Skip to content

Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 - #7135

Merged
bjohansebas merged 1 commit into
expressjs:4.xfrom
baryman:makkuznetsov/update-path-regexp
Jun 16, 2026
Merged

Update path-to-regexp to 0.1.13 to fix CVE-2026-4867#7135
bjohansebas merged 1 commit into
expressjs:4.xfrom
baryman:makkuznetsov/update-path-regexp

Conversation

@baryman

@baryman baryman commented Mar 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Description

To keep projects on version 4.x, you need to update the path-to-regexp package to version 0.1.13 to fix the CVE-2026-4867 vulnerability.

@baryman baryman changed the title Update path-to-regexp to 0.1.13 because CVE-2026-4867 Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 Mar 30, 2026
krzysdz
krzysdz approved these changes Mar 30, 2026
View reviewed changes

@krzysdz krzysdz left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI ~0.1.12 matches all 0.1.x versions >= 0.1.12. Running npm audit fix, npm update in existing project or npm install in a new one, will install the updated version of path-to-regexp, without requiring a new Express version - #6905.

@baryman

baryman commented Mar 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

FYI ~0.1.12 matches all 0.1.x versions >= 0.1.12. Running npm audit fix, npm update in existing project or npm install in a new one, will install the updated version of path-to-regexp, without requiring a new Express version - #6905.

Perfect. Can I close PR ?

@krzysdz krzysdz added 4.x deps dependencies Pull requests that update a dependency file labels Mar 30, 2026
bjohansebas
bjohansebas approved these changes Mar 30, 2026
View reviewed changes

@bjohansebas bjohansebas left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I know, there won’t be a release anytime soon, but you can update your application yourself with npm update path-to-regexp. I merged this so that if a release does happen, applications will get the latest version of that package—but as I said, it won’t be anytime soon.

@bjohansebas

bjohansebas commented Mar 30, 2026

Copy link
Copy Markdown
Member

Could you rebase the branch so the CI passes, please?

@krzysdz

krzysdz commented Mar 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Could you rebase the branch so the CI passes, please?

This test is broken with current 4.x too. It's an unrelated bug with body-parser (expressjs/body-parser#715).

This was referenced Mar 30, 2026
Closed
Closed
@bjohansebas
bjohansebas force-pushed the makkuznetsov/update-path-regexp branch from 4015420 to 45dfa34 Compare June 16, 2026 03:11
@bjohansebas
bjohansebas merged commit 715101b into expressjs:4.x Jun 16, 2026
52 checks passed
@UlisesGascon UlisesGascon mentioned this pull request Sep 11, 2026
Merged
sickn33 added a commit to sickn33/agentic-awesome-skills that referenced this pull request Oct 6, 2026
@sickn33
[Snyk] Upgrade express from 4.22.2 to 4.22.3 (#1799)
cf2c251 
![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg)

<h3>Snyk has created this PR to upgrade express from 4.22.2 to 4.22.3.</h3>

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

<hr/>

- The recommended version is **1 version** ahead of your current version.

- The recommended version was released **22 days ago**.

#### Breaking Change Risk

![Merge Risk: Low](https://img.shields.io/badge/Merge%20Risk%3A%20Low-006400?style=for-the-badge)

> **Notice:** This assessment is enhanced by AI.

