Bump the npm_and_yarn group across 1 directory with 30 updates

[dependabot]

Bumps the npm_and_yarn group with 9 updates in the /examples/basic directory:

Package	From	To
ajv	4.11.4	6.12.6
brace-expansion	1.1.6	1.1.12
hosted-git-info	2.2.0	2.8.9
min-document	2.19.0	2.19.2
path-parse	1.0.5	1.0.7
sshpk	1.11.0	1.18.0
tmpl	1.0.4	1.0.5
ua-parser-js	0.7.12	0.7.41
y18n	3.2.1	3.2.2

Updates ajv from 4.11.4 to 6.12.6

Release notes

Sourced from ajv's releases.

v6.12.6

Fix performance issue of "url" format.

v6.12.5

Fix uri scheme validation (@​ChALkeR). Fix boolean schemas with strictKeywords option (#1270)

v6.12.4

Fix: coercion of one-item arrays to scalar that should fail validation (failing example).

v6.12.3

Pass schema object to processCode function Option for strictNumbers (@​issacgerges, #1128) Fixed vulnerability related to untrusted schemas (CVE-2020-15366)

v6.12.2

Removed post-install script

v6.12.1

Docs and dependency updates

v6.12.0

Improved hostname validation (@​sambauers, #1143) Option keywords to add custom keywords (@​franciscomorais, #1137) Types fixes (@​boenrobot, @​MattiAstedrone) Docs:

• error logging example (@​RadiationSickness)
• TypeScript usage notes (@​thetric)

v6.11.0

Time formats support two digit and colon-less variants of timezone offset (#1061 , @​cjpillsbury) Docs: RegExp related security considerations Tests: Disabled failing typescript test

v6.10.2

Fix: the unknown keywords were ignored with the option strictKeywords: true (instead of failing compilation) in some sub-schemas (e.g. anyOf), when the sub-schema didn't have known keywords.

v6.10.1

Fix types Fix addSchema (#1001) Update dependencies

v6.10.0

Option strictDefaults to report ignored defaults (#957, @​not-an-aardvark) Option strictKeywords to report unknown keywords (#781)

v6.9.0

OpenAPI keyword nullable can be any boolean (and not only true). Custom keyword definition changes:

• dependencies option in to require the presence of keywords in the same schema.

... (truncated)

Commits

• See full diff in compare view

Updates body-parser from 1.13.3 to 1.20.4

Release notes

Sourced from body-parser's releases.

1.20.4

What's Changed

• Remove redundant depth check by @​blakeembrey in expressjs/body-parser#538
• ci: add support for Node.js v23 by @​Phillip9587 in expressjs/body-parser#553
• ci: restore CI for 1.x branch by @​bjohansebas in expressjs/body-parser#665
• deps: qs@^6.14.0 by @​bjohansebas in expressjs/body-parser#664
• deps: use tilde notation and update certain dependencies by @​Phillip9587 in expressjs/body-parser#668
• chore: remove SECURITY.md by @​Phillip9587 in expressjs/body-parser#669
• ci: add CodeQL (SAST) by @​Phillip9587 in expressjs/body-parser#670
• Release: 1.20.4 by @​UlisesGascon in expressjs/body-parser#672

Full Changelog: expressjs/body-parser@1.20.3...1.20.4

1.20.3

What's Changed

Important

• deps: qs@6.13.0
• add depth option to customize the depth level in the parser
• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

• chore: add support for OSSF scorecard reporting by @​inigomarquinez in expressjs/body-parser#522
• ci: fix errors in ci github action for node 8 and 9 by @​inigomarquinez in expressjs/body-parser#523
• fix: pin to node@22.4.1 by @​wesleytodd in expressjs/body-parser#527
• deps: qs@6.12.3 by @​melikhov-dev in expressjs/body-parser#521
• Add OSSF Scorecard badge by @​bjohansebas in expressjs/body-parser#531
• Linter by @​UlisesGascon in expressjs/body-parser#534
• Release: 1.20.3 by @​UlisesGascon in expressjs/body-parser#535

New Contributors

• @​inigomarquinez made their first contribution in expressjs/body-parser#522
• @​melikhov-dev made their first contribution in expressjs/body-parser#521
• @​bjohansebas made their first contribution in expressjs/body-parser#531
• @​UlisesGascon made their first contribution in expressjs/body-parser#534

