v4.22.3

anomalyco/opentuiv4.22.3Sep 14, 2026by UlisesGascon

Upgrading?

AI Summary

This release focuses on security by addressing a CVE vulnerability in the path-to-regexp dependency. It introduces a new feature allowing conditional revalidation for QUERY requests and updates associated dependencies. Additionally, CI workflows were improved to support staged publication.

Key Highlights

  • Security fix: Updated path-to-regexp to 0.1.13 to address CVE-2026-4867
  • New feature: Allow conditional revalidation for QUERY requests
  • Dependency update: Updated qs to version 6.16.0
  • CI improvement: Added npm staged publication with dist-tag support

New Features

  • Conditional revalidation for QUERY requests

Full Release Notes

## What's Changed
* Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 by @baryman in https://github.com/expressjs/express/pull/7135
* feat: allow conditional revalidation for QUERY requests (v4) by @Cherry in https://github.com/expressjs/express/pull/7377
* deps: qs@~6.16.0 by @lazerg in https://github.com/expressjs/express/pull/7440
* ci: add npm staged publication with dist-tag support by @UlisesGascon in https://github.com/expressjs/express/pull/7465
* 4.22.3 by @UlisesGascon in https://github.com/expressjs/express/pull/7466

## New Contributors
* @baryman made their first contribution in https://github.com/expressjs/express/pull/7135
* @lazerg made their first contribution in https://github.com/expressjs/express/pull/7440

**Full Changelog**: https://github.com/expressjs/express/compare/v4.22.2...v4.22.3

Related Repositories