<details>
<summary><b>Release notes</b></summary>
<br/>
  <details>
    <summary>Package name: <b>express</b></summary>
    <ul>
      <li>
        <b>4.22.3</b> - <a href="https://redirect.github.com/expressjs/express/releases/tag/v4.22.3">2026-09-14</a></br><h2>What's Changed</h2>
<ul>
<li>Update path-to-regexp to 0.1.13 to fix <a title="CVE-2026-4867" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-37ch-88jc-xwx2/hovercard" href="https://redirect.github.com/advisories/GHSA-37ch-88jc-xwx2">CVE-2026-4867</a> by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/baryman/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/baryman">@ baryman</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4170816498" data-permission-text="Title is private" data-url="expressjs/express#7135" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7135/hovercard" href="https://redirect.github.com/expressjs/express/pull/7135">#7135</a></li>
<li>feat: allow conditional revalidation for QUERY requests (v4) by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Cherry/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Cherry">@ Cherry</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4867995640" data-permission-text="Title is private" data-url="expressjs/express#7377" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7377/hovercard" href="https://redirect.github.com/expressjs/express/pull/7377">#7377</a></li>
<li>deps: qs@~6.16.0 by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/lazerg/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/lazerg">@ lazerg</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5309974252" data-permission-text="Title is private" data-url="expressjs/express#7440" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7440/hovercard" href="https://redirect.github.com/expressjs/express/pull/7440">#7440</a></li>
<li>ci: add npm staged publication with dist-tag support by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/UlisesGascon/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/UlisesGascon">@ UlisesGascon</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5425994556" data-permission-text="Title is private" data-url="expressjs/express#7465" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7465/hovercard" href="https://redirect.github.com/expressjs/express/pull/7465">#7465</a></li>
<li>4.22.3 by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/UlisesGascon/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/UlisesGascon">@ UlisesGascon</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5426105923" data-permission-text="Title is private" data-url="expressjs/express#7466" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7466/hovercard" href="https://redirect.github.com/expressjs/express/pull/7466">#7466</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/baryman/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/baryman">@ baryman</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4170816498" data-permission-text="Title is private" data-url="expressjs/express#7135" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7135/hovercard" href="https://redirect.github.com/expressjs/express/pull/7135">#7135</a></li>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/lazerg/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/lazerg">@ lazerg</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5309974252" data-permission-text="Title is private" data-url="expressjs/express#7440" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7440/hovercard" href="https://redirect.github.com/expressjs/express/pull/7440">#7440</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a class="commit-link" href="https://redirect.github.com/expressjs/express/compare/v4.22.2...v4.22.3"><tt>v4.22.2...v4.22.3</tt></a></p>
      </li>
      <li>
        <b>4.22.2</b> - <a href="https://redirect.github.com/expressjs/express/releases/tag/v4.22.2">2026-05-11</a></br><h2>What's Changed</h2>
<ul>
<li>fix: restore &gt;20 array parsing for <code>req.query</code> repeated keys (<a href="https://redirect.github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db"><code>8d09bfe6</code></a>)
<ul>
<li>This also unifies array-cap behavior across notations. Indexed notation (<code>a[0]=...</code>) was historically capped at qs's default <code>arrayLimit</code> of 20 even in older qs versions; after this change it also allows up to 1000 items.</li>
</ul>
</li>
<li>deps: qs@~6.15.1</li>
<li>deps: body-parser@~1.20.5</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/suuuuuuminnnnnn/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/suuuuuuminnnnnn">@ suuuuuuminnnnnn</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3905065919" data-permission-text="Title is private" data-url="expressjs/express#7021" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7021/hovercard" href="https://redirect.github.com/expressjs/express/pull/7021">#7021</a></li>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/SAY-5/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/SAY-5">@ SAY-5</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4266728030" data-permission-text="Title is private" data-url="expressjs/express#7181" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7181/hovercard" href="https://redirect.github.com/expressjs/express/pull/7181">#7181</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a class="commit-link" href="https://redirect.github.com/expressjs/express/compare/v4.22.1...v4.22.2"><tt>v4.22.1...v4.22.2</tt></a></p>
      </li>
    </ul>
    from <a href="https://redirect.github.com/expressjs/express/releases">express GitHub release notes</a>
  </details>
</details>

---

> [!IMPORTANT]
>
> - Check the changes in this PR to ensure they won't cause issues with your project.
> - This PR was automatically created by Snyk using the credentials of a real user.

---

**Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._

**For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6ImZha2Uta2V5IiwiYW5vbnltb3VzSWQiOiJiNGE2MWUzMC1hOGM1LTQzY2YtOTI2Zi0yMGU4YWUxZWQ5YTUiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImI0YTYxZTMwLWE4YzUtNDNjZi05MjZmLTIwZThhZTFlZDlhNSJ9fQ==" width="0" height="0"/>

> - 🧐 [View latest project report](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/c6cb14ff-6962-4dca-92b2-b0578606cee5?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template)
> - 🛠 [Adjust upgrade PR settings](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/c6cb14ff-6962-4dca-92b2-b0578606cee5/settings/integration?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/c6cb14ff-6962-4dca-92b2-b0578606cee5/settings/integration?pkg&#x3D;express&amp;utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr#auto-dep-upgrades)

[//]: # 'snyk:metadata:{"breakingChangeRiskLevel":"low","FF_showPullRequestBreakingChanges":true,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"express","from":"4.22.2","to":"4.22.3"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"b4a61e30-a8c5-43cf-926f-20e8ae1ed9a5","prPublicId":"b4a61e30-a8c5-43cf-926f-20e8ae1ed9a5","packageManager":"npm","priorityScoreList":[],"projectPublicId":"c6cb14ff-6962-4dca-92b2-b0578606cee5","projectUrl":"https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/c6cb14ff-6962-4dca-92b2-b0578606cee5?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":1,"publishedDate":"2026-09-14T06:46:38.631Z"},"vulns":[]}'
sickn33 added a commit to sickn33/agentic-awesome-skills that referenced this pull request Oct 6, 2026
@sickn33
[Snyk] Upgrade express from 4.22.2 to 4.22.3 (#1803)
d5f8362 
![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg)

<h3>Snyk has created this PR to upgrade express from 4.22.2 to 4.22.3.</h3>

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

<hr/>

- The recommended version is **1 version** ahead of your current version.