Full Changelog: expressjs/body-parser@1.20.2...1.20.3

1.20.2

• Fix strict json error message on Node.js 19+
• deps: content-type@~1.0.5
  • perf: skip value escaping when unnecessary
• deps: raw-body@2.5.2

1.20.1

• deps: qs@6.11.0
• perf: remove unnecessary object clone

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.4 / 2025-12-01

• deps: qs@~6.14.0
• deps: use tilde notation for dependencies
• deps: http-errors@~2.0.1
• deps: raw-body@~2.5.3

1.20.3 / 2024-09-10

• deps: qs@6.13.0
• add depth option to customize the depth level in the parser
• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

1.20.2 / 2023-02-21

• Fix strict json error message on Node.js 19+
• deps: content-type@~1.0.5
  • perf: skip value escaping when unnecessary
• deps: raw-body@2.5.2

1.20.1 / 2022-10-06

• deps: qs@6.11.0
• perf: remove unnecessary object clone

1.20.0 / 2022-04-02

• Fix error message for json parse whitespace in strict
• Fix internal error when inflated body exceeds limit
• Prevent loss of async hooks context
• Prevent hanging when request already read
• deps: depd@2.0.0
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: http-errors@2.0.0
  • deps: depd@2.0.0
  • deps: statuses@2.0.1
• deps: on-finished@2.4.1
• deps: qs@6.10.3
• deps: raw-body@2.5.1
  • deps: http-errors@2.0.0

1.19.2 / 2022-02-15

... (truncated)

Commits

• 7db202c 1.20.4 (#672)
• d8f8adb ci: add CodeQL (SAST) (#670)
• 6d133c1 chore: remove SECURITY.md (#669)
• fcd1535 deps: use tilde notation and update certain dependencies (#668)
• ec5fa29 deps: qs@~6.14.0 (#664)
• ffb95c1 ci: restore CI for 1.x branch (#665)
• 48a5f07 ci: add support for Node.js v23 (#553)
• f20f6ad Remove redundant depth check (#538)
• 1752951 1.20.3
• 39744cf chore: linter (#534)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.

Updates brace-expansion from 1.1.6 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

v1.1.11

brace-expansion

Brace expansion, as known from sh/bash, in JavaScript.

Example

var expand = require('brace-expansion');
expand('file-{a,b,c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('-v{,,}')
// => ['-v', '-v', '-v']
expand('file{0..2}.jpg')
// => ['file0.jpg', 'file1.jpg', 'file2.jpg']
expand('file-{a..c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('file{2..0}.jpg')
// => ['file2.jpg', 'file1.jpg', 'file0.jpg']
expand('file{0..4..2}.jpg')
// => ['file0.jpg', 'file2.jpg', 'file4.jpg']
expand('file-{a..e..2}.jpg')
// => ['file-a.jpg', 'file-c.jpg', 'file-e.jpg']
expand('file{00..10..5}.jpg')
// => ['file00.jpg', 'file05.jpg', 'file10.jpg']
</tr></table>

... (truncated)

Commits

• 44f33b4 1.1.12
• c460dbd pkg: publish on tag 1.x
• ccb8ac6 fmt
• c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
• 01a21de 1.1.11
• d7c93ee sponsors
• 54a6176 1.1.10
• 327c729 Merge pull request #40 from Parcley/add-license-1
• b6ba2e0 create LICENSE file
• 0f82dab 1.1.9
• Additional commits viewable in compare view

Updates cookie from 0.1.3 to 0.7.2

Release notes

Sourced from cookie's releases.

v0.7.2

Fixed

• Fix object assignment of hasOwnProperty (#177) bc38ffd

jshttp/cookie@v0.7.1...v0.7.2

0.7.1

Fixed

• Allow leading dot for domain (#174)
  • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
• Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)

jshttp/cookie@v0.7.0...v0.7.1

0.7.0

• perf: parse cookies ~10% faster (#144 by @​kurtextrem and #170)
• fix: narrow the validation of cookies to match RFC6265 (#167 by @​bewinsnw)
• fix: add main to package.json for rspack (#166 by @​proudparrot2)

jshttp/cookie@v0.6.0...v0.7.0

0.6.0

• Add partitioned option

0.5.0

• Add priority option
• Fix expires option to reject invalid dates
• pref: improve default decode speed
• pref: remove slow string split in parse

