Skip to content

Build(deps): bump express-session and @types/express-session#1201

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-f0ed5a30e3
Closed

Build(deps): bump express-session and @types/express-session#1201
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-f0ed5a30e3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 18, 2025

Copy link
Copy Markdown
Contributor

Bumps express-session and @types/express-session. These dependencies needed to be updated together.
Updates express-session from 1.17.3 to 1.18.2

Release notes

Sourced from express-session's releases.

v1.18.2

What's Changed

New Contributors

Full Changelog: expressjs/session@v1.18.1...v1.18.2

1.18.1

What's Changed

New Contributors

Full Changelog: expressjs/session@v1.18.0...v1.18.1

1.18.0

  • Add debug log for pathname mismatch
  • Add partitioned to cookie options
  • Add priority to cookie options
  • Fix handling errors from setting cookie
  • Support any type in secret that crypto.createHmac supports
  • deps: cookie@0.6.0
    • Fix expires option to reject invalid dates
    • perf: improve default decode speed

... (truncated)

Changelog

Sourced from express-session's changelog.

1.18.2 / 2025-07-17

1.18.1 / 2024-10-08

  • deps: cookie@0.7.2
    • Fix object assignment of hasOwnProperty
  • deps: cookie@0.7.1
    • Allow leading dot for domain
      • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
    • Add fast path for serialize without options, use obj.hasOwnProperty when parsing
  • deps: cookie@0.7.0
    • perf: parse cookies ~10% faster
    • fix: narrow the validation of cookies to match RFC6265
    • fix: add main to package.json for rspack

1.18.0 / 2024-01-28

  • Add debug log for pathname mismatch
  • Add partitioned to cookie options
  • Add priority to cookie options
  • Fix handling errors from setting cookie
  • Support any type in secret that crypto.createHmac supports
  • deps: cookie@0.6.0
    • Fix expires option to reject invalid dates
    • perf: improve default decode speed
    • perf: remove slow string split in parse
  • deps: cookie-signature@1.0.7
Commits
  • d10709f 🔖 v1.18.2 (#1070)
  • 5808783 deps: on-headers@1.1.0 (#1069)
  • b9fcad8 chore: fix typos (#1066)
  • a698c81 build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 (#1051)
  • ec1957b build(deps): bump actions/upload-artifact from 4.5.0 to 4.6.2 (#1052)
  • 2caff6a build(deps): bump actions/checkout from 4.1.1 to 4.2.2 (#1049)
  • 2633e88 build(deps): bump github/codeql-action from 3.24.7 to 3.28.18 (#1050)
  • 7e2c696 build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 (#1048)
  • 92dd300 build(deps-dev): bump mocha from 10.2.0 to 10.8.2 (#1061)
  • 168271c fix(dependabot): do not update major versions
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express-session since your current version.


Updates @types/express-session from 1.17.10 to 1.18.2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [express-session](https://github.com/expressjs/session) and [@types/express-session](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express-session). These dependencies needed to be updated together.

Updates `express-session` from 1.17.3 to 1.18.2
- [Release notes](https://github.com/expressjs/session/releases)
- [Changelog](https://github.com/expressjs/session/blob/master/HISTORY.md)
- [Commits](expressjs/session@v1.17.3...v1.18.2)

Updates `@types/express-session` from 1.17.10 to 1.18.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express-session)

---
updated-dependencies:
- dependency-name: express-session
  dependency-version: 1.18.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: "@types/express-session"
  dependency-version: 1.18.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 18, 2025
@dependabot
dependabot Bot requested a review from a team July 18, 2025 07:36
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 18, 2025
@dependabot @github

dependabot Bot commented on behalf of github Jan 23, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1303.

@dependabot dependabot Bot closed this Jan 23, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-f0ed5a30e3 branch January 23, 2026 07:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants