chore(deps): update npm (runtime)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
body-parser	1.20.6 → 1.20.8
cors	2.8.5 → 2.8.6
express (source)	4.22.0 → 4.22.3
influx	5.11.0 → 5.12.0
node-stream-zip	1.15.0 → 1.16.0

---

Release Notes

expressjs/body-parser (body-parser)

v1.20.8

Compare Source

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

• ci: backport npm-publish workflow from master by @​UlisesGascon in #​769
• 1.20.8 by @​UlisesGascon in #​770

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

expressjs/cors (cors)

v2.8.6

Compare Source

==================

• Improve documentation (API, context, examples...)
• Remove additional markdown files from tarball

expressjs/express (express)

v4.22.3

Compare Source

What's Changed

• Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 by @​baryman in #​7135
• feat: allow conditional revalidation for QUERY requests (v4) by @​Cherry in #​7377
• deps: qs@~6.16.0 by @​lazerg in #​7440
• ci: add npm staged publication with dist-tag support by @​UlisesGascon in #​7465
• 4.22.3 by @​UlisesGascon in #​7466

New Contributors

• @​baryman made their first contribution in #​7135
• @​lazerg made their first contribution in #​7440

Full Changelog: expressjs/express@v4.22.2...v4.22.3

v4.22.2

Compare Source

What's Changed

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

New Contributors

• @​suuuuuuminnnnnn made their first contribution in #​7021
• @​SAY-5 made their first contribution in #​7181

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

Compare Source

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

• Release: 4.22.1 by @​UlisesGascon in #​6934

Full Changelog: expressjs/express@4.22.0...v4.22.1

node-influx/node-influx (influx)

v5.12.0

Compare Source

Features

• AbortSignal parameter for queries (#​734) (4ae8dc1)

antelle/node-stream-zip (node-stream-zip)

v1.16.0

Compare Source

+ fixed reading compressed entry size to prevent exploitation reported by @​DumDumSu
* updated dependencies

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.