0.4.2

• pref: read value only when assigning in parse
• pref: remove unnecessary regexp in parse

0.4.1

• Fix maxAge option to reject invalid values

0.4.0

• Add SameSite=None support

0.3.1

• Fix sameSite: true to work with draft-7 clients
  • true now sends SameSite=Strict instead of SameSite

0.3.0

• Add sameSite option
  • Replaces firstPartyOnly option, never implemented by browsers
• Improve error message when encode is not a function

... (truncated)

Commits

• d19eaa1 0.7.2
• bc38ffd Fix object assignment of hasOwnProperty (#177)
• cf4658f 0.7.1
• 6a8b8f5 Allow leading dot for domain (#174)
• 58015c0 Remove more code and perf wins (#172)
• ab057d6 0.7.0
• 5f02ca8 Migrate history to GitHub releases
• a5d591c Migrate history to GitHub releases
• 51968f9 Skip isNaN
• 9e7ca51 perf(parse): cache length, return early (#144)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.

Updates cross-spawn from 2.2.3 to 5.1.0

Changelog

Sourced from cross-spawn's changelog.

5.1.0 (2017-02-26)

Bug Fixes

• fix options.shell support for NodeJS v4.8

5.0.1 (2016-11-04)

Bug Fixes

• fix options.shell support for NodeJS v7

5.0.0 (2016-10-30)

Features

• add support for options.shell
• improve parsing of shebangs by using shebang-command module

Chores

• refactor some code to make it more clear
• update README caveats

Commits

• 1da4c09 Release 5.1.0
• 2eeda0e Node 4.8 supports the shell option for spawn (#67)
• d74d461 Release 5.0.1
• 444efdb Fix shell option with Node 7 (#48)
• 8deb123 Update README.md
• d424f89 CS.
• 4187519 Typo in comment.
• 2d22b33 Release 5.0.0
• 9ba08eb Update README.md
• 36ac0f5 Add support for options.shell and other goodies (#46)
• Additional commits viewable in compare view

Updates debug from 0.7.4 to 2.6.1

Changelog

Sourced from debug's changelog.

2.6.1 / 2017-01-16

• Fix: Module's export default syntax fix for IE8 Expected identifier error

2.6.0 / 2016-12-28

• Fix: added better null pointer checks for browser useColors (@​thebigredgeek)
• Improvement: removed explicit window.debug export (#404, @​tootallnate)
• Improvement: deprecated DEBUG_FD environment variable (#405, @​tootallnate)

2.5.2 / 2016-12-25

• Fix: reference error on window within webworkers (#393, @​KlausTrainer)
• Docs: fixed README typo (#391, @​lurch)
• Docs: added notice about v3 api discussion (@​thebigredgeek)

2.5.1 / 2016-12-20

• Fix: babel-core compatibility

2.5.0 / 2016-12-20

• Fix: wrong reference in bower file (@​thebigredgeek)
• Fix: webworker compatibility (@​thebigredgeek)
• Fix: output formatting issue (#388, @​kribblo)
• Fix: babel-loader compatibility (#383, @​escwald)
• Misc: removed built asset from repo and publications (@​thebigredgeek)
• Misc: moved source files to /src (#378, @​yamikuronue)
• Test: added karma integration and replaced babel with browserify for browser tests (#378, @​yamikuronue)
• Test: coveralls integration (#378, @​yamikuronue)
• Docs: simplified language in the opening paragraph (#373, @​yamikuronue)

2.4.5 / 2016-12-17

• Fix: navigator undefined in Rhino (#376, @​jochenberger)
• Fix: custom log function (#379, @​hsiliev)
• Improvement: bit of cleanup + linting fixes (@​thebigredgeek)
• Improvement: rm non-maintainted dist/ dir (#375, @​freewil)
• Docs: simplified language in the opening paragraph. (#373, @​yamikuronue)

2.4.4 / 2016-12-14

• Fix: work around debug being loaded in preload scripts for electron (#368, @​paulcbetts)

... (truncated)

Commits

• 37e14d6 Whitelist DEBUG_FD for values 1 and 2 only Fixes #410 (#415)
• 705a9fe Merge pull request #414 from vgoma/export-default-fix
• 78ae6c9 Fixed IE8 "Expected identifier" error
• 1c163a4 added names and skips arrays erasing on enable call (#409)
• ac5ccae release 2.6.0
• 5895595 better null pointer checks for browser useColors
• 6646130 remove explicit window.debug export (#404)
• 62df220 Deprecate DEBUG_FD (#405)
• 9a18d66 release 2.5.2
• eba68ce fix(browser): prevent ReferenceError in workers (#393)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by thebigredgeek, a new releaser for debug since your current version.

