Update dependency express to v4.21.1

[mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
express (source)	dependencies	minor	4.17.1 → 4.21.1
express (source)	dependencies	minor	4.17.1 → 4.20.0
express (source)	dependencies	minor	4.17.1 → 4.22.0

By merging this PR, the issue #42 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability
High	7.5	CVE-2024-45296
High	7.5	CVE-2024-52798
Medium	5.3	CVE-2024-47764

By merging this PR, the issue #42 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability
Medium	6.1	CVE-2024-29041
Medium	5.0	CVE-2024-43796

By merging this PR, the issue #42 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability
High	7.5	CVE-2022-24999
Low	3.7	CVE-2025-15284
Low	3.7	CVE-2026-2391

---

Release Notes

expressjs/express (express)

v4.21.1

Compare Source

What's Changed

• Backport a fix for CVE-2024-47764 to the 4.x branch by @​joshbuker in #​6029
• Release: 4.21.1 by @​UlisesGascon in #​6031

Full Changelog: expressjs/express@4.21.0...4.21.1

v4.21.0

Compare Source

What's Changed

• Deprecate "back" magic string in redirects by @​blakeembrey in #​5935
• finalhandler@​1.3.1 by @​wesleytodd in #​5954
• fix(deps): serve-static@​1.16.2 by @​wesleytodd in #​5951
• Upgraded dependency qs to 6.13.0 to match qs in body-parser by @​agadzinski93 in #​5946

New Contributors

• @​agadzinski93 made their first contribution in #​5946

Full Changelog: expressjs/express@4.20.0...4.21.0

v4.20.0

Compare Source

==========

• deps: serve-static@​0.16.0
  • Remove link renderization in html while redirecting
• deps: send@​0.19.0
  • Remove link renderization in html while redirecting
• deps: body-parser@​0.6.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
• Remove link renderization in html while using res.redirect
• deps: path-to-regexp@​0.1.10
  • Adds support for named matching groups in the routes using a regex
  • Adds backtracking protection to parameters without regexes defined
• deps: encodeurl@~2.0.0
  • Removes encoding of \, |, and ^ to align better with URL spec
• Deprecate passing options.maxAge and options.expires to res.clearCookie
  • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

v4.19.2

Compare Source

==========

• Improved fix for open redirect allow list bypass

v4.19.1

Compare Source

==========

• Allow passing non-strings to res.location with new encoding handling checks

v4.19.0

Compare Source

==========

• Prevent open redirect allow list bypass due to encodeurl
• deps: cookie@​0.6.0

v4.18.3

Compare Source

==========

• Fix routing requests without method
• deps: body-parser@​1.20.2
  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
  • deps: raw-body@​2.5.2
• deps: cookie@​0.6.0
  • Add partitioned option

v4.18.2

Compare Source

===================

• Fix regression routing a large stack in a single route
• deps: body-parser@​1.20.1
  • deps: qs@​6.11.0
  • perf: remove unnecessary object clone
• deps: qs@​6.11.0

v4.18.1

Compare Source

===================

• Fix hanging on large stack of sync routes

v4.18.0

Compare Source

===================

• Add "root" option to res.download
• Allow options without filename in res.download
• Deprecate string and non-integer arguments to res.status
• Fix behavior of null/undefined as maxAge in res.cookie
• Fix handling very large stacks of sync middleware
• Ignore Object.prototype values in settings through app.set/app.get
• Invoke default with same arguments as types in res.format
• Support proper 205 responses using res.send
• Use http-errors for res.format error
• deps: body-parser@​1.20.0
  • Fix error message for json parse whitespace in strict
  • Fix internal error when inflated body exceeds limit
  • Prevent loss of async hooks context
  • Prevent hanging when request already read
  • deps: depd@​2.0.0
  • deps: http-errors@​2.0.0
  • deps: on-finished@​2.4.1
  • deps: qs@​6.10.3
  • deps: raw-body@​2.5.1
• deps: cookie@​0.5.0
  • Add priority option
  • Fix expires option to reject invalid dates
• deps: depd@​2.0.0
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: finalhandler@​1.2.0
  • Remove set content headers that break response
  • deps: on-finished@​2.4.1
  • deps: statuses@​2.0.1
• deps: on-finished@​2.4.1
  • Prevent loss of async hooks context
• deps: qs@​6.10.3
• deps: send@​0.18.0
  • Fix emitted 416 error missing headers property
  • Limit the headers removed for 304 response
  • deps: depd@​2.0.0
  • deps: destroy@​1.2.0
  • deps: http-errors@​2.0.0
  • deps: on-finished@​2.4.1
  • deps: statuses@​2.0.1
• deps: serve-static@​1.15.0
  • deps: send@​0.18.0
• deps: statuses@​2.0.1
  • Remove code 306
  • Rename 425 Unordered Collection to standard 425 Too Early

v4.17.3

Compare Source

===================

• deps: accepts@~1.3.8
  • deps: mime-types@~2.1.34
  • deps: negotiator@​0.6.3
• deps: body-parser@​1.19.2
  • deps: bytes@​3.1.2
  • deps: qs@​6.9.7
  • deps: raw-body@​2.4.3
• deps: cookie@​0.4.2
• deps: qs@​6.9.7
  • Fix handling of __proto__ keys
• pref: remove unnecessary regexp for trust proxy

v4.17.2

Compare Source

===================

• Fix handling of undefined in res.jsonp
• Fix handling of undefined when "json escape" is enabled
• Fix incorrect middleware execution with unanchored RegExps
• Fix res.jsonp(obj, status) deprecation message
• Fix typo in res.is JSDoc
• deps: body-parser@​1.19.1
  • deps: bytes@​3.1.1
  • deps: http-errors@​1.8.1
  • deps: qs@​6.9.6
  • deps: raw-body@​2.4.2
  • deps: safe-buffer@​5.2.1
  • deps: type-is@~1.6.18
• deps: content-disposition@​0.5.4
  • deps: safe-buffer@​5.2.1
• deps: cookie@​0.4.1
  • Fix maxAge option to reject invalid values
• deps: proxy-addr@~2.0.7
  • Use req.socket over deprecated req.connection
  • deps: forwarded@​0.2.0
  • deps: ipaddr.js@​1.9.1
• deps: qs@​6.9.6
• deps: safe-buffer@​5.2.1
• deps: send@​0.17.2
  • deps: http-errors@​1.8.1
  • deps: ms@​2.1.3
  • pref: ignore empty http tokens
• deps: serve-static@​1.14.2
  • deps: send@​0.17.2
• deps: setprototypeof@​1.2.0

---

• If you want to rebase/retry this PR, check this box