Bump express and @types/express#17
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
dependabot
Bot
added
dependencies
Bumps [express](https://github.com/expressjs/express) and [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express). These dependencies needed to be updated together. Updates `express` from 4.22.1 to 5.2.1 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v4.22.1...v5.2.1) Updates `@types/express` from 4.17.25 to 5.0.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express) --- updated-dependencies: - dependency-name: "@types/express" dependency-version: 5.0.6 dependency-type: direct:development update-type: version-update:semver-major - dependency-name: express dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/multi-b251156d90
branch
from
ef7388a to
47d4371
Compare
This was referenced May 4, 2026
Collaborator
|
Deferred: this is a major version bump with breaking changes that needs a code-level review, not a lockfile bump. Reopening or filing a fresh PR after the audit is fine. Tracked here so we do not lose it:
Dependabot is now configured (monthly, grouped, majors only as separate PRs) so the queue should stay small. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
pulkitpareek18
pushed a commit
that referenced
this pull request
May 28, 2026
C-101 from the Phase 1 plan in docs/plan/bfsi-v1/04-commits.md — the
Phase 1 production-track Android client for the ZeroAuth Pramaan protocol.
Lands four Gradle modules:
:app — Activity, Compose UI, placeholder surface
rendering 'ZeroAuth — coming soon (scaffold
C-101)'. minSdk 30, targetSdk 34, Kotlin
1.9.22, AGP 8.3.2, Compose BOM 2024.02.02,
applicationId dev.zeroauth.banking,
versionCode 1 / versionName 0.1.0.
:prover — interface-only library. Prover.kt declares
generateProof(witnessJson) -> proofJson;
DefaultProver throws NotImplementedError.
The rapidsnark JNI bridge implementation
lands with C-104 per the Agent #17 plan
(docs/plan/bfsi-v1/agents/agent-17-android-prover.md
ticket A17-W3-Mon).
:sensors:r307 — interface-only library for the R307 USB-OTG
fingerprint sensor. Driver lands with C-145.
:sensors:biometric_prompt — interface-only library for the platform
BiometricPrompt + StrongBox key wrap. Real
invocation + class-3 enforcement land with
C-144.
The subtree is deliberately parallel to the existing android/ subtree
(the W3 desktop-login WebView spike): different toolchain pin
(android/ is Kotlin 2.0 + AGP 8.5; mobile/ is Kotlin 1.9.22 + AGP 8.3.2),
different applicationId (dev.zeroauth.android vs dev.zeroauth.banking),
different settings.gradle.kts root. They coexist for the W3-to-W4
transition; once C-104 lands the rapidsnark JNI bridge here the W3
WebView path becomes a tier-2 fallback and mobile/ is the authoritative
implementation.
Why this commit ships only a scaffold:
* gives downstream commits (C-104 prover, C-143 enrollment,
C-144 keystore, C-145 R307, C-146 e2e login) a place to land
without each one re-litigating module boundaries;
* exercises the module graph end-to-end (:app depends on all three
siblings from day one) so each implementation drop is a
module-internal change rather than a wiring change;
* the four pinned versions (Kotlin/AGP/Compose-BOM/compose-compiler)
are intentionally a stable older quartet — the toolchain bump is
re-evaluated once the rapidsnark JNI build stabilises post-C-104.
Reference artefacts the scaffold is designed against:
* docs/plan/bfsi-v1/02-bank-demo.md — Scenes 1 (enrollment) + 2
(kiosk login) drive the eventual flows in :app.
* docs/operations/device-support-matrix.md — minSdk 30 + StrongBox
+ class-3 BiometricPrompt requirements come from the tier-1 row
constraints + the tier-3 denylist.
* docs/plan/bfsi-v1/agents/agent-17-android-prover.md ticket
A17-W2-Mon — this commit is the explicit deliverable.
* docs/plan/bfsi-v1/agents/agent-04-vp-mobile.md ticket A04-W3-Tue —
the reviewer-side review of this PR.
New dependencies introduced (AndroidX core/lifecycle/activity, Compose
BOM + UI + Material 3 + Tooling, AndroidX test runners + Compose UI
test JUnit4): these are intrinsic to the Android-only platform choice.
The platform-level rationale is covered by adr/0010-android-webview-
snarkjs-bundling.md (the existing Android-only commitment in this tree)
and is being broadened in adr/0014-android-only-mobile-platform.md as
C-102 lands in week 3 (per docs/plan/bfsi-v1/agents/agent-04-vp-mobile.md
ticket A04-W1-Tue). No new ADR is opened with this commit — the
platform dep ADR trail is in flight on the C-102 PR.
Verification at commit time:
* find mobile -name '*.kt' -o -name '*.kts' -o -name '*.xml' lists
31 files spanning all four modules.
* 31 files / 1412 lines total.
