diff --git a/libs/eventually-broker/package.json b/libs/eventually-broker/package.json
index 55636215..234a0679 100644
--- a/libs/eventually-broker/package.json
+++ b/libs/eventually-broker/package.json
@@ -25,7 +25,7 @@
     "cron": "^2.4.4",
     "cron-parser": "^4.9.0",
     "cron-validator": "^1.3.1",
-    "express": "^4.18.2",
+    "express": "^4.19.2",
     "express-handlebars": "^7.1.2",
     "helmet": "^7.1.0",
     "joi": "^17.11.0",
diff --git a/libs/eventually-express/package.json b/libs/eventually-express/package.json
index dfb84ae0..0e163902 100644
--- a/libs/eventually-express/package.json
+++ b/libs/eventually-express/package.json
@@ -24,7 +24,7 @@
     "@rotorsoft/eventually": "workspace:^5",
     "@rotorsoft/eventually-openapi": "workspace:^0",
     "cors": "^2.8.5",
-    "express": "^4.18.2"
+    "express": "^4.19.2"
   },
   "devDependencies": {
     "@types/express": "^4.17.21"
diff --git a/services/hotel/package.json b/services/hotel/package.json
index 1f663910..c26e2281 100644
--- a/services/hotel/package.json
+++ b/services/hotel/package.json
@@ -16,7 +16,7 @@
     "@rotorsoft/eventually": "workspace:^5",
     "@rotorsoft/eventually-express": "workspace:^5",
     "@rotorsoft/eventually-pg": "workspace:^5",
-    "express": "^4.18.2",
+    "express": "^4.19.2",
     "express-handlebars": "^7.1.2",
     "zod": "^3.22.4"
   },
diff --git a/yarn.lock b/yarn.lock
index f58d6891..d4bf370c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1686,7 +1686,7 @@ __metadata:
     cron: ^2.4.4
     cron-parser: ^4.9.0
     cron-validator: ^1.3.1
-    express: ^4.18.2
+    express: ^4.19.2
     express-handlebars: ^7.1.2
     helmet: ^7.1.0
     joi: ^17.11.0
@@ -1703,7 +1703,7 @@ __metadata:
     "@rotorsoft/eventually-openapi": "workspace:^0"
     "@types/express": ^4.17.21
     cors: ^2.8.5
-    express: ^4.18.2
+    express: ^4.19.2
   languageName: unknown
   linkType: soft
 
@@ -3415,7 +3415,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"body-parser@npm:^1.20.1":
+"body-parser@npm:1.20.2, body-parser@npm:^1.20.1":
   version: 1.20.2
   resolution: "body-parser@npm:1.20.2"
   dependencies:
@@ -3817,6 +3817,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cookie@npm:0.6.0":
+  version: 0.6.0
+  resolution: "cookie@npm:0.6.0"
+  checksum: f56a7d32a07db5458e79c726b77e3c2eff655c36792f2b6c58d351fb5f61531e5b1ab7f46987150136e366c65213cbe31729e02a3eaed630c3bf7334635fb410
+  languageName: node
+  linkType: hard
+
 "cors@npm:^2.8.5":
   version: 2.8.5
   resolution: "cors@npm:2.8.5"
@@ -4482,6 +4489,45 @@ __metadata:
   languageName: node
   linkType: hard
 
+"express@npm:^4.19.2":
+  version: 4.19.2
+  resolution: "express@npm:4.19.2"
+  dependencies:
+    accepts: ~1.3.8
+    array-flatten: 1.1.1
+    body-parser: 1.20.2
+    content-disposition: 0.5.4
+    content-type: ~1.0.4
+    cookie: 0.6.0
+    cookie-signature: 1.0.6
+    debug: 2.6.9
+    depd: 2.0.0
+    encodeurl: ~1.0.2
+    escape-html: ~1.0.3
+    etag: ~1.8.1
+    finalhandler: 1.2.0
+    fresh: 0.5.2
+    http-errors: 2.0.0
+    merge-descriptors: 1.0.1
+    methods: ~1.1.2
+    on-finished: 2.4.1
+    parseurl: ~1.3.3
+    path-to-regexp: 0.1.7
+    proxy-addr: ~2.0.7
+    qs: 6.11.0
+    range-parser: ~1.2.1
+    safe-buffer: 5.2.1
+    send: 0.18.0
+    serve-static: 1.15.0
+    setprototypeof: 1.2.0
+    statuses: 2.0.1
+    type-is: ~1.6.18
+    utils-merge: 1.0.1
+    vary: ~1.1.2
+  checksum: 212dbd6c2c222a96a61bc927639c95970a53b06257080bb9e2838adb3bffdb966856551fdad1ab5dd654a217c35db94f987d0aa88d48fb04d306340f5f34dca5
+  languageName: node
+  linkType: hard
+
 "extend@npm:^3.0.2":
   version: 3.0.2
   resolution: "extend@npm:3.0.2"
@@ -5028,7 +5074,7 @@ __metadata:
     "@rotorsoft/eventually-pg": "workspace:^5"
     "@types/express": ^4.17.21
     "@types/jest": ^29.5.11
-    express: ^4.18.2
+    express: ^4.19.2
     express-handlebars: ^7.1.2
     jest: ^29.7.0
     ts-node-dev: ^2.0.0