods. A contract may declare the same event name more than once (composed modules each emitting their own transfer); each declaration gets its own interface and filter method, and occurrence — a 0-based index in declaration order — selects among them. Generated names receive a numeric suffix when needed to avoid a collision, and stellar-sdk bindings warns about duplicate declarations and renames. Adds the contract.ParsedEvent type (#1556, #1565, #1572).

Fixed

• Spec.scValToNative now handles contract values typed as Val (scSpecTypeVal) by delegating to the generic scValToNative converter, mirroring the encoding-side support added in #1485. Decoding a response containing a Val-typed string, symbol, vec, or map — e.g. a struct with a Vec<Val> field — no longer throws ScSpecType scSpecTypeVal was not string or symbol; each value decodes to its natural native representation (Address → string, u32 → number, Symbol → string, vecs/maps recurse). (#1551)

Full Changelog: stellar/js-stellar-sdk@v16.1.0...v16.2.0

v16.1.0

v16.1.0

Added

• inspectAuthEntry(entry): decodes a xdr.SorobanAuthorizationEntry into a typed summary — credential type, authorizing address, nonce, signatureExpirationLedger, and a signers list covering top-level credentials and CAP-71 delegates. Adds the AuthEntryInfo, AuthEntrySigner, AuthEntrySignature, and AuthEntryCredentialType types (#1529).
• checkAuthEntryReadiness(entry, currentLedgerSeq): reports whether an auth entry is ready to submit — { ready, expired, unsignedBy } — as a pure decode with no network call (#1529).
• Spec.nativeToScVal now supports contract parameters typed as Val (scSpecTypeVal), so raw JS values can be passed to Val-typed arguments without building xdr.ScVal objects by hand (#1485).
• rpc.Server.queryContract<T>(contractId, method, args?, networkPassphrase?): a one-line read-only contract call that returns { result, isReadCall }, no transaction assembly or signing. Works for Wasm contracts and built-in Stellar Asset Contracts (SACs) (#1502).
• rpc.Server.getContractMethods(contractId, networkPassphrase?): lists a contract's callable methods and their signatures. Adds the Api.ContractMethod and Api.ContractMethodInput types (#1502).
• rpc.Server.getContractInstance(contractId): returns a contract's xdr.ScContractInstance (#1501).
• contract.Client.from, fromWasm, and fromWasmHash are now generic (<T>) and return Client & T, giving typed contract methods without code generation. T defaults to unknown, so untyped calls are unchanged (#1502).
• ClientOptions.server: pass an existing rpc.Server to contract.Client.from to reuse its transport instead of building a new one (#1502).
• Keypair.signMessage(message) and Keypair.verifyMessage(message, signature): sign and verify arbitrary messages per SEP-53, matching the Python and Java SDKs and stellar-cli (#1513).
• TransactionFailedError: raised by Horizon.Server.submitTransaction and submitAsyncTransaction when Horizon rejects a transaction with result codes. Extends BadResponseError and adds getResultCodes() and getTransactionResult() (#1526).

Changed

• HorizonApi.TransactionFailedResultCodes gained the transaction result codes it was missing: tx_bad_sponsorship, tx_bad_min_seq_age_or_gap, tx_malformed, tx_soroban_invalid, and tx_frozen_key_accessed (#1526).
• contract.Client.from now supports built-in Stellar Asset Contracts (SACs), building the client from the embedded SAC spec instead of downloading Wasm (#1501).
• rpc.Server.getContractWasmByContractId now rejects a SAC with a structured { code: 400 } error pointing to contract.Client.from. The not-found rejection is now { code: 404, message: "Could not obtain contract instance from server" } (#1501).
• The UMD (dist/) build now sets inlineDynamicImports so the single-file bundle stays whole despite the SAC spec's lazy import() (#1501).

Fixed

• Horizon.Server.submitTransaction and submitAsyncTransaction now reject with SDK error types on HTTP failures, as documented: a TransactionFailedError for Horizon result codes, a BadResponseError otherwise. The wrapping branch used to be unreachable, so failures leaked through as raw HTTP-client errors. err.response.data and err.response.status are unchanged; the original error is now preserved as err.cause (#1526).
• Federation.Server resolution methods (resolveAddress, resolveAccountId, resolveTransactionId, forDomain) had the same unreachable branch and now reject HTTP failures with BadResponseError (#1526).
• contract.AssembledTransaction.needsNonInvokerSigningBy now treats an empty scvVec signature as unsigned, matching the existing scvVoid check. Such entries used to count as already signed and were left off the list (#1529).