Updates diff from 2.2.3 to 3.5.1

Changelog

Sourced from diff's changelog.

v3.5.1 - January 2026

Only change from 3.5.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v3.5.0 - March 4th, 2018

• Omit redundant slice in join method of diffArrays - 1023590
• Support patches with empty lines - fb0f208
• Accept a custom JSON replacer function for JSON diffing - 69c7f0a
• Optimize parch header parser - 2aec429
• Fix typos - e89c832

Commits

v3.4.0 - October 7th, 2017

• #183 - Feature request: ability to specify a custom equality checker for diffArrays
• #173 - Bug: diffArrays gives wrong result on array of booleans
• #158 - diffArrays will not compare the empty string in array?
• comparator for custom equality checks - 30e141e
• count oldLines and newLines when there are conflicts - 53bf384
• Fix: diffArrays can compare falsey items - 9e24284
• Docs: Replace grunt with npm test - 00e2f94

Commits

v3.3.1 - September 3rd, 2017

• #141 - Cannot apply patch because my file delimiter is "/r/n" instead of "/n"
• #192 - Fix: Bad merge when adding new files (#189)
• correct spelling mistake - 21fa478

Commits

v3.3.0 - July 5th, 2017

• #114 - /patch/merge not exported
• Gracefully accept invalid newStart in hunks, same as patch(1) does. - d8a3635
• Use regex rather than starts/ends with for parsePatch - 6cab62c
• Add browser flag - e64f674
• refactor: simplified code a bit more - 8f8e0f2
• refactor: simplified code a bit - b094a6f
• fix: some corrections re ignoreCase option - 3c78fd0
• ignoreCase option - 3cbfbb5
• Sanitize filename while parsing patches - 2fe8129
• Added better installation methods - aced50b
• Simple export of functionality - 8690f31

Commits

... (truncated)

Commits

• e8bb422 v3.5.1
• 2f5bf5e Backport kpdecker/jsdiff#649
• c9f00db Backport kpdecker/jsdiff#647
• e9ab948 v3.5.0
• b73884c Update release notes
• 8953021 Update release notes
• 1023590 Omit redundant slice in join method of diffArrays
• c72ef4a Add missing test coverage
• b9ef24f Support patches with empty lines
• 10aaabb Support patches with empty lines
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by explodingcabbage, a new releaser for diff since your current version.

Updates form-data from 2.1.2 to 2.3.3

Release notes

Sourced from form-data's releases.

Added filepath option

The filepath property overrides filename and may contain a relative path. This is typically used when uploading multiple files from a directory.

Thanks to @​sebdeckers

Proper toString

• toString will output '[object FormData]' Thanks to @​m59peacemaker

Broken version

No release notes provided.

Changelog

Sourced from form-data's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

v4.0.5 - 2025-11-17

Commits

• [Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076
• [Dev Deps] update @ljharb/eslint-config, eslint 5822467
• [Fix] set Symbol.toStringTag in the proper place 76d0dee

v4.0.4 - 2025-07-16

Commits

• [meta] add auto-changelog 811f682
• [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
• [Fix] Switch to using crypto random for boundary values 3d17230
• [Tests] fix linting errors 5e34080
• [meta] actually ensure the readme backup isn’t published 316c82b
• [Dev Deps] update @ljharb/eslint-config 58c25d7
• [meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

• [Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

• [eslint] use a shared config 426ba9a
• [eslint] fix some spacing issues 2094191
• [Refactor] use hasown 81ab41b
• [Fix] validate boundary type in setBoundary() method 8d8e469
• [Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1
• [Dev Deps] remove unused deps 870e4e6
• [meta] remove local commit hooks e6e83cc
• [Dev Deps] update eslint 4066fd6
• [meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2 - 2025-02-14

Merged

• [Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

... (truncated)

Commits

• See full diff in compare view

Updates hosted-git-info from 2.2.0 to 2.8.9

Changelog

Sourced from hosted-git-info's changelog.

