[Snyk] Upgrade express from 4.18.1 to 4.22.1

[eldadfux]

Snyk has created this PR to upgrade express from 4.18.1 to 4.22.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 11 versions ahead of your current version.

• The recommended version was released 23 days ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Asymmetric Resource Consumption (Amplification) SNYK-JS-BODYPARSER-7926860	529	No Known Exploit
	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	529	No Known Exploit
	Open Redirect SNYK-JS-EXPRESS-6474509	529	No Known Exploit
	Cross-site Scripting SNYK-JS-EXPRESS-7926867	529	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	529	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-8482416	529	Proof of Concept
	Cross-site Scripting SNYK-JS-SEND-7926862	529	No Known Exploit
	Cross-site Scripting SNYK-JS-SERVESTATIC-7926865	529	No Known Exploit

Release notes

Package name: express

• 4.22.1 - 2025-12-01
  

  What's Changed

  Important

  The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

  • Release: 4.22.1 by @ UlisesGascon in #6934

  Full Changelog: 4.22.0...v4.22.1

• 4.22.0 - 2025-12-01
  

  Important: Security

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

  What's Changed

  • Refactor: improve readability by @ sazk07 in #6190
  • ci: add support for [email protected] by @ UlisesGascon in #6080
  • Method functions with no path should error by @ wesleytodd in #5957
  • ci: updated github actions ci workflow by @ Phillip9587 in #6323
  • ci: reorder npm i steps to fix ci for older node versions by @ Phillip9587 in #6336
  • Backport: ci: add node.js 24 to test matrix by @ Phillip9587 in #6506
  • chore(4.x): wider range for query test skip by @ jonchurch in #6513
  • use tilde notation for certain dependencies by @ UlisesGascon in #6905
  • deps: [email protected] by @ UlisesGascon in #6909
  • deps: use tilde notation for qs by @ Phillip9587 in #6919
  • Release: 4.22.0 by @ UlisesGascon in #6921

  Full Changelog: 4.21.2...4.22.0

• 4.21.2 - 2024-12-05
  

  What's Changed

  • Add funding field (v4) by @ bjohansebas in #6065
  • deps: [email protected] by @ blakeembrey in #5956
  • deps: bump [email protected] by @ jonchurch in #6209
  • Release: 4.21.2 by @ UlisesGascon in #6094

  Full Changelog: 4.21.1...4.21.2

• 4.21.1 - 2024-10-08
  

  What's Changed

  • Backport a fix for CVE-2024-47764 to the 4.x branch by @ joshbuker in #6029
  • Release: 4.21.1 by @ UlisesGascon in #6031

  Full Changelog: 4.21.0...4.21.1

• 4.21.0 - 2024-09-11
  

  What's Changed

  • Deprecate "back" magic string in redirects by @ blakeembrey in #5935
  • [email protected] by @ wesleytodd in #5954
  • fix(deps): [email protected] by @ wesleytodd in #5951
  • Upgraded dependency qs to 6.13.0 to match qs in body-parser by @ agadzinski93 in #5946

  New Contributors

  • @ agadzinski93 made their first contribution in #5946

  Full Changelog: 4.20.0...4.21.0

• 4.20.0 - 2024-09-10
  

  What's Changed

  Important

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect

  Other Changes

  • 4.19.2 Staging by @ wesleytodd in #5561
  • remove duplicate location test for data uri by @ wesleytodd in #5562
  • feat: document beta releases expectations by @ marco-ippolito in #5565
  • Cut down on duplicated CI runs by @ jonchurch in #5564
  • Add a Threat Model by @ UlisesGascon in #5526
  • Assign captain of encodeurl by @ blakeembrey in #5579
  • Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @ jonchurch in #5587
  • docs: update Security.md by @ inigomarquinez in #5590
  • docs: update triage nomination policy by @ UlisesGascon in #5600
  • Add CodeQL (SAST) by @ UlisesGascon in #5433
  • docs: add UlisesGascon as triage initiative captain by @ UlisesGascon in #5605
  • deps: encodeurl@~2.0.0 by @ blakeembrey in #5569
  • skip QUERY method test by @ jonchurch in #5628
  • ignore ETAG query test on 21 and 22, reuse skip util by @ jonchurch in #5639
  • add support Node.js@22 in the CI by @ mertcanaltin in #5627
  • doc: add table of contents, tc/triager lists to readme by @ mertcanaltin in #5619
  • List and sort all projects, add captains by @ blakeembrey in #5653
  • docs: add @ UlisesGascon as captain for cookie-parser by @ UlisesGascon in #5666
  • ✨ bring back query tests for node 21 by @ ctcpip in #5690
  • [v4] Deprecate res.clearCookie accepting options.maxAge and options.expires by @ jonchurch in #5672
  • skip QUERY tests for Node 21 only, still not supported by @ jonchurch in #5695
  • 📝 update people, add ctcpip to TC by @ ctcpip in #5683
  • remove minor version pinning from ci by @ jonchurch in #5722
  • Fix link variable use in attribution section of CODE OF CONDUCT by @ IamLizu in #5762
  • Replace Appveyor windows testing with GHA by @ jonchurch in #5599
  • Add OSSF Scorecard badge by @ UlisesGascon in #5436
  • update scorecard link by @ bjohansebas in #5814
  • Nominate @ IamLizu to the triage team by @ UlisesGascon in #5836
  • deps: [email protected] by @ blakeembrey in #5603
  • docs: specify new instructions for question and discuss by @ IamLizu in #5835
  • 4.x: Upgrade merge-descriptors dependency by @ RobinTail in #5781
  • [email protected] by @ blakeembrey in #5902

  New Contributors

  • @ marco-ippolito made their first contribution in #5565
  • @ inigomarquinez made their first contribution in #5590
  • @ mertcanaltin made their first contribution in #5627
  • @ ctcpip made their first contribution in #5690
  • @ bjohansebas made their first contribution in #5814

  Full Changelog: 4.19.1...4.20.0

• 4.19.2 - 2024-03-25
• 4.19.1 - 2024-03-20
• 4.19.0 - 2024-03-20
• 4.18.3 - 2024-02-29
• 4.18.2 - 2022-10-08
• 4.18.1 - 2022-04-29

from express GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch snyk-upgrade-a09ada7f2ae4d1fa63c9bdbe44e64302

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Adityakk9031]

@eldadfux sir please look into this pr appwrite/appwrite#10951 this already approved please merge it

[Adityakk9031]

appwrite/appwrite#10991 also this pr