... (truncated)

Changelog

Sourced from @​stellar/stellar-sdk's changelog.

v16.2.0

Added

• rpc.Server.simulateTransaction accepts an optional useUpgradedAuth flag, and contract.AssembledTransaction accepts it as a method option (useUpgradedAuth) or per-call (tx.simulate({ useUpgradedAuth: true })). When set, RPC simulation records v2 address credentials (CAP-71) instead of the legacy v1 credentials. It only affects the recording auth modes and is silently ignored on hosts that cannot emit v2 credentials. The flag is deprecated from the start: it is transitional and becomes a no-op once the network returns v2 credentials by default (protocol 28) (#1562).
• @stellar/stellar-sdk/base subpath export: import offline primitives like StrKey and Keypair without loading Horizon, RPC, or the SEP helpers and their networking dependencies (#1550).
• authorizeEntry / authorizeInvocation signing callbacks now receive the 32-byte signing payload (hash(preimage.toXDR())) as a second argument alongside the preimage, so signers — including HSMs and remote signers that only accept a digest — never have to re-derive it. Existing single-argument callbacks are unaffected (#1532).
• authorizeEntry / authorizeInvocation now support non-Ed25519 signers: the signing callback may return { signatureScVal: xdr.ScVal, address?: string }, and the given ScVal is written verbatim as the credentials' signature — no Ed25519 verification, no {public_key, signature} map, no scvVec wrapping. This lets smart-wallet / custom-account contracts (whose __check_auth expects its own signature structure) use the helper instead of hand-rolling preimage construction and credential assembly. The optional address routes the signature to a specific credential node, like forAddress (#1530).
• contract.Signer: an interface pairing an address with the SEP-43 signTransaction and optional signAuthEntry methods, plus contract.KeypairSigner, a Keypair-backed implementation. The signTransaction and signAuthEntry options — on ClientOptions, MethodOptions, and AssembledTransaction's sign / signAndSend / signAuthEntries — now accept a Signer or a bare Keypair in addition to a callback. Adds the contract.SignTransactionLike and contract.SignAuthEntryLike types. When signAuthEntries gets a Signer or Keypair, its default target address is now the signer's own address rather than publicKey. Existing callbacks work unchanged; one type-only caveat: the option fields are no longer plain function types, so derive callback shapes from contract.SignTransaction / contract.SignAuthEntry instead of the option field (#1567, closes #1462 and #1063).
• contract.Spec now reads SEP-48 event declarations: events() and findEvent(name, occurrence?) list a contract's declared events, parseEvent(topics, data) decodes a fired event into { name, data }, with topic-carried params merged into data (returns undefined when nothing matches), and eventTopicFilter(name, topicValues?, occurrence?) builds a getEvents filter row, with "*" for any topic param left unset. Generated client bindings gain a typed <Name>Event interface per event, a ContractEvent union, a parseEvent() method, and per-event <name>EventFilter() methods. A contract may declare the same event name more than once (composed modules each emitting their own transfer); each declaration gets its own interface and filter method, and occurrence — a 0-based index in declaration order — selects among them. Generated names receive a numeric suffix when needed to avoid a collision, and stellar-sdk bindings warns about duplicate declarations and renames. Adds the contract.ParsedEvent type (#1556, #1565, #1572).

Fixed

• Spec.scValToNative now handles contract values typed as Val (scSpecTypeVal) by delegating to the generic scValToNative converter, mirroring the encoding-side support added in #1485. Decoding a response containing a Val-typed string, symbol, vec, or map — e.g. a struct with a Vec<Val> field — no longer throws ScSpecType scSpecTypeVal was not string or symbol; each value decodes to its natural native representation (Address → string, u32 → number, Symbol → string, vecs/maps recurse). (#1551)

