Bump the production group across 1 directory with 19 updates

[dependabot]

Bumps the production group with 19 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.9.1	0.128.0
@octokit/rest	20.1.2	22.0.1
@octokit/webhooks	12.3.2	14.2.0
@slack/web-api	6.13.0	8.1.1
diff	5.2.2	9.0.0
dotenv	16.6.1	18.0.4
ejs	3.1.10	6.0.1
express	4.22.1	5.2.1
fs-extra	11.3.0	11.4.1
openai	4.104.0	7.23.0
pino	9.7.0	10.3.1
probot	13.4.7	14.3.2
simple-git	3.36.0	4.0.1
tree-sitter	0.20.6	0.25.1
tree-sitter-java	0.20.2	0.23.5
tree-sitter-javascript	0.20.4	0.25.0
tree-sitter-python	0.20.4	0.25.0
tree-sitter-rust	0.20.4	0.24.0
tree-sitter-typescript	0.20.5	0.23.2

Updates @anthropic-ai/sdk from 0.9.1 to 0.128.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.128.0

0.128.0 (2026-09-22)

Full Changelog: sdk-v0.127.0...sdk-v0.128.0

Features

• api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (eff2748)

Bug Fixes

• api: share one evaluated_permission enum across Managed Agents events (0c1cc0f)
• tools: addTools() takes effect straight away (#773) (1ccdad0)
• tools: leave reply-only params off the tool runner's compaction request (#769) (8afc336)

Chores

• docs: add descriptions to the Dreams API reference (ea4ddd1)
• docs: add descriptions to the User Profiles API reference (ea4ddd1)
• docs: add memory store descriptions to the Managed Agents API reference (ea4ddd1)
• docs: improve descriptions in the Dreams API reference (971c54a)
• docs: simplify the session thread agent type description (ccf71a2)
• docs: update diagnostics field descriptions on beta messages (c0b8746)
• internal: add property-based tests for partial JSON parsing (#776) (3ffac09)

sdk: v0.127.0

0.127.0 (2026-09-18)

Full Changelog: sdk-v0.126.0...sdk-v0.127.0

Features

• api: add group with display_name to rate limits, deprecate group_type (2575d97)
• tools: add compactBeforeNextTurn() to the tool runner (#682) (9f75ca6)

Bug Fixes

• BetaMessageStream: stop coercing a null compaction_delta content into "null" (#655) (dbd6845)
• client: don't retry requests whose body is a stream or iterator (eebc1b9)
• client: join multiple anthropic-beta values with a comma and no space (#638) (e0cb1ff)
• client: make pagination exports on the client namespace type-only (5adea1f)
• internal: drop jest from tsconfig types (60588af)
• middleware: echo a streamed compaction summary in the fallback continuation (#657) (2e0f004)
• tools: keep $defs when transformJSONSchema root is a $ref (#687) (57a9f30)

Performance Improvements

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.128.0 (2026-09-22)

Full Changelog: sdk-v0.127.0...sdk-v0.128.0

Features

• api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (eff2748)

Bug Fixes

• api: share one evaluated_permission enum across Managed Agents events (0c1cc0f)
• tools: addTools() takes effect straight away (#773) (1ccdad0)
• tools: leave reply-only params off the tool runner's compaction request (#769) (8afc336)

Chores

• docs: add descriptions to the Dreams API reference (ea4ddd1)
• docs: add descriptions to the User Profiles API reference (ea4ddd1)
• docs: add memory store descriptions to the Managed Agents API reference (ea4ddd1)
• docs: improve descriptions in the Dreams API reference (971c54a)
• docs: simplify the session thread agent type description (ccf71a2)
• docs: update diagnostics field descriptions on beta messages (c0b8746)
• internal: add property-based tests for partial JSON parsing (#776) (3ffac09)

0.127.0 (2026-09-18)

Full Changelog: sdk-v0.126.0...sdk-v0.127.0

Features

• api: add group with display_name to rate limits, deprecate group_type (2575d97)
• tools: add compactBeforeNextTurn() to the tool runner (#682) (9f75ca6)