- The recommended version was released **22 days ago**.

#### Breaking Change Risk

![Merge Risk: Low](https://img.shields.io/badge/Merge%20Risk%3A%20Low-006400?style=for-the-badge)

> **Notice:** This assessment is enhanced by AI.

<details>
<summary><b>Release notes</b></summary>
<br/>
  <details>
    <summary>Package name: <b>express</b></summary>
    <ul>
      <li>
        <b>4.22.3</b> - <a href="https://redirect.github.com/expressjs/express/releases/tag/v4.22.3">2026-09-14</a></br><h2>What's Changed</h2>
<ul>
<li>Update path-to-regexp to 0.1.13 to fix <a title="CVE-2026-4867" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-37ch-88jc-xwx2/hovercard" href="https://redirect.github.com/advisories/GHSA-37ch-88jc-xwx2">CVE-2026-4867</a> by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/baryman/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/baryman">@ baryman</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4170816498" data-permission-text="Title is private" data-url="expressjs/express#7135" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7135/hovercard" href="https://redirect.github.com/expressjs/express/pull/7135">#7135</a></li>
<li>feat: allow conditional revalidation for QUERY requests (v4) by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Cherry/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Cherry">@ Cherry</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4867995640" data-permission-text="Title is private" data-url="expressjs/express#7377" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7377/hovercard" href="https://redirect.github.com/expressjs/express/pull/7377">#7377</a></li>
<li>deps: qs@~6.16.0 by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/lazerg/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/lazerg">@ lazerg</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5309974252" data-permission-text="Title is private" data-url="expressjs/express#7440" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7440/hovercard" href="https://redirect.github.com/expressjs/express/pull/7440">#7440</a></li>
<li>ci: add npm staged publication with dist-tag support by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/UlisesGascon/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/UlisesGascon">@ UlisesGascon</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5425994556" data-permission-text="Title is private" data-url="expressjs/express#7465" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7465/hovercard" href="https://redirect.github.com/expressjs/express/pull/7465">#7465</a></li>
<li>4.22.3 by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/UlisesGascon/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/UlisesGascon">@ UlisesGascon</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5426105923" data-permission-text="Title is private" data-url="expressjs/express#7466" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7466/hovercard" href="https://redirect.github.com/expressjs/express/pull/7466">#7466</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/baryman/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/baryman">@ baryman</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4170816498" data-permission-text="Title is private" data-url="expressjs/express#7135" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7135/hovercard" href="https://redirect.github.com/expressjs/express/pull/7135">#7135</a></li>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/lazerg/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/lazerg">@ lazerg</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5309974252" data-permission-text="Title is private" data-url="expressjs/express#7440" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7440/hovercard" href="https://redirect.github.com/expressjs/express/pull/7440">#7440</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a class="commit-link" href="https://redirect.github.com/expressjs/express/compare/v4.22.2...v4.22.3"><tt>v4.22.2...v4.22.3</tt></a></p>
      </li>
      <li>
        <b>4.22.2</b> - <a href="https://redirect.github.com/expressjs/express/releases/tag/v4.22.2">2026-05-11</a></br><h2>What's Changed</h2>
<ul>
<li>fix: restore &gt;20 array parsing for <code>req.query</code> repeated keys (<a href="https://redirect.github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db"><code>8d09bfe6</code></a>)
<ul>
<li>This also unifies array-cap behavior across notations. Indexed notation (<code>a[0]=...</code>) was historically capped at qs's default <code>arrayLimit</code> of 20 even in older qs versions; after this change it also allows up to 1000 items.</li>
</ul>
</li>
<li>deps: qs@~6.15.1</li>
<li>deps: body-parser@~1.20.5</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/suuuuuuminnnnnn/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/suuuuuuminnnnnn">@ suuuuuuminnnnnn</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3905065919" data-permission-text="Title is private" data-url="expressjs/express#7021" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7021/hovercard" href="https://redirect.github.com/expressjs/express/pull/7021">#7021</a></li>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/SAY-5/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/SAY-5">@ SAY-5</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4266728030" data-permission-text="Title is private" data-url="expressjs/express#7181" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7181/hovercard" href="https://redirect.github.com/expressjs/express/pull/7181">#7181</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a class="commit-link" href="https://redirect.github.com/expressjs/express/compare/v4.22.1...v4.22.2"><tt>v4.22.1...v4.22.2</tt></a></p>
      </li>
    </ul>
    from <a href="https://redirect.github.com/expressjs/express/releases">express GitHub release notes</a>
  </details>
</details>