v16.1.0

Added

• inspectAuthEntry(entry): decodes a xdr.SorobanAuthorizationEntry into a typed summary — credential type, authorizing address, nonce, signatureExpirationLedger, and a signers list covering top-level credentials and CAP-71 delegates. Adds the AuthEntryInfo, AuthEntrySigner, AuthEntrySignature, and AuthEntryCredentialType types (#1529).
• checkAuthEntryReadiness(entry, currentLedgerSeq): reports whether an auth entry is ready to submit — { ready, expired, unsignedBy } — as a pure decode with no network call (#1529).
• Spec.nativeToScVal now supports contract parameters typed as Val (scSpecTypeVal), so raw JS values can be passed to Val-typed arguments without building xdr.ScVal objects by hand (#1485).
• rpc.Server.queryContract<T>(contractId, method, args?, networkPassphrase?): a one-line read-only contract call that returns { result, isReadCall }, no transaction assembly or signing. Works for Wasm contracts and built-in Stellar Asset Contracts (SACs) (#1502).
• rpc.Server.getContractMethods(contractId, networkPassphrase?): lists a contract's callable methods and their signatures. Adds the Api.ContractMethod and Api.ContractMethodInput types (#1502).
• rpc.Server.getContractInstance(contractId): returns a contract's xdr.ScContractInstance (#1501).
• contract.Client.from, fromWasm, and fromWasmHash are now generic (<T>) and return Client & T, giving typed contract methods without code generation. T defaults to unknown, so untyped calls are unchanged (#1502).
• ClientOptions.server: pass an existing rpc.Server to contract.Client.from to reuse its transport instead of building a new one (#1502).
• Keypair.signMessage(message) and Keypair.verifyMessage(message, signature): sign and verify arbitrary messages per SEP-53, matching the Python and Java SDKs and stellar-cli (#1513).
• TransactionFailedError: raised by Horizon.Server.submitTransaction and submitAsyncTransaction when Horizon rejects a transaction with result codes. Extends BadResponseError and adds getResultCodes() and getTransactionResult() (#1526).

Changed

• HorizonApi.TransactionFailedResultCodes gained the transaction result codes it was missing: tx_bad_sponsorship, tx_bad_min_seq_age_or_gap, tx_malformed, tx_soroban_invalid, and tx_frozen_key_accessed (#1526).
• contract.Client.from now supports built-in Stellar Asset Contracts (SACs), building the client from the embedded SAC spec instead of downloading Wasm (#1501).
• rpc.Server.getContractWasmByContractId now rejects a SAC with a structured { code: 400 } error pointing to contract.Client.from. The not-found rejection is now { code: 404, message: "Could not obtain contract instance from server" } (#1501).
• The UMD (dist/) build now sets inlineDynamicImports so the single-file bundle stays whole despite the SAC spec's lazy import() (#1501).

Fixed

• Horizon.Server.submitTransaction and submitAsyncTransaction now reject with SDK error types on HTTP failures, as documented: a TransactionFailedError for Horizon result codes, a BadResponseError otherwise. The wrapping branch used to be unreachable, so failures leaked through as raw HTTP-client errors. err.response.data and err.response.status are unchanged; the original error is now preserved as err.cause (#1526).
• Federation.Server resolution methods (resolveAddress, resolveAccountId, resolveTransactionId, forDomain) had the same unreachable branch and now reject HTTP failures with BadResponseError (#1526).
• contract.AssembledTransaction.needsNonInvokerSigningBy now treats an empty scvVec signature as unsigned, matching the existing scvVoid check. Such entries used to count as already signed and were left off the list (#1529).

... (truncated)

Commits

• 0336c41 feat(contract): add occurrence param to Spec.findEvent (#1574)
• 22b013a Support duplicate event names in generated bindings (#1572)
• 513da91 release V16.2.0 (#1569)
• b1a4814 Review fixes for event bindings and contract signers (#1570)
• c93797c Add useUpgradedAuth simulation flag for CAP-71 v2 address credentials (#1568)
• 52717e4 Accept a Signer or Keypair wherever signTransaction is accepted (#1567)
• 5aaba3c Event bindings review fixes (#1565)
• 1e1ba81 Bump astro from 6.4.8 to 7.1.0 (#1557)
• aa00dd1 feat(bindings): generate typed event interfaces and filter helpers (#1556)
• 9526bd3 Extend authorizeEntry signing callbacks: payload argument and custom signatur...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​stellar/stellar-sdk since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates dotenv from 16.6.1 to 17.4.2

Changelog

Sourced from dotenv's changelog.

17.4.2 (2026-04-12)

Changed

• Improved skill files - tightened up details (#1009)

17.4.1 (2026-04-05)

Changed

• Change text injecting to injected (#1005)

17.4.0 (2026-04-01)

Added

• Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

• Tighten up logs: ◇ injecting env (14) from .env (#1003)

17.3.1 (2026-02-12)

Changed

• Fix as2 example command in README and update spanish README

17.3.0 (2026-02-12)

Added

• Add a new README section on dotenv’s approach to the agentic future.