Bug Fixes

• BetaMessageStream: stop coercing a null compaction_delta content into "null" (#655) (dbd6845)
• client: don't retry requests whose body is a stream or iterator (eebc1b9)
• client: join multiple anthropic-beta values with a comma and no space (#638) (e0cb1ff)
• client: make pagination exports on the client namespace type-only (5adea1f)
• internal: drop jest from tsconfig types (60588af)
• middleware: echo a streamed compaction summary in the fallback continuation (#657) (2e0f004)
• tools: keep $defs when transformJSONSchema root is a $ref (#687) (57a9f30)

Performance Improvements

• client: skip formatting request details when debug logging is off (2b29ed2)

... (truncated)

Commits

• 1926adb Merge pull request #1208 from anthropics/release-please--branches--main--chan...
• 162c8b1 chore: release main
• 3ffac09 chore(internal): add property-based tests for partial JSON parsing (#776)
• e40ce27 test(ecosystem): check that unused imports tree-shake to nothing
• 1ccdad0 fix(tools): addTools() takes effect straight away (#773)
• 8afc336 fix(tools): leave reply-only params off the tool runner's compaction request ...
• eff2748 feat(api): add support for claude-opus-5-5, inline tool definitions and MCP t...
• 06e5f9b codegen metadata
• 0c1cc0f fix(api): share one evaluated_permission enum across Managed Agents events
• c0b8746 chore(docs): update diagnostics field descriptions on beta messages
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.

Updates @octokit/rest from 20.1.2 to 22.0.1

Release notes

Sourced from @​octokit/rest's releases.

v22.0.1

22.0.1 (2025-10-31)

Bug Fixes

• deps: update octokit monorepo (major) (#538) (ded2f17)

v22.0.0

22.0.0 (2025-05-25)

Bug Fixes

• deps: update octokit monorepo (major) (#504) (77530ab)

BREAKING CHANGES

• deps: Drop support for NodeJS v18
• deps: Remove deprecated Projects endpoints
• deps: Remove deprecated Copilot usage metrics endpoints

v21.1.1

21.1.1 (2025-02-14)

Bug Fixes

• deps: update Octokit dependencies to mitigate ReDos [security] (#484) (ca256c3)

v21.1.0

21.1.0 (2025-01-08)

Features

• new endpoints, bump Octokit deps to fix Deno (#477) (908b1c8)

v21.0.2

21.0.2 (2024-08-16)

Bug Fixes

• docs: update to react 18 and latest gatsby deps (#462) (9a80f06), closes #216 #230 #460

... (truncated)

Commits

• daa3ec9 ci(action): update actions/setup-node action to v6 (#534)
• 1dec0c7 ci(action): update peter-evans/create-or-update-comment action to v5 (#531)
• ded2f17 fix(deps): update octokit monorepo (major) (#538)
• 0e0eaea chore(deps): update dependency @​types/node to v24 (#537)
• c04acc8 chore(deps): update vitest monorepo to v4 (major) (#536)
• e6dd306 chore(deps): update dependency undici to v7 (#474)
• 5f380d0 build(deps-dev): Bump form-data from 4.0.2 to 4.0.4 in /docs (#520)
• dc6827d build(deps-dev): Bump tar-fs from 2.1.2 to 2.1.3 in /docs (#516)
• 77530ab fix(deps): update octokit monorepo (major) (#504)
• d07b719 build(deps): Bump vite from 6.2.5 to 6.3.4 (#509)
• Additional commits viewable in compare view

Updates @octokit/webhooks from 12.3.2 to 14.2.0

Release notes

Sourced from @​octokit/webhooks's releases.

v14.2.0

14.2.0 (2025-12-03)

Features

• new secret_scanning_alert.assigned, secret_scanning_alert.unassigned, issue_dependencies events (#1189) (b47e4b0)

v14.1.3

14.1.3 (2025-07-31)

Bug Fixes

• avoid Object.assign to avoid hiding potential type errors (#1166) (4c36fce)

v14.1.2

14.1.2 (2025-07-30)

Bug Fixes

• normalize trailing slashes (#1167) (ea2a89d)

v14.1.1

14.1.1 (2025-07-10)

Bug Fixes

• createLogger should not recreate the logger object if it already exists (#1162) (18f0be5)

v14.1.0

14.1.0 (2025-06-29)

