[dependabot]

Bumps the production-dependencies group with 3 updates in the / directory: @node-saml/node-saml, express and nodemailer.

Updates @node-saml/node-saml from 5.1.0 to 5.2.0

Release notes

Sourced from @​node-saml/node-saml's releases.

v5.2.0

• Check idpIssuer on a login Response and its assertion, and reject a message with more than one Issuer (#515) (71b30b2)
• Warn before v6 rejects legacy decryption algorithms (#513) (521e9c8)
• Update dependencies without raising the Node floor (#510) (3eb12e0)
• Reject replayed assertions by remembering their IDs when asked to, and stop skipping a maxAssertionAgeMs deadline at the epoch (#506) (8ee2835)
• Export from the root every type its API uses, and document lib/ as internal (#461) (a0a0123)
• Warn when a response lacks a bearer confirmation, or a Recipient or Destination that matches (#505) (32f5b9d)
• Check a POST-binding LogoutResponse's status and issuer, as the Redirect binding does (#500) (d3eb48a)
• Reject a parsed query whose RelayState is not the one in the signed query string (#498) (ad08542)
• Deprecate overriding the methods that validate an incoming message (#504) (b3f7f5f)
• Give the attribute-value and multiple-reference warnings a migration path (#509) (49833a9)
• Accept decryptionPvk as Base64, read Base64 PKCS #1 private keys, and correct the error for a key that can't be read (#447) (a4abbdc)
• Retire the request a signed NoPassive response answers (#501) (d195c63)
• Read the status of a signed response from the bytes its signature covers (#502) (dcb358a)
• Sign the Redirect-binding parameters as they are sent (#496) (15ac505)
• Process the Redirect-binding parameters that were verified, and deprecate the parsed-query argument (#494) (f74b332)
• Add the sha256-mgf1 signature algorithm (RSASSA-PSS) (#479) (f5b76d0)
• Make metadataContactPerson and metadataOrganization follow the metadata schema, and warn about request Extensions that SAML does not allow (#485) (afdb88a)
• Add support for AttributeConsumingService in SAML metadata (#396) (8773120)
• Warn when generateServiceProviderMetadata signs with an omitted or unrecognized algorithm (#478) (6b38d03)
• Warn when a signature is ignored for having more than one reference (#477) (9c9d381)
• Remove the tests of deprecation warnings (#482) (68dbb9a)
• Group tests and deprecations in the changelog (#475) (ae42526)
• Update xml-crypto to 6.3.3 (#476) (345199d)
• Add tests for the signature ambiguity rejections, the SHA-1 fallback, and error statuses (#460) (ef8fef1)
• Document turning on debug output with NODE_DEBUG=node-saml (#462) (3af74a3)
• Remove normalizeNewlines now that xmldom normalizes line endings (#455) (ba5a887)
• Export InMemoryCacheProvider from the package root (#454) (6762d23)
• Stop unsigned input from retiring a pending request ID (#448) (bb96591)
• Warn when an attribute reaches the profile with no usable value (#427) (c9b213d)
• Read the verified bytes in validatePostRequestAsync, not the raw ones (#440) (081ba99)
• Enforce SubjectConfirmationData NotOnOrAfter in every validateInResponseTo mode (#439) (fd7d8db)
• Stop trusting an unsigned Response's InResponseTo (#434) (95e628e)
• Deprecate Profile.getSamlResponseXml() (#426) (503b512)
• Warn when a security-relevant default was never chosen, and close InResponseTo replay gaps (#425) (5a47bc4)
• Warn when a redirect-binding logout message carries no signature (#420) (2616706)
• Update xml-crypto to 6.3 and delegate PEM handling to it (#409) (ac1a318)
• Docs: audit the README for accuracy and structure (#430) (b10fce3)
• Deprecate the unused host argument on the getAuthorize* methods (#421) (9b07731)
• Docs: add AGENTS.md and CLAUDE.md (#416) (91efe9a)
• Update dependencies and fix the CI matrix (#417) (a78dfa3)
• Security: remove debug dependency (#406) (25c434a)
• Update to support Node strip-only TypeScript support (#407) (b6fc8b6)

Changelog

Sourced from @​node-saml/node-saml's changelog.

