📦 Update dependencies (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@google-cloud/logging (source)	11.2.0 → 12.2.0
@google-cloud/storage (source)	7.17.0 → 8.4.0
express (source)	4.21.2 → 5.3.0

---

Release Notes

googleapis/google-cloud-node (@​google-cloud/logging)

v12.2.0

Features

• tools: Add individual CLI flags for Bun monkey patches (#​9533) (a5eec89)

v12.1.0

Features

• PNPM workspace (#​8973) (1ea27c9)

v12.0.1

Bug Fixes

• Ensure node 22 dependencies are up to date so they get the latest patches for core and handwritten libraries (#​9116) (fad57ff)

v12.0.0

⚠ BREAKING CHANGES

• Update logging to minimum Node version of 22. (#​9048)

Features

• Update logging to minimum Node version of 22. (#​9048) (afb70ac), refs #​8985

v11.4.0

Features

• logging: Split GAPIC from the logging handwritten package (#​8929) (ee21766)

v11.3.0

Features

• Consolidate prettierignore and prettierrc files: handwritten (#​8081) (a241532)

Bug Fixes

• Remove dependency on the eventid package (#​8687) (d258379)

v11.2.3

Bug Fixes

• deps: Remove vulnerable dependency uuid (#​8120) (3ec901e)

v11.2.2

Bug Fixes

• Bump all node submodules (#​8178) (9fd76ef)

v11.2.1

Bug Fixes

• logging: Specifying resourceNames should fetch logs only from those resources (#​1597) (ff7899f)

googleapis/google-cloud-node (@​google-cloud/storage)

v8.4.0

Features

• Update API sources and regenerate (#​9554) (8b6837a)

v8.3.0

Features

• tools: Add individual CLI flags for Bun monkey patches (#​9533) (a5eec89)

v8.2.0

Features

• PNPM workspace (#​8973) (1ea27c9)

v8.1.0

Features

• storage: Add IpFilter support to bucket metadata (#​8623) (30c91c8)
• storage: Add x-goog-gcs-idempotency-token header (#​8837) (0df2e55)
• storage: Support copying CSEK-encrypted files to non-CSEK destinations (#​8771) (953328f)

Bug Fixes

• storage: Resolve strict linter and TypeScript errors (#​9198) (cee5338)

v8.0.1

Bug Fixes

• Upgrade storage dependencies to corresponding Node 22 versions for core, handwritten and generated libraries (#​9135) (a3d9092)

v8.0.0

⚠ BREAKING CHANGES

• Update storage to minimum Node version of 22. (#​9079)

Features

• Update storage to minimum Node version of 22. (#​9079) (5830779), refs #​8985

v7.22.0

Features

• storage: Add deleteSourceObjects option to combine/compose method (#​8444) (43abc45)

Bug Fixes

• storage: Destroy local read stream on upload write failure to prevent resource leaks (#​8752) (77dab53), refs #​7325
• storage: Pass signingEndpoint to URLSigner in file.getSignedUrl (#​8982) (b001807)
• storage: Resolve Node compatibility crashes, security vulnerability, and stream hangs (#​8622) (512ba79)
• storage: Set application/json Content-Type for impersonated ADC requests (#​8419) (292c688)

v7.21.0

Features

• storage: Enable CRC32C validation by default in transfer manager (#​8350) (86086a6)

Bug Fixes

• deps: Remove vulnerable dependency uuid (#​8120) (3ec901e)

v7.19.0

Features

• Enable full object checksum validation on JSON path (#​2687) (08a8962)

Bug Fixes

• deps: Update dependency fast-xml-parser to v5 [security] (#​2713) (420935a)

v7.18.0

Features

• listBuckets: Add support for returning partial success (#​2678) (c7004da)

v7.17.3

Bug Fixes

• 🐛 fix the issue 2667, do not mutate object given to options … (#​2668) (8a9f259)
• Revert implement path containment to prevent traversal attacks (254b6b2)

v7.17.2

Bug Fixes

• Common Service: should retry a request failed (#​2652) (b38b5d2)
• Implement path containment to prevent traversal attacks (#​2654) (08d7abf)

v7.17.1

Bug Fixes

• Respect useAuthWithCustomEndpoint flag for resumable uploads (#​2637) (707b4f2)

expressjs/express (express)

v5.3.0

Compare Source

=====

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #​4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #​7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #​7057 and #​7478, and @​cyphercodes in #​7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #​7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #​7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #​5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #​6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #​7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #​6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #​7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