Features

• add validate-event-name (#1161) (6965d70)

v14.0.2

14.0.2 (2025-06-05)

Bug Fixes

• types: add missing enterprise key (#1158) (4e83370)

v14.0.1

14.0.1 (2025-06-04)

... (truncated)

Commits

• b47e4b0 feat: new secret_scanning_alert.assigned, `secret_scanning_alert.unassigned...
• 5ca3206 ci(action): update github/codeql-action action to v4 (#1178)
• 07b617c ci(action): update actions/setup-node action to v6 (#1179)
• 3e7c815 build(deps): lock file maintenance (#1177)
• be82b3d ci(action): update peter-evans/create-or-update-comment action to v5 (#1175)
• 73ec1fc chore(deps): update vitest monorepo to v4 (major) (#1181)
• 4b4ad0f build(deps): lock file maintenance (#1174)
• 2a24466 ci(action): update actions/checkout action to v5 (#1170)
• aea297e ci(action): update actions/setup-node action to v5 (#1172)
• 302105e build(deps): lock file maintenance (#1168)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/webhooks since your current version.

Updates @slack/web-api from 6.13.0 to 8.1.1

Release notes

Sourced from @​slack/web-api's releases.

@​slack/web-api@​8.1.1

Patch Changes

• 0ee1d99: fix: revert internal packages requiring esm loading for backward compatible support (#2711)

@​slack/web-api@​8.1.0

Minor Changes

• 955e6b9: feat(web-api): add support for admin.users.getExpiration

• 4322e14: feat(web-api): add agents.sessions.rename and agents.sessions.setStatus

• 4ba30a1: feat(web-api): add session_status to chat.stopStream arguments

• bff3398: feat(web-api): add webapi response changes as of 2026-08-21

  Regenerate response types with new stable response properties (e.g. agent_session on message-bearing responses, ListView grouping/sort/filter fields, bots.info connector/workflow flags).

  Two fields are removed from UsersListResponse, neither of which is a real success-response property:

  • Member.is_connector_bot — not returned by users.list; this flag is surfaced on bots.info (added here to BotsInfoResponse).
  • arg — an error-response echo field, not part of a successful users.list body.

• f5fd35a: feat(web-api): add blocks.validate method

Patch Changes

• Updated dependencies [916d8e9]
• Updated dependencies [f5e9a01]
  • @​slack/types@​3.1.0

@​slack/web-api@​8.0.0

Major Changes

• fc98c8c: Drop Node.js 18 support. The minimum supported Node.js version is now 20.

• fc98c8c: Redesigned error handling to use proper Error subclasses instead of plain objects with a code property.

  Migration: Replace if (error.code === ErrorCode.PlatformError) with if (error instanceof WebAPIPlatformError). All error classes extend a common SlackError base class (which extends Error), so you can also catch all SDK errors with if (error instanceof SlackError).

  New error class hierarchy:

  • SlackError (abstract base)
    • WebAPIPlatformError — Slack API returned ok: false
    • WebAPIRequestError — Network/transport failure (original error in cause)
    • WebAPIHTTPError — Non-200 HTTP status from Slack
    • WebAPIRateLimitedError — HTTP 429 with retryAfter seconds
    • WebAPIFileUploadInvalidArgumentsError — Invalid file upload arguments
    • WebAPIFileUploadReadFileDataError — Failed to read file data for upload

  Removed factory functions (these were internal but exported — use new with the corresponding class instead):

  • errorWithCode()
  • platformErrorFromResult() → new WebAPIPlatformError(...)

... (truncated)

Commits

• e026671 chore: release (#2719)
• 0ee1d99 ci: adjust outputs of changeset releases to reattempt most recent releases (#...
• 05502d9 chore: release (#2713)
• 11b81e1 chore(deps): bump changesets/action from 1.9.0 to 2.1.1 (#2714)
• 7a3d149 chore(deps-dev): bump @​changesets/cli from 2.31.1 to 3.0.1 (#2716)
• 67f8a74 chore(deps-dev): bump @​biomejs/biome from 2.5.8 to 2.5.10 (#2717)
• aef66ac fix: revert internal packages requiring esm loading for backward compatible s...
• c663dc0 chore: release (#2681)
• 4ba30a1 feat(web-api): add session_status to chat.stopStream arguments (#2708)
• 916d8e9 feat(types): add agent_session_stopped and agent_session_title_changed events...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​slack/web-api since your current version.