2.8.9 (2021-04-07)

Bug Fixes

• backport regex fix from #76 (29adfe5), closes #84

2.8.8 (2020-02-29)

Bug Fixes

• #61 & #65 addressing issues w/ url.URL implmentation which regressed node 6 support (5038b18), closes #66

2.8.7 (2020-02-26)

Bug Fixes

• Do not attempt to use url.URL when unavailable (2d0bb66), closes #61 #62
• Do not pass scp-style URLs to the WhatWG url.URL (f2cdfcf), closes #60

2.8.6 (2020-02-25)

2.8.5 (2019-10-07)

Bug Fixes

• updated pathmatch for gitlab (e8325b5), closes #51
• updated pathmatch for gitlab (ffe056f)

2.8.4 (2019-08-12)

... (truncated)

Commits

• 8d4b369 chore(release): 2.8.9
• 29adfe5 fix: backport regex fix from #76
• afeaefd chore(release): 2.8.8
• 5038b18 fix: #61 & #65 addressing issues w/ url.URL implmentation which regressed nod...
• 7440afa chore(release): 2.8.7
• 2d0bb66 fix: Do not attempt to use url.URL when unavailable
• f2cdfcf fix: Do not pass scp-style URLs to the WhatWG url.URL
• e1b83df chore(release): 2.8.6
• ff259a6 Ensure passwords in hosted Git URLs are correctly escaped
• 624fd6f chore(release): 2.8.5
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by nlf, a new releaser for hosted-git-info since your current version.

Updates lodash from 3.10.1 to 4.17.4

Release notes

Sourced from lodash's releases.

4.0.0

lodash v4.0.0

2015 was big year! Lodash became the most depended on npm package, passed 1 billion downloads, & its v3 release saw massive adoption!

The year was also one of collaboration, as discussions began on merging Lodash & Underscore. Much of Lodash v4 is proofing out the ideas from those discussions. Lodash v4 would not be possible without the collaboration & contributions of the Underscore core team. In the spirit of merging our teams have blended with several members contributing to both libraries.

For 2016 & lodash v4.0.0 we wanted to cut loose, push forward, & take things up a notch!

Modern only

With v4 we’re breaking free from old projects, old environments, & dropping old IE < 9 support!

4 kB Core

Lodash’s kitchen-sink size will continue to grow as new methods & functionality are added. However, we now offer a 4 kB (gzipped) core build that’s compatible with Backbone v1.2.4 for folks who want Lodash without lugging around the kitchen sink.

More ES6

We’ve continued to embrace ES6 with methods like _.isSymbol, added support for cloning & comparing array buffers, maps, sets, & symbols, converting iterators to arrays, & iterable _(…).

In addition, we’ve published an es-build & pulled babel-plugin-lodash into core to make tree-shaking a breeze.

More Modular

Pop quiz! 📣

What category path does the bindAll method belong to? Is it

A) require('lodash/function/bindAll') B) require('lodash/utility/bindAll') C) require('lodash/util/bindAll')

Don’t know? Well, with v4 it doesn’t matter because now module paths are as simple as

var bindAll = require('lodash/bindAll');

We’ve also reduced module complexity making it easier to create smaller bundles. This has helped Lodash adoption with libraries like Async & Redux!

1st Class FP

With v3 we introduced lodash-fp. We learned a lot & with v4 we decided to pull it into core.

