Upgrade `content-disposition` by blakeembrey · Pull Request #7233 · expressjs/express

blakeembrey · 2026-05-11T21:08:35Z

Version 2 upgrade will mostly only be relevant for users that want to generate non-ASCII by ISO-8859-1 valid filenames. There was a gap in theoretical vs real behavior of browsers that sniffed this and failed to have the correct encoding for filenames because it treated them as UTF-8 instead. See jshttp/content-disposition#27 for more information.

Separately, the API no longer attempts to basename inputs so I need to do that in the Express API instead.

socket-security · 2026-05-11T21:10:08Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/content-disposition@2.0.1

View full report

blakeembrey · 2026-05-11T21:10:19Z

  // set Content-Disposition when file is sent
  var headers = {
-    'Content-Disposition': contentDisposition(name || path)
+    'Content-Disposition': contentDisposition.create(name || basename(path))


The correct backward compatibility would be basename(name || path), should I do that instead? The difference is if someone gave a path instead of a filename in the filename parameter.

bjohansebas · 2026-06-16T02:39:57Z

Content-Disposition: old (v1.1.0) vs new (v2.0.1)

Express output for the tests added in test/res.attachment.js. All outputs are
RFC 6266 / 8187 / 9110 compliant.

Express call	Old (v1.1.0)	New (v2.0.1)	Changed?
`res.attachment('/path/to/my report.png')`	`attachment; filename="my report.png"`	`attachment; filename="my report.png"`	No
`res.attachment('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/locales/café.txt')`	`attachment; filename="café.txt"`	`attachment; filename="caf?.txt"; filename*=UTF-8''caf%C3%A9.txt`	Yes
`res.attachment('')`	`attachment; filename*=UTF-8''`	`attachment; filename=""`	Yes

Notes

Space in name: still quoted in both, a non-token value must be a quoted-string.
Latin1 name: v2 emits an ASCII fallback (filename) plus the UTF-8 filename*
extended form, instead of putting the raw non-ASCII byte in filename — more
interoperable and spec-clean.
Empty name: both valid; v2 uses an empty quoted-string, v1 an empty filename*.