Updates diff from 5.2.2 to 9.0.0

Changelog

Sourced from diff's changelog.

9.0.0

(All changes part of PR #672.)

• ES5 support is dropped. parsePatch now uses TextDecoder and Uint8Array, which are not available in ES5, and TypeScript is now compiled with the "es6" target. From now on, I intend to freely use any features that are deemed "Widely available" by Baseline. Users who need ES5 support should stick to version 8.

• C-style quoted strings in filename headers are now properly supported.

  When the name of either the old or new file in a patch contains "special characters", both GNU diff and Git quote the filename in the patch's headers and escape special characters using the same escape sequences that are used in string literals in C, including octal escapes for all non-ASCII characters. Previously, jsdiff had very little support for this; parsePatch would remove the quotes, and unescape any escaped backslashes, but would not unescape other escape sequences. formatPatch, meanwhile, did not quote or escape special characters at all.

  Now, parsePatch parses all the possible escape sequences that GNU diff (or Git) ever output, and formatPatch quotes and escapes filenames containing special characters in the same way GNU diff does.

• formatPatch now omits file headers when oldFileName or newFileName in the provided patch object are undefined, regardless of the headerOptions parameter. (Previously, it would treat the absence of oldFileName or newFileName as indicating the filename was the word "undefined" and emit headers --- undefined / +++ undefined.)

• formatPatch no longer outputs trailing tab characters at the end of ---/+++ headers.

  Previously, if formatPatch was passed a patch object to serialize that had empty strings for the oldHeader or newHeader property, it would include a trailing tab character after the filename in the --- and/or +++ file header. Now, this scenario is treated the same as when oldHeader/newHeader is undefined - i.e. the trailing tab is omitted.

• formatPatch no longer mutates its input when serializing a patch containing a hunk where either the old or new content contained zero lines. (Such a hunk occurs only when the hunk has no context lines and represents a pure insertion or pure deletion, which for instance will occur whenever one of the two files being diffed is completely empty.) Previously formatPatch would provide the correct output but also mutate the oldLines or newLines property on the hunk, changing the meaning of the underlying patch.

• Git-style patches are now supported by parsePatch, formatPatch, and reversePatch.

  Patches output by git diff can include some features that are unlike those output by GNU diff, and therefore not handled by an ordinary unified diff format parser. An ordinary diff simply describes the differences between the content of two files, but Git diffs can also indicate, via "extended headers", the creation or deletion of (potentially empty) files, indicate that a file was renamed, and contain information about file mode changes. Furthermore, when these changes appear in a diff in the absence of a content change (e.g. when an empty file is created, or a file is renamed without content changes), the patch will contain no associated ---/+++ file headers nor any hunks.

  jsdiff previously did not support parsing Git's extended headers, nor hunkless patches. Now parsePatch parses some of the extended headers, parses hunkless Git patches, and can determine filenames (e.g. from the extended headers) when parsing a patch that includes no --- or +++ file headers. The additional information conveyed by the extended headers we support is recorded on new fields on the result object returned by parsePatch. See isGit and subsequent properties in the docs in the README.md file.

  formatPatch now outputs extended headers based on these new Git-specific properties, and reversePatch respects them as far as possible (with one unavoidable caveat noted in the README.md file).

• Unpaired file headers now cause parsePatch to throw.

  It remains acceptable to have a patch with no file headers whatsoever (e.g. one that begins with a @@ hunk header on the very first line), but a patch with only a --- header or only a +++ header is now considered an error.

• parsePatch is now more tolerant of "trailing garbage"

  That is: after a patch, or between files/indexes in a patch, it is now acceptable to have arbitrary lines of "garbage" (so long as they unambiguously have no syntactic meaning - e.g. trailing garbage that leads with a +, -, or and thus is interpretable as part of a hunk still triggers a throw).

  This means we no longer reject patches output by tools that include extra data in "garbage" lines not understood by generic unified diff parsers. (For example, SVN patches can include "Property changes on:" lines that generic unified diff parsers should discard as garbage; jsdiff previously threw errors when encountering them.)