Now you can get immutable, auto-curried, iteratee-first, data-last methods as simply as

var _ = require('lodash/fp');
var object = { 'a': 1 };
</tr></table> 

... (truncated)

Commits

• 912d6b0 Bump to v4.17.4.
• 1655720 Rebuild lodash and docs.
• ae467c7 Update deps.
• 1e80c19 Remove dead “modern environments” link from readme. [ci skip]
• 6eeafd3 Update kitchen sink size. [ci skip]
• e33b156 Ensure _.omit doesn’t mutate object with deep paths. [closes #2912]
• a23b918 Increment package version to enable ci tests.
• ef61899 Bump to v4.17.3.
• 708b962 Rebuild lodash and docs.
• da2d08d Update deps.
• Additional commits viewable in compare view

Updates min-document from 2.19.0 to 2.19.2

Commits

• 0d14150 2.19.2
• 49c2e06 Merge pull request #56 from wasabina67/fix/prototype-pollution-removeAttribut...
• 9666461 Fix prototype pollution vulnerability in removeAttributeNS
• 4490b40 2.19.1
• 2cd5871 update ignore
• fe32e8d Merge pull request #55 from jameswassink/fix/prototype-pollution-removeAttrib...
• 6c5f31a Better prototype pollution fix
• 0d4e819 Fix prototype pollution in removeAttributeNS
• bf7b691 Update package.json
• 1b5402d Merge pull request #49 from PixnBits/patch-1
• Additional commits viewable in compare view

Updates morgan from 1.6.1 to 1.10.1

Release notes

Sourced from morgan's releases.

1.10.1

What's Changed

• renaming simple to sample in readme by @​ryhinchey in expressjs/morgan#237
• adding installation instructions to readme by @​ryhinchey in expressjs/morgan#233
• chore: add support for OSSF scorecard reporting by @​inigomarquinez in expressjs/morgan#291
• ci: replace travis with github actions by @​inigomarquinez in expressjs/morgan#290
• docs: add example output for log formats by @​jonchurch in expressjs/morgan#299
• ci: use ubuntu-latest by @​bjohansebas in expressjs/morgan#301
• ci: apply OSSF Scorecard security best practices by @​UlisesGascon in expressjs/morgan#300
• remove --bail by @​jonchurch in expressjs/morgan#314
• ⬆️ bump on-headers by @​ctcpip in expressjs/morgan#319

New Contributors

• @​inigomarquinez made their first contribution in expressjs/morgan#291
• @​jonchurch made their first contribution in expressjs/morgan#299
• @​bjohansebas made their first contribution in expressjs/morgan#301
• @​UlisesGascon made their first contribution in expressjs/morgan#300
• @​ctcpip made their first contribution in expressjs/morgan#319

Full Changelog: expressjs/morgan@1.10.0...1.10.1

1.10.0

• Add :total-time token
• Fix trailing space in colored status code for dev format
• deps: basic-auth@~2.0.1
  • deps: safe-buffer@5.1.2
• deps: depd@~2.0.0
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: on-headers@~1.0.2
  • Fix res.writeHead patch missing return value

1.9.1

• Fix using special characters in format
• deps: depd@~1.1.2
  • perf: remove argument reassignment

1.9.0

• Use res.headersSent when available
• deps: basic-auth@~2.0.0
  • Use safe-buffer for improved Buffer API
• deps: debug@2.6.9
• deps: depd@~1.1.1
  • Remove unnecessary Buffer loading

1.8.2

• deps: debug@2.6.8
  • Fix DEBUG_MAX_ARRAY_LENGTH
  • deps: ms@2.0.0

... (truncated)

Changelog

Sourced from morgan's changelog.

1.10.1 / 2025-07-17

• deps: on-headers@~1.1.0
  • Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

1.10.0 / 2020-03-20

• Add :total-time token
• Fix trailing space in colored status code for dev format
• deps: basic-auth@~2.0.1
  • deps: safe-buffer@5.1.2
• deps: depd@~2.0.0
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: on-headers@~1.0.2
  • Fix res.writeHead patch missing return value

1.9.1 / 2018-09-10

• Fix using special characters in format
• deps: depd@~1.1.2
  • perf: remove argument reassignment

1.9.0 / 2017-09-26

• Use res.headersSent when available
• deps: basic-auth@~2.0.0
  • Use safe-buffer for improved Buffer API
• deps: debug@2.6.9
• deps: depd@~1.1.1
  • Remove unnecessary Buffer loading

1.8.2 / 2017-05-23

• deps: debug@2.6.8
  • Fix DEBUG_MAX_ARRAY_LENGTH
  • deps: ms@2.0.0

1.8.1 / 2017-02-04

• deps: debug@2.6.1
  • Fix deprecation messages in WebStorm and other editors
  • Undeprecate DEBUG_FD set to 1 or 2

... (truncated)

Details

Description has been truncated