Changed

• Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

17.2.4 (2026-02-05)

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

17.2.3 (2025-09-29)

Changed

• Fixed typescript error definition (#912)

... (truncated)

Commits

• f116f70 17.4.2
• 3a81612 fix visual order of faq
• 13f55a8 Merge branch 'skill'
• 4bbbf73 reorganize faq
• c3da64b Merge pull request #1009 from motdotla/skill
• 6f743b1 update source
• fc2c624 update skill
• 972315b Tighten up skill
• 2795fce reorganize faq
• d5495d4 adjust skill
• Additional commits viewable in compare view

Updates express from 4.22.2 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

• Release: 5.2.1 by @​UlisesGascon in expressjs/express#6933

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

• build(deps): bump github/codeql-action from 3.28.11 to 3.28.13 by @​dependabot[bot] in expressjs/express#6429
• Refactor: simplify acceptsLanguages implementation using spread operator by @​Ayoub-Mabrouk in expressjs/express#6137
• increased code coverage of utils.js file by @​ashish3011 in expressjs/express#6386
• chore: remove duplicate word by @​dufucun in expressjs/express#6456
• build(deps): bump github/codeql-action from 3.28.13 to 3.28.16 by @​dependabot[bot] in expressjs/express#6498
• build(deps): bump actions/setup-node from 4.3.0 to 4.4.0 by @​dependabot[bot] in expressjs/express#6497
• build(deps): bump actions/download-artifact from 4.2.1 to 4.3.0 by @​dependabot[bot] in expressjs/express#6496
• ci: add node.js 24 to test matrix by @​Phillip9587 in expressjs/express#6504
• ci: update codeql config by @​Phillip9587 in expressjs/express#6488
• chore: wider range for query test skip by @​jonchurch in expressjs/express#6512
• chore: fix typos in test by @​noritaka1166 in expressjs/express#6535
• ci: disable credential persistence for checkout actions by @​mertssmnoglu in expressjs/express#6522
• ci: allow manual triggering of workflow by @​shivarm in expressjs/express#6515
• test: add coverage for app.listen() variants by @​kgarg1 in expressjs/express#6476
• docs: move documentation and charters to the discussions and .github … by @​bjohansebas in expressjs/express#6427
• build(deps): bump github/codeql-action from 3.28.16 to 3.28.18 by @​dependabot[bot] in expressjs/express#6549
• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @​dependabot[bot] in expressjs/express#6548
• chore: enforce explicit Buffer import and add lint rule by @​shivarm in expressjs/express#6525
• chore: use node protocol for querystring by @​shivarm in expressjs/express#6520
• chore: fix typo by @​mountdisk in expressjs/express#6609
• build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by @​dependabot[bot] in expressjs/express#6618
• add deprecation warnings for redirect arguments undefined by @​bjohansebas in expressjs/express#6405
• ci: run CI when the markdown changes by @​bjohansebas in expressjs/express#6632
• doc: fix CONTRIBUTING link by @​jonchurch in expressjs/express#6653
• doc: update contributing guidelines and code of conduct links by @​ShubhamOulkar in expressjs/express#6601
• build(deps-dev): bump morgan from 1.10.0 to 1.10.1 by @​dependabot[bot] in expressjs/express#6679
• build(deps-dev): bump cookie-session from 2.1.0 to 2.1.1 by @​dependabot[bot] in expressjs/express#6678
• lint: add --fix flag to automatic fix linting issue by @​shivarm in expressjs/express#6644
• chore: ignore yarn.lock file and update example by @​shivarm in expressjs/express#6588
• lib: use req.socket over deprecated req.connection by @​bjohansebas in expressjs/express#6705
• doc: update express app example by @​shivarm in expressjs/express#6718
• build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @​dependabot[bot] in expressjs/express#6675
• Remove history.md from being packaged on publish by @​sheplu in expressjs/express#6780

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
• deps: body-parser@^2.2.1
• A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

• Add support for Uint8Array in res.send()
• Add support for ETag option in res.sendFile()
• Add support for multiple links with the same rel in res.links()
• Add funding field to package.json
• perf: use loop for acceptParams
• refactor: prefix built-in node module imports
• deps: remove setprototypeof
• deps: remove safe-buffer
• deps: remove utils-merge
• deps: remove methods
• deps: remove depd
• deps: debug@^4.4.0
• deps: body-parser@^2.2.0
• deps: router@^2.2.0
• deps: content-type@^1.0.5
• deps: finalhandler@^2.1.0
• deps: qs@^6.14.0
• deps: server-static@2.2.0
• deps: type-is@2.0.1