  This change brings jsdiff's behaviour more in line with GNU patch, which is highly permissive of "garbage".

• The oldFileName and newFileName fields of StructuredPatch are now typed as string | undefined instead of string. This type change reflects the (pre-existing) reality that parsePatch can produce patches without filenames (e.g. when parsing a patch that simply contains hunks with no file headers).

8.0.4

• #667 - fix another bug in diffWords when used with an Intl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space), diffWords would previously crash. Now this case is handled correctly.

8.0.3

• #631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).
• #635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.

... (truncated)

Commits

• ed13aca Update version in package.json and in release notes (#683)
• 7a49317 Bump dependencies again (#682)
• afe5aec Add Git support, and otherwise variously improve & fix parsePatch (and other ...
• 2e46779 Fix a typo (#679)
• dd2f994 8.0.4 release (#678)
• 3cc4384 Update docs on releasing to reflect migration to yarn berry (#677)
• 6fc2aa6 yarn up '*' && yarn up -R '**' (#676)
• af7393a yarn up '*' && yarn up -R '**' (#670)
• 4b5d180 Fix another bug in diffWords's "intlSegmenter" mode (#667)
• 10da50c yarn up '*' && yarn up -R '**' (#666)
• Additional commits viewable in compare view

Updates dotenv from 16.6.1 to 18.0.4

Changelog

Sourced from dotenv's changelog.

18.0.4 (2026-09-25)

Changed

• import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

• NEW: Dotenv now has a CLI. (#1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

faster than Node native parseEnv!

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#1037)

... (truncated)

Commits

• 86804c0 18.0.4
• 2403db5 changelog
• 75b775e npm audit
• 7e1750c Merge pull request #1064 from motdotla/dependabot/npm_and_yarn/ip-address-10.7.2
• a6ade63 Merge pull request #1063 from motdotla/import
• 288b0d7 patch test
• 00da912 Bump ip-address from 10.2.0 to 10.7.2
• e6b5816 import 'dotenv/config' should still be defaulting to quiet
• 3646ac5 Merge pull request #1061 from motdotla/fast
• 83fc961 report dotenv vs native vs dotenv.fast
• Additional commits viewable in compare view

Updates ejs from 3.1.10 to 6.0.1

Release notes

Sourced from ejs's releases.

v6.0.1

Version 6.0.1

v5.0.2

Version 5.0.2

v5.0.1

Version 5.0.1

v4.0.1

Version 4.0.1

Changelog

Sourced from ejs's changelog.

EJS Version 5.0.1 Release Notes

Overview

EJS version 5.0.1 is a major release that removes deprecated options, fixes template behavior with custom delimiters, improves the CLI and build pipeline, and simplifies the package by moving Jake to a dev-only dependency.

Major Changes

Deprecated Option Removed

• Removed client option (Fixes #746): The legacy client flag and related code have been removed. This option produced browser-oriented template functions by inlining escape and rethrow helpers; it was unmaintained and broken. Use the standard browser bundle (ejs.min.js) or compile templates for the client using your own build setup.

Bug Fixes

• Custom delimiters and whitespace-slurp tags (Fixed #780): Whitespace-slurp tags (<%_ and _%> by default) now respect custom openDelimiter, delimiter, and closeDelimiter. Previously, the slurp regex was hardcoded to <%/%>, so custom delimiters did not work correctly with <%_/_%>-style tags.

CLI & Build

• CLI no longer depends on Jake: The ejs CLI now uses a bundled argument parser (lib/esm/parseargs.js / lib/cjs/parseargs.js) instead of the Jake program module. Jake remains a devDependency for the build (lint, compile, browserify, minify, test).
• Jake moved to devDependencies: Jake was moved from dependencies to devDependencies, so installing ejs as a dependency no longer pulls in Jake.
• Minification fix: The minify task now minifies the browserified ejs.js bundle (output of the browserify task) instead of lib/cjs/ejs.js, so the browser bundle is correctly minified.

