[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dotenv	18.0.5 → 18.0.7
express (source)	5.2.1 → 5.3.0
express-rate-limit	8.7.0 → 8.7.1
ignore	7.0.10 → 7.0.12
isomorphic-git (source)	1.42.3 → 1.44.2
mime	4.1.0 → 4.1.1
uuid	14.0.2 → 14.0.3

---

Release Notes

motdotla/dotenv (dotenv)

v18.0.7

Compare Source

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#​1070)
• CLI should honor DOTENV_QUIET setting in .env file (#​1071)

v18.0.6

Compare Source

Changed

• Use smarter parseBoolean not Boolean() to fix override (#​1069)

expressjs/express (express)

v5.3.0

Compare Source

=====

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #​4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #​7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #​7057 and #​7478, and @​cyphercodes in #​7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #​7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #​7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #​5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #​6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #​7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #​6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #​7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

• Upgrade body-parser to ^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalid limit option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid limit values now throw at parser initialization instead of being ignored - by @​Mayvis in #​7390

⚡ Performance

• Avoid duplicate Content-Type header processing in res.send() when sending string responses without an explicit Content-Type header - by @​bjohansebas in #​6991

express-rate-limit/express-rate-limit (express-rate-limit)

v8.7.1

Compare Source

You can view the changelog here.

kaelzhang/node-ignore (ignore)

v7.0.12

Compare Source

v7.0.11

Compare Source

isomorphic-git/isomorphic-git (isomorphic-git)

v1.44.2

Compare Source

Bug Fixes

• preserve Pako decompression errors when reading objects (#​2451) (b75230a)

v1.44.1

Compare Source

Bug Fixes

• return absent from status for case-mismatched paths on case-insensitive filesystems (#​2454) (c8f4687)

v1.44.0

Compare Source

Features

• log: add author filter (#​2456) (c5916f4)

v1.43.3

Compare Source

Bug Fixes

• verify each packfile checksum once under concurrent reads (#​2453) (909b97b)

v1.43.2

Compare Source

Bug Fixes

• parse config variable names with digits and tabs around the equal sign (#​2452) (90c5773)

v1.43.1

Compare Source

Bug Fixes

• peel annotated tags to commits in checkout, branch, merge and commit (#​2450) (ed2af40)

v1.43.0

Compare Source

Features

• remove: accept an array of filepaths (#​2449) (563848e)

v1.42.7

Compare Source

Bug Fixes

• write the index once per walk instead of once per file (#​2448) (149de87)

v1.42.6

Compare Source

Bug Fixes

• refuse to cherry-pick over local changes (#​2444) (431453f), closes #​2436

v1.42.5

Compare Source

Bug Fixes

• sort paths by UTF-8 bytes like git does (#​2439) (afd8a5e)

v1.42.4

Compare Source

Bug Fixes

• anchor .git/info/exclude patterns to the working directory (#​2438) (8eea17f)

broofa/mime (mime)

v4.1.1

Compare Source

Bug Fixes

• normalize content types in getAllExtensions (#​365) (2a742a4)

uuidjs/uuid (uuid)

v14.0.3

Compare Source

Bug Fixes

• fix CITGM #​1154 (#​981) (b44f159)

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: package-lock.json

npm --before could not be enforced because existing locked packages were published after the minimumReleaseAge cutoff. This will resolve after the next lock file maintenance run.

[github-actions]

This PR will trigger a patch release when merged.

[tripodsan]

🎉 This PR is included in version 16.22.15 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