* The Gradle wrapper jar is NOT committed; it lands in the
follow-on CI-wiring commit. No attempt is made to compile the
project locally — that runs in CI once the workflow exists.
pulkitpareek18
pushed a commit
that referenced
this pull request
May 28, 2026
C-101 from the Phase 1 plan in docs/plan/bfsi-v1/04-commits.md — the
Phase 1 production-track Android client for the ZeroAuth Pramaan protocol.
Lands four Gradle modules:
:app — Activity, Compose UI, placeholder surface
rendering 'ZeroAuth — coming soon (scaffold
C-101)'. minSdk 30, targetSdk 34, Kotlin
1.9.22, AGP 8.3.2, Compose BOM 2024.02.02,
applicationId dev.zeroauth.banking,
versionCode 1 / versionName 0.1.0.
:prover — interface-only library. Prover.kt declares
generateProof(witnessJson) -> proofJson;
DefaultProver throws NotImplementedError.
The rapidsnark JNI bridge implementation
lands with C-104 per the Agent #17 plan
(docs/plan/bfsi-v1/agents/agent-17-android-prover.md
ticket A17-W3-Mon).
:sensors:r307 — interface-only library for the R307 USB-OTG
fingerprint sensor. Driver lands with C-145.
:sensors:biometric_prompt — interface-only library for the platform
BiometricPrompt + StrongBox key wrap. Real
invocation + class-3 enforcement land with
C-144.
The subtree is deliberately parallel to the existing android/ subtree
(the W3 desktop-login WebView spike): different toolchain pin
(android/ is Kotlin 2.0 + AGP 8.5; mobile/ is Kotlin 1.9.22 + AGP 8.3.2),
different applicationId (dev.zeroauth.android vs dev.zeroauth.banking),
different settings.gradle.kts root. They coexist for the W3-to-W4
transition; once C-104 lands the rapidsnark JNI bridge here the W3
WebView path becomes a tier-2 fallback and mobile/ is the authoritative
implementation.
Why this commit ships only a scaffold:
* gives downstream commits (C-104 prover, C-143 enrollment,
C-144 keystore, C-145 R307, C-146 e2e login) a place to land
without each one re-litigating module boundaries;
* exercises the module graph end-to-end (:app depends on all three
siblings from day one) so each implementation drop is a
module-internal change rather than a wiring change;
* the four pinned versions (Kotlin/AGP/Compose-BOM/compose-compiler)
are intentionally a stable older quartet — the toolchain bump is
re-evaluated once the rapidsnark JNI build stabilises post-C-104.
Reference artefacts the scaffold is designed against:
* docs/plan/bfsi-v1/02-bank-demo.md — Scenes 1 (enrollment) + 2
(kiosk login) drive the eventual flows in :app.
* docs/operations/device-support-matrix.md — minSdk 30 + StrongBox
+ class-3 BiometricPrompt requirements come from the tier-1 row
constraints + the tier-3 denylist.
* docs/plan/bfsi-v1/agents/agent-17-android-prover.md ticket
A17-W2-Mon — this commit is the explicit deliverable.
* docs/plan/bfsi-v1/agents/agent-04-vp-mobile.md ticket A04-W3-Tue —
the reviewer-side review of this PR.
New dependencies introduced (AndroidX core/lifecycle/activity, Compose
BOM + UI + Material 3 + Tooling, AndroidX test runners + Compose UI
test JUnit4): these are intrinsic to the Android-only platform choice.
The platform-level rationale is covered by adr/0010-android-webview-
snarkjs-bundling.md (the existing Android-only commitment in this tree)
and is being broadened in adr/0014-android-only-mobile-platform.md as
C-102 lands in week 3 (per docs/plan/bfsi-v1/agents/agent-04-vp-mobile.md
ticket A04-W1-Tue). No new ADR is opened with this commit — the
platform dep ADR trail is in flight on the C-102 PR.
Verification at commit time:
* find mobile -name '*.kt' -o -name '*.kts' -o -name '*.xml' lists
31 files spanning all four modules.
* 31 files / 1412 lines total.
* The Gradle wrapper jar is NOT committed; it lands in the
follow-on CI-wiring commit. No attempt is made to compile the
project locally — that runs in CI once the workflow exists.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps express and @types/express. These dependencies needed to be updated together.
Updates
expressfrom 4.22.1 to 5.2.1Release notes
Sourced from express's releases.
... (truncated)
Changelog
Sourced from express's changelog.
... (truncated)
Commits
dbac7415.2.1697547cRevert "sec: security patch for CVE-2024-51999"4007ad1Release: 5.2.0 (#6920)2f64f68sec: security patch for CVE-2024-51999ed0ba3fbuild(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#6928)8eace46build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 (#6929)30bae81build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 (#6930)758d435deps: body-parser@^2.2.1 (#6922)77bcd52docs: update emeritus triagers (#6890)f33caf1Nominate to@efekrsklfor triage team (#6888)Updates
@types/expressfrom 4.17.25 to 5.0.6Commits