chore(deps): bump the everything-else group across 1 directory with 6 updates by dependabot[bot] · Pull Request #6558 · redis/RedisInsight

dependabot · 2026-10-26T00:07:16Z

Bumps the everything-else group with 6 updates in the /redisinsight/api directory:

Package	From	To
body-parser	`2.3.0`	`2.4.0`
express	`5.2.1`	`5.3.0`
uuid	`14.0.2`	`14.0.3`
@types/adm-zip	`0.5.8`	`0.6.0`
@types/lodash	`4.17.25`	`4.17.27`
@types/node	`24.13.5`	`24.19.2`

Updates body-parser from 2.3.0 to 2.4.0

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#737

chore: group github actions updates by @Phillip9587 in expressjs/body-parser#743

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#745

test: fix 'presist' typo in test descriptions by @maxtaran2010 in expressjs/body-parser#749

docs: include security fix in 2.3.0 changes by @UlisesGascon in expressjs/body-parser#748

fix: avoid mutating read options when reading body by @Phillip9587 in expressjs/body-parser#742

refactor: move getCharset helper to only usage by @Phillip9587 in expressjs/body-parser#707

build(deps): bump the github-actions group with 7 updates by @dependabot[bot] in expressjs/body-parser#753

refactor: switch to neostandard by @Phillip9587 in expressjs/body-parser#751

perf(json): avoid first-char regex for direct JSON bodies by @Phillip9587 in expressjs/body-parser#744

docs: fix entity verify error description by @Rawal27 in expressjs/body-parser#755

feat: zstandard support by @Phillip9587 in expressjs/body-parser#586

test: remove unused experimentalZstd option by @Phillip9587 in expressjs/body-parser#757

ci: run tests on windows and macos matrix by @kilisamemarisaaa in expressjs/body-parser#759

deps: qs@^6.16.0 by @krzysdz in expressjs/body-parser#762

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#763

ci: trigger npm publish on release published and set dist-tag by @UlisesGascon in expressjs/body-parser#768

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#771

fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression by @saadkhantareen in expressjs/body-parser#773

perf: inline content stream setup by @Phillip9587 in expressjs/body-parser#750

docs: note that req.body may be undefined in v2 by @Hashim1999164 in expressjs/body-parser#752

docs: fix strict option description by @Rawal27 in expressjs/body-parser#756

docs: fix depth error description by @johnnyhuirilef in expressjs/body-parser#776

chore: update dependencies by @Phillip9587 in expressjs/body-parser#778

Release: 2.4.0 by @UlisesGascon in expressjs/body-parser#777

New Contributors

@maxtaran2010 made their first contribution in expressjs/body-parser#749

@Rawal27 made their first contribution in expressjs/body-parser#755

@kilisamemarisaaa made their first contribution in expressjs/body-parser#759

@saadkhantareen made their first contribution in expressjs/body-parser#773

@Hashim1999164 made their first contribution in expressjs/body-parser#752

@johnnyhuirilef made their first contribution in expressjs/body-parser#776

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

Changelog

Sourced from body-parser's changelog.

2.4.0

Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)

feat: add zstd content-encoding support (#586)

Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies

fix: avoid mutating the parser options and the request object while reading the body (#742, #750)

perf(json): avoid first-char regex for direct JSON bodies (#744)

deps:

content-type@^2.1.0

iconv-lite^0.7.3

qs@^6.16.1

Commits

b4744d7 2.4.0 (#777)
f7075ea fix: prevent process crash from trailing bytes after a compressed body
185ff1d chore: update dependencies (#778)
73713f7 docs: fix depth error description (#776)
2dcc826 docs: improve readability (#756)
402dbdc docs: note that req.body may be undefined in v2 (#752)
9883a1e perf: inline content stream setup (#750)
02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
822a0fd build(deps): bump the github-actions group with 3 updates (#771)
aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

cf6722b 5.3.0 (#7468)
8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
9efc29e docs: fix pass-through typos (#7509)
2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
9169cbe docs: add missing apostrophe in example (#7483)
7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
98bd4cd deps: proxy-addr@^2.0.8 (#7474)
9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates uuid from 14.0.2 to 14.0.3

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

fix CITGM #1154 (#981) (b44f159)

Changelog

Sourced from uuid's changelog.