5.0.1 / 2024-10-08

• Update cookie semver lock to address CVE-2024-47764

5.0.0 / 2024-09-10

• remove:
  • path-is-absolute dependency - use path.isAbsolute instead
• breaking:
  • res.status() accepts only integers, and input must be greater than 99 and less than 1000
    • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
    • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
  • deps: send@1.0.0

... (truncated)

Commits

• dbac741 5.2.1
• 697547c Revert "sec: security patch for CVE-2024-51999"
• 4007ad1 Release: 5.2.0 (#6920)
• 2f64f68 sec: security patch for CVE-2024-51999
• ed0ba3f build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#6928)
• 8eace46 build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 (#6929)
• 30bae81 build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 (#6930)
• 758d435 deps: body-parser@^2.2.1 (#6922)
• 77bcd52 docs: update emeritus triagers (#6890)
• f33caf1 Nominate to @​efekrskl for triage team (#6888)
• Additional commits viewable in compare view

Updates @types/express from 4.17.25 to 5.0.6

Commits

• See full diff in compare view

Updates node-cron from 3.0.3 to 4.6.0

Release notes

Sourced from node-cron's releases.

v4.6.0

4.6.0 (2026-07-04)

Added

• add cron.shutdown(timeout?) for graceful process teardown (#589) (35f1a61)
• add unref option for heartbeat timers (#588) (35cb140)
• day-of-month: Quartz-style W, L-n and ? modifiers (#570) (cbe379b)
• emit task:failed when a background daemon exits unexpectedly (7bd91d6)
• support cron expression nicknames (@​yearly, @​daily, etc.) (#579) (6a6e14e)

Fixed

• background task state transition on stop/destroy without fork (#584) (9dbc6de)
• clear jitter timeout on runner stop (#583) (28b8146)
• CommonJS type resolution (#608) (ee9d294)
• correct falied->failed typo in daemon task error log (#594) (66c6961)
• correct shutdown listener typing that broke the build (#595) (7aac3ad)
• correlate execute() by id, isolate event hooks, and stop counting manual runs toward maxExecutions (#607) (0f039a9)
• daemon serialized task state with wrong field name (#587) (688d465)
• expand inverted ranges with wrap-around instead of silently swapping (#602) (a10ae53)
• harden cron.shutdown() teardown (#598) (a0b0d1f)
• kill orphan child process on background task stop/destroy timeout (#582) (8179e10)
• make concurrent background start() await the daemon and time out coordinator lookups (#605) (446f03a)
• make lifecycle calls on a destroyed task safe no-ops (#600) (7fa9795)
• prevent double destroy on registry remove (#585) (8ae9f06)
• release-please: match existing v-prefixed tags (#575) (e43c152)
• runner promise bugs that could hang scheduling or crash process (#581) (0ae62be)
• unref the IPC channel so background tasks let the process exit (#599) (534e593)
• validate the cron expression when scheduling a task (#603) (196e6cd)
• validate() consistency and multi-asterisk expansion (#606) (8cf41c4)
• weekday 7-to-0 conversion corrupting ranges (#580) (c8a3943)

Changed

• replace chai and sinon with native vitest assertions (#590) (d29d07a)

v4.5.0

Added

• lastRun() introspection getter on ScheduledTask: returns { date, result } after a successful execution, { date, error } after a failed one, or null before the first run.
• Extended day-of-week tokens: <weekday>#<nth> (nth weekday of the month, e.g. 1#1 for the first Monday) and <weekday>L (last weekday of the month, e.g. 5L for the last Friday).

Performance

• Cache Intl.DateTimeFormat instances per timezone instead of rebuilding on every call.
• Parse the cron expression once per TimeMatcher instead of re-parsing in MatcherWalker.
• Compute the GMT offset lazily (only when formatting ISO strings, not during the next-run search).
• Replace crypto.randomBytes with crypto.randomUUID for internal ID generation.

... (truncated)

Changelog

Sourced from node-cron's changelog.

4.6.0 (2026-07-04)

Added

• add cron.shutdown(timeout?) for graceful process teardown (#589) (35f1a61)
• add unref option for heartbeat timers (#588) (35cb140)
• day-of-month: Quartz-style W, L-n and ? modifiers (#570) (cbe379b)
• emit task:failed when a background daemon exits unexpectedly (7bd91d6)
• support cron expression nicknames (@​yearlyDescription has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, indexer. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.