SIGN IN SIGN UP
TryGhost / Ghost UNCLAIMED

Independent technology for modern publishing, memberships, subscriptions and newsletters.

0 0 121 JavaScript

Update dependency express to v4.22.2 (#28176)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [express](https://expressjs.com/)
([source](https://redirect.github.com/expressjs/express)) | [`4.21.2` →
`4.22.2`](https://renovatebot.com/diffs/npm/express/4.21.2/4.22.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/express/4.22.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/4.21.2/4.22.2?slim=true)
|

---

### Release Notes

<details>
<summary>expressjs/express (express)</summary>

###
[`v4.22.2`](https://redirect.github.com/expressjs/express/releases/tag/v4.22.2)

[Compare
Source](https://redirect.github.com/expressjs/express/compare/v4.22.1...v4.22.2)

##### What's Changed

- fix: restore >20 array parsing for `req.query` repeated keys
([`8d09bfe6`](https://redirect.github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db))
- This also unifies array-cap behavior across notations. Indexed
notation (`a[0]=...`) was historically capped at qs's default
`arrayLimit` of 20 even in older qs versions; after this change it also
allows up to 1000 items.
- deps: qs@\~6.15.1
- deps: body-parser@\~1.20.5

##### New Contributors

- [@&#8203;suuuuuuminnnnnn](https://redirect.github.com/suuuuuuminnnnnn)
made their first contribution in
[#&#8203;7021](https://redirect.github.com/expressjs/express/pull/7021)
- [@&#8203;SAY-5](https://redirect.github.com/SAY-5) made their first
contribution in
[#&#8203;7181](https://redirect.github.com/expressjs/express/pull/7181)

**Full Changelog**:
<https://github.com/expressjs/express/compare/v4.22.1...v4.22.2>

###
[`v4.22.1`](https://redirect.github.com/expressjs/express/releases/tag/v4.22.1)

[Compare
Source](https://redirect.github.com/expressjs/express/compare/4.22.0...v4.22.1)

##### What's Changed

> \[!IMPORTANT]\
> The prior release (4.22.0) included an erroneous breaking change
related to the extended query parser. There is no actual security
vulnerability associated with this behavior (CVE-2024-51999 has been
rejected). The change has been fully reverted in this release.

- Release: 4.22.1 by
[@&#8203;UlisesGascon](https://redirect.github.com/UlisesGascon) in
[#&#8203;6934](https://redirect.github.com/expressjs/express/pull/6934)

**Full Changelog**:
<https://github.com/expressjs/express/compare/4.22.0...v4.22.1>

###
[`v4.22.0`](https://redirect.github.com/expressjs/express/releases/tag/4.22.0)

[Compare
Source](https://redirect.github.com/expressjs/express/compare/4.21.2...4.22.0)

##### Important: Security

- Security fix for
[CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999)
([GHSA-pj86-cfqh-vqx6](https://redirect.github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))

##### What's Changed

- Refactor: improve readability by
[@&#8203;sazk07](https://redirect.github.com/sazk07) in
[#&#8203;6190](https://redirect.github.com/expressjs/express/pull/6190)
- ci: add support for Node.js\@&#8203;23.0 by
[@&#8203;UlisesGascon](https://redirect.github.com/UlisesGascon) in
[#&#8203;6080](https://redirect.github.com/expressjs/express/pull/6080)
- Method functions with no path should error by
[@&#8203;wesleytodd](https://redirect.github.com/wesleytodd) in
[#&#8203;5957](https://redirect.github.com/expressjs/express/pull/5957)
- ci: updated github actions ci workflow by
[@&#8203;Phillip9587](https://redirect.github.com/Phillip9587) in
[#&#8203;6323](https://redirect.github.com/expressjs/express/pull/6323)
- ci: reorder `npm i` steps to fix ci for older node versions by
[@&#8203;Phillip9587](https://redirect.github.com/Phillip9587) in
[#&#8203;6336](https://redirect.github.com/expressjs/express/pull/6336)
- Backport: ci: add node.js 24 to test matrix by
[@&#8203;Phillip9587](https://redirect.github.com/Phillip9587) in
[#&#8203;6506](https://redirect.github.com/expressjs/express/pull/6506)
- chore(4.x): wider range for query test skip by
[@&#8203;jonchurch](https://redirect.github.com/jonchurch) in
[#&#8203;6513](https://redirect.github.com/expressjs/express/pull/6513)
- use tilde notation for certain dependencies by
[@&#8203;UlisesGascon](https://redirect.github.com/UlisesGascon) in
[#&#8203;6905](https://redirect.github.com/expressjs/express/pull/6905)
- deps: qs\@&#8203;6.14.0 by
[@&#8203;UlisesGascon](https://redirect.github.com/UlisesGascon) in
[#&#8203;6909](https://redirect.github.com/expressjs/express/pull/6909)
- deps: use tilde notation for `qs` by
[@&#8203;Phillip9587](https://redirect.github.com/Phillip9587) in
[#&#8203;6919](https://redirect.github.com/expressjs/express/pull/6919)
- Release: 4.22.0 by
[@&#8203;UlisesGascon](https://redirect.github.com/UlisesGascon) in
[#&#8203;6921](https://redirect.github.com/expressjs/express/pull/6921)

**Full Changelog**:
<https://github.com/expressjs/express/compare/4.21.2...4.22.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Only on Sunday and Saturday (`* * * * 0,6`)
- Between 11:00 PM and 11:59 PM, Monday through Friday (`* 23 * * 1-5`)
- Between 12:00 AM and 04:59 AM, Monday through Saturday (`* 0-4 * *
1-6`)
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
- Between 11:00 PM and 11:59 PM, Monday through Friday (`* 23 * * 1-5`)
- Between 12:00 AM and 04:59 AM, Monday through Saturday (`* 0-4 * *
1-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMTMiLCJ1cGRhdGVkSW5WZXIiOiI0My4yMDEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: tryghost-renovate[bot] <269725441+tryghost-renovate[bot]@users.noreply.github.com>
T
tryghost-renovate[bot] committed
fe9439b72e0c09cb609be621020c10ad9d6b396b
Parent: 84fedc2
Committed by GitHub <noreply@github.com> on 5/29/2026, 7:24:16 PM