Documentation & Examples

• JSDoc updates: Removed references to the client option and ClientFunction from options and template-function documentation.
• Examples: examples/client-compilation.html and examples/express/app.js updated to remove use of the client option; Express example no longer passes client: true.
• README: Removed broken link to the third-party EJS playground.

Code Quality

• Tests: Removed tests that targeted the removed client option behavior.
• Utils: Removed unused client-related code from lib/esm/utils.js.

Breaking Changes

Removed client Option

• Option removed: The client option is no longer supported. Passing client: true (or any value) is ignored; no error is thrown, but no

... (truncated)

Commits

• 2c41365 Version 6.0.1
• 409fec9 Moved missed shim
• 7097026 Update README
• f78de72 Updated README
• dc84d04 Major version bump
• 82e73e5 Proto poisoning hardening
• 34c68a1 Ecosystem smoke tests
• 8d1af6c Linting warnings
• c62fe52 Move shim
• dff76b5 Packaging improvements
• Additional commits viewable in compare view

Updates express from 4.22.1 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

• Release: 5.2.1 by @​UlisesGascon in expressjs/express#6933

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

• build(deps): bump github/codeql-action from 3.28.11 to 3.28.13 by @​dependabot[bot] in expressjs/express#6429
• Refactor: simplify acceptsLanguages implementation using spread operator by @​Ayoub-Mabrouk in expressjs/express#6137
• increased code coverage of utils.js file by @​ashish3011 in expressjs/express#6386
• chore: remove duplicate word by @​dufucun in expressjs/express#6456
• build(deps): bump github/codeql-action from 3.28.13 to 3.28.16 by @​dependabot[bot] in expressjs/express#6498
• build(deps): bump actions/setup-node from 4.3.0 to 4.4.0 by @​dependabot[bot] in expressjs/express#6497
• build(deps): bump actions/download-artifact from 4.2.1 to 4.3.0 by @​dependabot[bot] in expressjs/express#6496
• ci: add node.js 24 to test matrix by @​Phillip9587 in expressjs/express#6504
• ci: update codeql config by @​Phillip9587 in expressjs/express#6488
• chore: wider range for query test skip by @​jonchurch in expressjs/express#6512
• chore: fix typos in test by @​noritaka1166 in expressjs/express#6535
• ci: disable credential persistence for checkout actions by @​mertssmnoglu in expressjs/express#6522
• ci: allow manual triggering of workflow by @​shivarm in expressjs/express#6515
• test: add coverage for app.listen() variants by @​kgarg1 in expressjs/express#6476
• docs: move documentation and charters to the discussions and .github … by @​bjohansebas in expressjs/express#6427
• build(deps): bump github/codeql-action from 3.28.16 to 3.28.18 by @​dependabot[bot] in expressjs/express#6549
• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @​dependabot[bot] in expressjs/express#6548
• chore: enforce explicit Buffer import and add lint rule by @​shivarm in expressjs/express#6525
• chore: use node protocol for querystring by @​shivarm in expressjs/express#6520
• chore: fix typo by @​mountdisk in expressjs/express#6609
• build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by @​dependabot[bot] in expressjs/express#6618
• add deprecation warnings for redirect arguments undefined by @​bjohansebas in expressjs/express#6405
• ci: run CI when the markdown changes by @​bjohansebas in expressjs/express#6632
• doc: fix CONTRIBUTING link by @​jonchurch in expressjs/express#6653
• doc: update contributing guidelines and code of conduct links by @​ShubhamOulkar in expressjs/express#6601
• build(deps-dev): bump morgan from 1.10.0 to 1.10.1 by @​dependabot[bot] in expressjs/express#6679
• build(deps-dev): bump cookie-session from 2.1.0 to 2.1.1 by @​dependabot[bot] in expressjs/express#6678
• lint: add --fix flag to automatic fix linting issue by @​shivarm in expressjs/express#6644
• chore: ignore yarn.lock file and update example by @​shivarm in expressjs/express#6588
• lib: use req.socket over deprecated req.connection by @​bjohansebas in expressjs/express#6705
• doc: update express app example by @​shivarm in expressjs/express#6718
• build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @​dependabot[bot] in expressjs/express#6675
• Remove history.md from being packaged on publish by @​sheplu in expressjs/express#6780

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • The prior r...

    Description has been truncated