bump express dependencies #4411
Conversation
actual-github-bot
bot
changed the title
✅ Deploy Preview for actualbudget ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
WalkthroughThe pull request updates dependency versions in the sync-server package configuration. Several runtime and development dependencies have been modified to ensure the package is using more recent versions. The upgrade includes moving Express from version 4.20.0 to 4.21.2 and changing the Express rate limit package from version ^6.7.0 to ^7.5.0. In addition, development dependencies for Express type definitions have been updated, with @types/express moving from ^4.17.17 to ^5.0.0 and @types/express-actuator from ^1.8.0 to ^1.8.3. These changes reflect a maintenance update to align the package with newer releases of its dependencies and type definitions. Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
packages/sync-server/package.json (2)
36-36: Express-Rate-Limit Dependency Update
The package "express-rate-limit" has been updated from "^6.7.0" to "^7.5.0". This upgrade may include additional features or breaking changes. Please verify that the current rate limiting configurations in the application work as expected with the new version.
51-51: @types/express Version Upgrade
The update of "@types/express" from "^4.17.17" to "^5.0.0" reflects significant version improvements in type definitions. It's important to review any TypeScript errors or deprecations that might arise from updated type contracts in Express, as type changes between major releases can impact the application’s type safety.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
upcoming-release-notes/4411.mdis excluded by!**/*.mdyarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
packages/sync-server/package.json(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (6)
- GitHub Check: Functional
- GitHub Check: Visual regression
- GitHub Check: build (windows-latest)
- GitHub Check: build (ubuntu-latest)
- GitHub Check: Build Docker image (alpine)
- GitHub Check: Build Docker image (ubuntu)
🔇 Additional comments (2)
packages/sync-server/package.json (2)
34-34: Express Version Bump
The dependency for Express has been updated from "4.20.0" to "4.21.2". This aligns with the PR objective to address security vulnerabilities by moving to a newer patch release. Ensure that any middleware or integrations depending on Express are compatible with the minor version bump.
52-52: @types/express-actuator Update
The dev dependency "@types/express-actuator" has been updated from "^1.8.0" to "^1.8.3". This change appears to be a minor patch update to the type definitions and should enhance compatibility with the corresponding package.
Closes https://github.com/actualbudget/actual/security/dependabot/132