• Upgrade body-parser to ^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalid limit option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid limit values now throw at parser initialization instead of being ignored - by @​Mayvis in #​7390

⚡ Performance

• Avoid duplicate Content-Type header processing in res.send() when sending string responses without an explicit Content-Type header - by @​bjohansebas in #​6991

v5.2.1

Compare Source

=======================

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

v5.2.0

Compare Source

========================

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
• deps: body-parser@^2.2.1
• A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

v5.1.0

Compare Source

========================

• Add support for Uint8Array in res.send()
• Add support for ETag option in res.sendFile()
• Add support for multiple links with the same rel in res.links()
• Add funding field to package.json
• perf: use loop for acceptParams
• refactor: prefix built-in node module imports
• deps: remove setprototypeof
• deps: remove safe-buffer
• deps: remove utils-merge
• deps: remove methods
• deps: remove depd
• deps: debug@^4.4.0
• deps: body-parser@^2.2.0
• deps: router@^2.2.0
• deps: content-type@^1.0.5
• deps: finalhandler@^2.1.0
• deps: qs@^6.14.0
• deps: server-static@2.2.0
• deps: type-is@2.0.1

v5.0.1

Compare Source

==========

• Update cookie semver lock to address CVE-2024-47764

v5.0.0

Compare Source

=========================

• remove:
  • path-is-absolute dependency - use path.isAbsolute instead
• breaking:
  • res.status() accepts only integers, and input must be greater than 99 and less than 1000
    • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
    • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
  • deps: send@​1.0.0
  • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
• change:
  • res.clearCookie will ignore user provided maxAge and expires options
• deps: cookie-signature@^1.2.1
• deps: debug@​4.3.6
• deps: merge-descriptors@^2.0.0
• deps: serve-static@^2.1.0
• deps: qs@​6.13.0
• deps: accepts@^2.0.0
• deps: mime-types@^3.0.0
  • application/javascript => text/javascript
• deps: type-is@^2.0.0
• deps: content-disposition@^1.0.0
• deps: finalhandler@^2.0.0
• deps: fresh@^2.0.0
• deps: body-parser@^2.0.1
• deps: send@^1.1.0

v4.22.3

Compare Source

What's Changed

• Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 by @​baryman in #​7135
• feat: allow conditional revalidation for QUERY requests (v4) by @​Cherry in #​7377
• deps: qs@~6.16.0 by @​lazerg in #​7440
• ci: add npm staged publication with dist-tag support by @​UlisesGascon in #​7465
• 4.22.3 by @​UlisesGascon in #​7466

New Contributors

• @​baryman made their first contribution in #​7135
• @​lazerg made their first contribution in #​7440

Full Changelog: expressjs/express@v4.22.2...v4.22.3

v4.22.2

Compare Source

What's Changed

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

New Contributors

• @​suuuuuuminnnnnn made their first contribution in #​7021
• @​SAY-5 made their first contribution in #​7181

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

Compare Source

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

• Release: 4.22.1 by @​UlisesGascon in #​6934

Full Changelog: expressjs/express@4.22.0...v4.22.1

v4.22.0

Compare Source

Important: Security

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

• Refactor: improve readability by @​sazk07 in #​6190
• ci: add support for Node.js@​23.0 by @​UlisesGascon in #​6080
• Method functions with no path should error by @​wesleytodd in #​5957
• ci: updated github actions ci workflow by @​Phillip9587 in #​6323
• ci: reorder npm i steps to fix ci for older node versions by @​Phillip9587 in #​6336
• Backport: ci: add node.js 24 to test matrix by @​Phillip9587 in #​6506
• chore(4.x): wider range for query test skip by @​jonchurch in #​6513
• use tilde notation for certain dependencies by @​UlisesGascon in #​6905
• deps: qs@​6.14.0 by @​UlisesGascon in #​6909
• deps: use tilde notation for qs by @​Phillip9587 in #​6919
• Release: 4.22.0 by @​UlisesGascon in #​6921

Full Changelog: expressjs/express@4.21.2...4.22.0

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • "after 12am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.