---

> [!IMPORTANT]
>
> - Check the changes in this PR to ensure they won't cause issues with your project.
> - This PR was automatically created by Snyk using the credentials of a real user.

---

**Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._

**For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6ImZha2Uta2V5IiwiYW5vbnltb3VzSWQiOiJhNWNhZDZiYy1kMGU1LTQzNzgtOTI4Mi00YjM2ODcwMDE1NDAiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImE1Y2FkNmJjLWQwZTUtNDM3OC05MjgyLTRiMzY4NzAwMTU0MCJ9fQ==" width="0" height="0"/>

> - 🧐 [View latest project report](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/922576f9-727c-4a9f-922d-5954307979b4?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template)
> - 🛠 [Adjust upgrade PR settings](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/922576f9-727c-4a9f-922d-5954307979b4/settings/integration?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/922576f9-727c-4a9f-922d-5954307979b4/settings/integration?pkg&#x3D;express&amp;utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr#auto-dep-upgrades)

[//]: # 'snyk:metadata:{"breakingChangeRiskLevel":"low","FF_showPullRequestBreakingChanges":true,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"express","from":"4.22.2","to":"4.22.3"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"a5cad6bc-d0e5-4378-9282-4b3687001540","prPublicId":"a5cad6bc-d0e5-4378-9282-4b3687001540","packageManager":"npm","priorityScoreList":[],"projectPublicId":"922576f9-727c-4a9f-922d-5954307979b4","projectUrl":"https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/922576f9-727c-4a9f-922d-5954307979b4?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":1,"publishedDate":"2026-09-14T06:46:38.631Z"},"vulns":[]}'
sickn33 added a commit to sickn33/agentic-awesome-skills that referenced this pull request Oct 6, 2026
@sickn33
[Snyk] Upgrade express from 4.22.2 to 4.22.3 (#1804)
099499d 
![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg)

<h3>Snyk has created this PR to upgrade express from 4.22.2 to 4.22.3.</h3>

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

<hr/>

- The recommended version is **1 version** ahead of your current version.

- The recommended version was released **22 days ago**.

#### Breaking Change Risk

![Merge Risk: Low](https://img.shields.io/badge/Merge%20Risk%3A%20Low-006400?style=for-the-badge)

> **Notice:** This assessment is enhanced by AI.