…attachment

…e names in attachment

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [express](https://expressjs.com/) ([source](https://github.com/expressjs/express)) | [`5.2.1` → `5.3.0`](https://renovatebot.com/diffs/npm/express/5.2.1/5.3.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/express/5.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/5.2.1/5.3.0?slim=true) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/99) for more information. --- ### Release Notes <details> <summary>expressjs/express (express)</summary> ### [`v5.3.0`](https://github.com/expressjs/express/blob/HEAD/History.md#530) [Compare Source](expressjs/express@v5.2.1...v5.3.0) \===== #### 🐞 Bug fixes - Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by [@YuryShkoda](https://github.com/YuryShkoda) in [#4893](expressjs/express#4893) Fixed the behavior of `res.send()` to prevent conflicts between `Content-Length` and `Transfer-Encoding` HTTP headers in responses. The `Content-Length` header in `res.send()` is now only added when a `Transfer-Encoding` header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a `Transfer-Encoding` header - by [@cuishuang](https://github.com/cuishuang) in [#7459](expressjs/express#7459) * Upgrade `qs` to `^6.16.0`, which fixes [CVE-2026-2391](https://www.cve.org/CVERecord?id=CVE-2026-2391) ([GHSA-w7fw-mjwx-w883](GHSA-w7fw-mjwx-w883)), [CVE-2026-82417](https://www.cve.org/CVERecord?id=CVE-2026-82417) ([GHSA-4mjr-xmp4-gh2g](GHSA-4mjr-xmp4-gh2g)) and [CVE-2026-82562](https://www.cve.org/CVERecord?id=CVE-2026-82562) ([GHSA-x5fp-wj9c-mxmx](GHSA-x5fp-wj9c-mxmx)): `arrayLimit` bypasses in comma parsing and a denial of service via an attacker-controlled `isBuffer` - by [@davetashner](https://github.com/davetashner) in [#7057](expressjs/express#7057) and [#7478](expressjs/express#7478), and [@cyphercodes](https://github.com/cyphercodes) in [#7305](expressjs/express#7305) * Upgrade `proxy-addr` to `^2.0.8`, which fixes [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) - by [@lazerg](https://github.com/lazerg) in [#7474](expressjs/express#7474) #### 🚀 Improvements - Allow conditional revalidation for QUERY requests. `req.fresh` previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by [@Cherry](https://github.com/Cherry) in [#7366](expressjs/express#7366) ```js // QUERY /reports with If-None-Match: "12345" app.query('/reports', (req, res) => { res.set('ETag', '"12345"'); res.send(results); // now responds 304 Not Modified }); ``` - Improve HTML structure in `res.redirect()` responses when HTML format is accepted by adding `<!DOCTYPE html>`, `<title>`, and `<body>` tags for better browser compatibility - by [@Bernice55231](https://github.com/Bernice55231) in [#5167](expressjs/express#5167) - When calling `app.render` with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by [AkaHarshit](https://github.com/AkaHarshit) in [#6903](expressjs/express#6903) ```js app.render('index', null, callback); // now works as expected ``` - Upgrade `content-type` to `^2.0.0`, bringing a faster parser (\~1.5x quicker `Content-Type` parsing/formatting in `res.send()`) along with a behavior change: `res.send()` now keeps any existing parameters when adding the charset and no longer throws on a `Content-Type` that fails to parse. `type-is` is upgraded to `^2.1.0` as part of the same change - by [@blakeembrey](https://github.com/blakeembrey) in [#7234](expressjs/express#7234) ```js res.set('Content-Type', 'text/plain; foo=bar').send('hey'); // -> Content-Type: text/plain; foo=bar; charset=utf-8 ``` - The default error handler now logs the full error object instead of only its stack trace, so nested details such as `Error.cause` and library-specific properties (e.g. Sequelize's `parent`/`original`) are no longer swallowed - by [@Nitin-Mohapatra](https://github.com/Nitin-Mohapatra) in [#6464](expressjs/express#6464) - Upgrade `content-disposition` to `^2.0.1`, which changes the `Content-Disposition` header emitted by `res.download()`, `res.attachment()`, and `res.sendFile()`: file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by [@blakeembrey](https://github.com/blakeembrey) in [#7233](expressjs/express#7233) ```js res.attachment('user.html'); // before -> Content-Disposition: attachment; filename="user.html" // after -> Content-Disposition: attachment; filename=user.html ``` - Upgrade `body-parser` to `^2.3.0`, which fixes [CVE-2026-12590](https://www.cve.org/CVERecord?id=CVE-2026-12590) ([GHSA-v422-hmwv-36x6](GHSA-v422-hmwv-36x6)): an invalid `limit` option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid `limit` values now throw at parser initialization instead of being ignored - by [@Mayvis](https://github.com/Mayvis) in [#7390](expressjs/express#7390) #### ⚡ Performance - Avoid duplicate Content-Type header processing in `res.send()` when sending string responses without an explicit Content-Type header - by [@bjohansebas](https://github.com/bjohansebas) in [#6991](expressjs/express#6991) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 9am on tuesday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.futo.org/harbor/harbor/pulls/1812

blakeembrey requested a review from a team May 11, 2026 21:08

blakeembrey commented May 11, 2026

View reviewed changes

bjohansebas force-pushed the be/upgrade-content-disposition branch from 5b1dd33 to 2d0d3c5 Compare June 15, 2026 19:58

bjohansebas approved these changes Jun 15, 2026

View reviewed changes

blakeembrey and others added 5 commits June 15, 2026 21:41

Upgrade content-disposition

8523cf7

Better backward compat

f2922ae

chore: upgrade content-disposition to 2.0.1 and update History.md

2fb41ab

test: add case for encoding latin1 file names with ASCII fallback in …

833f556

…attachment

test: add cases for quoting invalid file names and handling empty fil…

754a183

…e names in attachment

bjohansebas force-pushed the be/upgrade-content-disposition branch from 21c7e27 to 754a183 Compare June 16, 2026 02:42

bjohansebas merged commit 59e205a into master Jun 16, 2026
30 checks passed

bjohansebas deleted the be/upgrade-content-disposition branch June 16, 2026 02:45

matemolnar8 mentioned this pull request Aug 14, 2026

Implement local review CLI, UI, and experimental generate matemolnar8/comprehende#1

Merged

UlisesGascon mentioned this pull request Sep 14, 2026

Release: 5.3.0 #7468

Merged

Navigation Menu

Repository navigation

Upgrade `content-disposition` - #7233

Upgrade `content-disposition`#7233
bjohansebas merged 5 commits into
masterfrom
be/upgrade-content-disposition

blakeembrey commented May 11, 2026

Uh oh!

socket-security Bot commented May 11, 2026 •

edited

Loading

Uh oh!

blakeembrey May 11, 2026

Uh oh!

bjohansebas commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

blakeembrey commented May 11, 2026

Uh oh!

socket-security Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

blakeembrey May 11, 2026

Choose a reason for hiding this comment

Uh oh!

bjohansebas commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

socket-security Bot commented May 11, 2026 •

edited

Loading