...**/!(*.map|*.min.js)Size
Gzip
Dependencies
Publish
Install
Publish
Install
Size
Gzip
Dependencies
@@ -1,7 +1,7 @@ | ||
| 1 | 1 | { |
| 2 | 2 | "name": "express", |
| 3 | 3 | "description": "Fast, unopinionated, minimalist web framework", |
| 4 | "version": "4.22.1", | |
| 4 | "version": "4.22.2", | |
| 5 | 5 | "author": "TJ Holowaychuk <tj@vision-media.ca>", |
| 6 | 6 | "contributors": [ |
| 7 | 7 | "Aaron Heckmann <aaron.heckmann+github@gmail.com>", |
@@ -34,7 +34,7 @@ | ||
| 34 | 34 | "dependencies": { |
| 35 | 35 | "accepts": "~1.3.8", |
| 36 | 36 | "array-flatten": "1.1.1", |
| 37 | "body-parser": "~1.20.3", | |
| 37 | "body-parser": "~1.20.5", | |
| 38 | 38 | "content-disposition": "~0.5.4", |
| 39 | 39 | "content-type": "~1.0.4", |
| 40 | 40 | "cookie": "~0.7.1", |
@@ -53,7 +53,7 @@ | ||
| 53 | 53 | "parseurl": "~1.3.3", |
| 54 | 54 | "path-to-regexp": "~0.1.12", |
| 55 | 55 | "proxy-addr": "~2.0.7", |
| 56 | "qs": "~6.14.0", | |
| 56 | "qs": "~6.15.1", | |
| 57 | 57 | "range-parser": "~1.2.1", |
| 58 | 58 | "safe-buffer": "5.2.1", |
| 59 | 59 | "send": "~0.19.0", |
@@ -1,7 +1,16 @@ | ||
| 1 | 4.22.2 / 2026-05-011 | |
| 2 | ========== | |
| 3 | ||
| 4 | * fix: restore >20 array parsing for `req.query` repeated keys ([`8d09bfe6`](https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db)) | |
| 5 | * This also unifies array-cap behavior across notations. Indexed notation (`a[0]=...`) was historically capped at qs's default `arrayLimit` of 20 even in older qs versions; after this change it also allows up to 1000 items. | |
| 6 | * deps: qs@~6.15.1 | |
| 7 | * deps: body-parser@~1.20.5 | |
| 8 | ||
| 1 | 9 | 4.22.1 / 2025-12-01 |
| 2 | 10 | ========== |
| 3 | 11 | |
| 4 | 12 | * Revert security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6)) |
| 13 | * The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release. | |
| 5 | 14 | |
| 6 | 15 | 4.22.0 / 2025-12-01 |
| 7 | 16 | ========== |