<details>
<summary><b>Release notes</b></summary>
<br/>
  <details>
    <summary>Package name: <b>express</b></summary>
    <ul>
      <li>
        <b>4.22.3</b> - <a href="https://redirect.github.com/expressjs/express/releases/tag/v4.22.3">2026-09-14</a></br><h2>What's Changed</h2>
<ul>
<li>Update path-to-regexp to 0.1.13 to fix <a title="CVE-2026-4867" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-37ch-88jc-xwx2/hovercard" href="https://redirect.github.com/advisories/GHSA-37ch-88jc-xwx2">CVE-2026-4867</a> by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/baryman/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/baryman">@ baryman</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4170816498" data-permission-text="Title is private" data-url="expressjs/express#7135" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7135/hovercard" href="https://redirect.github.com/expressjs/express/pull/7135">#7135</a></li>
<li>feat: allow conditional revalidation for QUERY requests (v4) by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Cherry/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Cherry">@ Cherry</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4867995640" data-permission-text="Title is private" data-url="expressjs/express#7377" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7377/hovercard" href="https://redirect.github.com/expressjs/express/pull/7377">#7377</a></li>
<li>deps: qs@~6.16.0 by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/lazerg/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/lazerg">@ lazerg</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5309974252" data-permission-text="Title is private" data-url="expressjs/express#7440" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7440/hovercard" href="https://redirect.github.com/expressjs/express/pull/7440">#7440</a></li>
<li>ci: add npm staged publication with dist-tag support by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/UlisesGascon/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/UlisesGascon">@ UlisesGascon</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5425994556" data-permission-text="Title is private" data-url="expressjs/express#7465" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7465/hovercard" href="https://redirect.github.com/expressjs/express/pull/7465">#7465</a></li>
<li>4.22.3 by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/UlisesGascon/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/UlisesGascon">@ UlisesGascon</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5426105923" data-permission-text="Title is private" data-url="expressjs/express#7466" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7466/hovercard" href="https://redirect.github.com/expressjs/express/pull/7466">#7466</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/baryman/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/baryman">@ baryman</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4170816498" data-permission-text="Title is private" data-url="expressjs/express#7135" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7135/hovercard" href="https://redirect.github.com/expressjs/express/pull/7135">#7135</a></li>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/lazerg/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/lazerg">@ lazerg</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5309974252" data-permission-text="Title is private" data-url="expressjs/express#7440" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7440/hovercard" href="https://redirect.github.com/expressjs/express/pull/7440">#7440</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a class="commit-link" href="https://redirect.github.com/expressjs/express/compare/v4.22.2...v4.22.3"><tt>v4.22.2...v4.22.3</tt></a></p>
      </li>
      <li>
        <b>4.22.2</b> - <a href="https://redirect.github.com/expressjs/express/releases/tag/v4.22.2">2026-05-11</a></br><h2>What's Changed</h2>
<ul>
<li>fix: restore &gt;20 array parsing for <code>req.query</code> repeated keys (<a href="https://redirect.github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db"><code>8d09bfe6</code></a>)
<ul>
<li>This also unifies array-cap behavior across notations. Indexed notation (<code>a[0]=...</code>) was historically capped at qs's default <code>arrayLimit</code> of 20 even in older qs versions; after this change it also allows up to 1000 items.</li>
</ul>
</li>
<li>deps: qs@~6.15.1</li>
<li>deps: body-parser@~1.20.5</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/suuuuuuminnnnnn/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/suuuuuuminnnnnn">@ suuuuuuminnnnnn</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3905065919" data-permission-text="Title is private" data-url="expressjs/express#7021" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7021/hovercard" href="https://redirect.github.com/expressjs/express/pull/7021">#7021</a></li>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/SAY-5/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/SAY-5">@ SAY-5</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4266728030" data-permission-text="Title is private" data-url="expressjs/express#7181" data-hovercard-type="pull_request" data-hovercard-url="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/expressjs/express/pull/7181/hovercard" href="https://redirect.github.com/expressjs/express/pull/7181">#7181</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a class="commit-link" href="https://redirect.github.com/expressjs/express/compare/v4.22.1...v4.22.2"><tt>v4.22.1...v4.22.2</tt></a></p>
      </li>
    </ul>
    from <a href="https://redirect.github.com/expressjs/express/releases">express GitHub release notes</a>
  </details>
</details>

---

> [!IMPORTANT]
>
> - Check the changes in this PR to ensure they won't cause issues with your project.
> - This PR was automatically created by Snyk using the credentials of a real user.

---

**Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._

**For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6ImZha2Uta2V5IiwiYW5vbnltb3VzSWQiOiIwOGVhODUzYi0yMWZlLTRlNzUtOTBjYi0yZGU2YjE1ZDRjYWMiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjA4ZWE4NTNiLTIxZmUtNGU3NS05MGNiLTJkZTZiMTVkNGNhYyJ9fQ==" width="0" height="0"/>

> - 🧐 [View latest project report](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/03c800b3-c3a6-4848-b6af-6f35a627adab?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template)
> - 🛠 [Adjust upgrade PR settings](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/03c800b3-c3a6-4848-b6af-6f35a627adab/settings/integration?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/03c800b3-c3a6-4848-b6af-6f35a627adab/settings/integration?pkg&#x3D;express&amp;utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr#auto-dep-upgrades)

[//]: # 'snyk:metadata:{"breakingChangeRiskLevel":"low","FF_showPullRequestBreakingChanges":true,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"express","from":"4.22.2","to":"4.22.3"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"08ea853b-21fe-4e75-90cb-2de6b15d4cac","prPublicId":"08ea853b-21fe-4e75-90cb-2de6b15d4cac","packageManager":"npm","priorityScoreList":[],"projectPublicId":"03c800b3-c3a6-4848-b6af-6f35a627adab","projectUrl":"https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/03c800b3-c3a6-4848-b6af-6f35a627adab?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":1,"publishedDate":"2026-09-14T06:46:38.631Z"},"vulns":[]}'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bjohansebas bjohansebas bjohansebas approved these changes
+1 more reviewer
@krzysdz krzysdz krzysdz approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

4.x dependencies Pull requests that update a dependency file deps

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@baryman @bjohansebas @krzysdz