14.0.3 (2026-10-09)

Bug Fixes

fix CITGM #1154 (#981) (b44f159)

Commits

993ff7b chore(main): release 14.0.3 (#982)
f7d19b9 chore: update workflow actions (#983)
b44f159 fix: fix CITGM #1154 (#981)
dd8c173 chore: update deps (#975)
See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @types/adm-zip from 0.5.8 to 0.6.0

Commits

See full diff in compare view

Updates @types/lodash from 4.17.25 to 4.17.27

Commits

See full diff in compare view

Updates @types/node from 24.13.5 to 24.19.2

Commits

See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note

Medium Risk
Touches the core HTTP/request parsing stack with security-driven minor releases; behavior of responses, downloads, and query/body parsing could shift slightly despite no app code changes.

Overview
Bumps runtime and dev dependencies in redisinsight/api via package.json and the lockfile—no application source changes.

Runtime: express 5.2.1 → 5.3.0 and body-parser 2.3.0 → 2.4.0 (both are on the Nest/Express HTTP path; body-parser is imported in main.ts). These releases pull in security fixes (e.g. body-parser CVE-2026-111181, express-related qs and proxy-addr advisories) plus minor HTTP behavior tweaks (headers, Content-Type/Content-Disposition, conditional QUERY caching). uuid moves 14.0.2 → 14.0.3 (patch).

Dev/types: @types/adm-zip 0.5.8 → 0.6.0 (lockfile marks it deprecated in favor of adm-zip’s bundled types), @types/lodash and @types/node minor bumps with matching transitive updates (undici-types, etc.).

^{Reviewed by Cursor Bugbot for commit 6751076. Bugbot is set up for automated code reviews on this repo. Configure here.}

… updates Bumps the everything-else group with 6 updates in the /redisinsight/api directory: | Package | From | To | | --- | --- | --- | | [body-parser](https://github.com/expressjs/body-parser) | `2.3.0` | `2.4.0` | | [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` | | [uuid](https://github.com/uuidjs/uuid) | `14.0.2` | `14.0.3` | | [@types/adm-zip](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/adm-zip) | `0.5.8` | `0.6.0` | | [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.25` | `4.17.27` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.13.5` | `24.19.2` | Updates `body-parser` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.3.0...v2.4.0) Updates `express` from 5.2.1 to 5.3.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v5.2.1...v5.3.0) Updates `uuid` from 14.0.2 to 14.0.3 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v14.0.2...v14.0.3) Updates `@types/adm-zip` from 0.5.8 to 0.6.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/adm-zip) Updates `@types/lodash` from 4.17.25 to 4.17.27 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash) Updates `@types/node` from 24.13.5 to 24.19.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: body-parser dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: express dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: uuid dependency-version: 14.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: "@types/adm-zip" dependency-version: 0.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: "@types/lodash" dependency-version: 4.17.27 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: "@types/node" dependency-version: 24.19.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: everything-else ... Signed-off-by: dependabot[bot] <support@github.com>

chatgpt-codex-connector · 2026-10-26T00:07:26Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T00:09:32.652609Z	`6751076`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6751076798

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-10-26T00:09:30Z

    "detect-port": "^1.6.1",
    "dotenv": "^16.0.0",
-    "express": "5.2.1",
+    "express": "5.3.0",


Upgrade the Express instance used by Nest

When the production API is created through NestFactory, @nestjs/platform-express still loads its exact express@5.2.1 dependency: the resulting lockfile records that pin at package-lock.json:4085 and installs the nested copy at package-lock.json:4134-4136. Consequently, this new root express@5.3.0 is used only by direct consumers such as the test helper servers, while the actual Nest HTTP server remains on 5.2.1 and does not receive the 5.3 fixes; update/override the adapter's dependency rather than adding a second Express copy.

Useful? React with 👍 / 👎.

dependabot · 2026-11-02T00:07:24Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot requested a review from a team as a code owner October 26, 2026 00:07

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026

chatgpt-codex-connector Bot reviewed Oct 26, 2026

View reviewed changes

dependabot Bot temporarily deployed to production October 26, 2026 00:10 Inactive

dependabot Bot closed this Nov 2, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/redisinsight/api/everything-else-e1ced74908 branch November 2, 2026 00:07

Navigation Menu

Repository navigation

chore(deps): bump the everything-else group across 1 directory with 6 updates - #6558

chore(deps): bump the everything-else group across 1 directory with 6 updates#6558
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/redisinsight/api/everything-else-e1ced74908

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 26, 2026

Uh oh!

dependabot Bot commented on behalf of github Nov 2, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.4.0

Important: Security

What's Changed

New Contributors

2.4.0

v5.3.0

Highlights

🐞 Bug fixes

🚀 Improvements

5.3.0

🐞 Bug fixes

🚀 Improvements

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

14.0.3 (2026-10-09)

Bug Fixes

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

dependabot Bot commented on behalf of github Nov 2, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 26, 2026 •

edited

Loading