4.22.0

Kieirra/murmure4.22.0Dec 1, 2025by UlisesGascon

AI Summary

The 4.x version of the release includes security fixes and dependency updates, specifically upgrading the `qs` library and adding support for newer Node.js versions in CI.

Key Highlights

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
Upgrade to qs@6.14.0
Added support for Node.js 23 and 24 in CI
Method functions with no path now error

Breaking Changes

Method functions with no path should error

Full Release Notes

## Important: Security

* Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))


## What's Changed
* Refactor: improve readability by @sazk07 in https://github.com/expressjs/express/pull/6190
* ci: add support for Node.js@23.0 by @UlisesGascon in https://github.com/expressjs/express/pull/6080
* Method functions with no path should error by @wesleytodd in https://github.com/expressjs/express/pull/5957
* ci: updated github actions ci workflow by @Phillip9587 in https://github.com/expressjs/express/pull/6323
* ci: reorder `npm i` steps to fix ci for older node versions by @Phillip9587 in https://github.com/expressjs/express/pull/6336
* Backport: ci: add node.js 24 to test matrix by @Phillip9587 in https://github.com/expressjs/express/pull/6506
* chore(4.x): wider range for query test skip by @jonchurch in https://github.com/expressjs/express/pull/6513
* use tilde notation for certain dependencies by @UlisesGascon in https://github.com/expressjs/express/pull/6905
* deps: qs@6.14.0 by @UlisesGascon in https://github.com/expressjs/express/pull/6909
* deps: use tilde notation for `qs` by @Phillip9587 in https://github.com/expressjs/express/pull/6919
* Release: 4.22.0 by @UlisesGascon in https://github.com/expressjs/express/pull/6921


**Full Changelog**: https://github.com/expressjs/express/compare/4.21.2...4.22.0