5.2.0 (2026-10-26)

🚀 Minor Changes

• [security] Reject replayed assertions by remembering their IDs when asked to, and stop skipping a maxAssertionAgeMs deadline at the epoch #506
• Export from the root every type its API uses, and document lib/ as internal #461
• Accept decryptionPvk as Base64, read Base64 PKCS #1 private keys, and correct the error for a key that can't be read #447
• Add the sha256-mgf1 signature algorithm (RSASSA-PSS) #479
• Make metadataContactPerson and metadataOrganization follow the metadata schema, and warn about request Extensions that SAML does not allow #485
• Add support for AttributeConsumingService in SAML metadata #396
• Warn when generateServiceProviderMetadata signs with an omitted or unrecognized algorithm #478
• [security] Warn when a signature is ignored for having more than one reference #477
• Export InMemoryCacheProvider from the package root #454
• Warn when an attribute reaches the profile with no usable value #427
• [security] Warn when a security-relevant default was never chosen, and close InResponseTo replay gaps #425
• [security] Warn when a redirect-binding logout message carries no signature #420

⚠️ Deprecations

• [security] Warn before v6 rejects legacy decryption algorithms #513
• [security] Warn when a response lacks a bearer confirmation, or a Recipient or Destination that matches #505
• [security] Deprecate overriding the methods that validate an incoming message #504
• Give the attribute-value and multiple-reference warnings a migration path #509
• [security] Process the Redirect-binding parameters that were verified, and deprecate the parsed-query argument #494
• [security] Deprecate Profile.getSamlResponseXml() #426
• Deprecate the unused host argument on the getAuthorize* methods #421

🔗 Dependencies

• Update dependencies without raising the Node floor #510
• Update xml-crypto to 6.3.3 #476
• Update dependencies and fix the CI matrix #417
• security: remove debug dependency #406

🐛 Bug Fixes

• [security] Check idpIssuer on a login Response and its assertion, and reject a message with more than one Issuer #515
• [security] Check a POST-binding LogoutResponse's status and issuer, as the Redirect binding does #500
• [security] Reject a parsed query whose RelayState is not the one in the signed query string #498
• [security] Retire the request a signed NoPassive response answers #501
• [security] Read the status of a signed response from the bytes its signature covers #502
• Sign the Redirect-binding parameters as they are sent #496
• [security] Stop unsigned input from retiring a pending request ID #448
• [security] Read the verified bytes in validatePostRequestAsync, not the raw ones #440
• [security] Enforce SubjectConfirmationData NotOnOrAfter in every validateInResponseTo mode #439
• [security] Stop trusting an unsigned Response's InResponseTo #434
• Update xml-crypto to 6.3 and delegate PEM handling to it #409

📚 Documentation

... (truncated)

Commits

• 3d083fb Release 5.2.0
• 71b30b2 Check idpIssuer on a login Response and its assertion, and reject a message...
• 521e9c8 Warn before v6 rejects legacy decryption algorithms (#513)
• 3eb12e0 Update dependencies without raising the Node floor (#510)
• 8ee2835 Reject replayed assertions by remembering their IDs when asked to, and stop s...
• a0a0123 Export from the root every type its API uses, and document lib/ as internal...
• 32f5b9d Warn when a response lacks a bearer confirmation, or a Recipient or Destinati...
• d3eb48a Check a POST-binding LogoutResponse's status and issuer, as the Redirect bind...
• ad08542 Reject a parsed query whose RelayState is not the one in the signed query s...
• b3f7f5f Deprecate overriding the methods that validate an incoming message (#504)
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

• cf6722b 5.3.0 (#7468)
• 8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
• 9efc29e docs: fix pass-through typos (#7509)
• 2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
• de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
• 9169cbe docs: add missing apostrophe in example (#7483)
• 7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
• 3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
• 98bd4cd deps: proxy-addr@^2.0.8 (#7474)
• 9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates nodemailer from 10.2.1 to 10.3.1

Release notes

Sourced from nodemailer's releases.

v10.3.1

10.3.1 (2026-10-29)

Bug Fixes

• apply the otp option in MailComposer too (1d4087f)

v10.3.0

10.3.0 (2026-10-29)

Summary

This release adds support for the OTP-Token header from the IETF draft draft-goto-otp-token, which lets mail clients and browsers offer a one-time passcode for autofill on the site it belongs to. It also fixes how a Content-ID header is encoded.

Who should upgrade

• Anyone sending one-time passcodes by email who wants them to be machine-readable.
• Anyone already setting an OTP-Token header through headers: before this release it went out MIME encoded and could not be parsed.
• Anyone embedding images with a cid that holds a non-ASCII character or a quote.

Highlights

• New otp message option: otp: { code: '123456', origin: 'https://example.com' } adds OTP-Token: "123456"; origin="https://example.com". The origin is reduced to its canonical form, only https (or http on a loopback host) is accepted, and invalid values fail the send with the new EOTP error code. See Message configuration.
• A custom OTP-Token header is no longer MIME word encoded. Line breaks and control characters are still removed.
• OTP-Token is included in the DKIM signature by default.
• A Content-ID header, from an attachment cid or set through headers, is now encoded as a message id rather than as text, so a cid with a non-ASCII character or a quote keeps matching the cid: URL in the HTML.
• Groundmail added to the well-known services.

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#1904) (47f2b25)

Changelog

Sourced from nodemailer's changelog.

10.3.1 (2026-10-29)

Bug Fixes

• apply the otp option in MailComposer too (1d4087f)

10.3.0 (2026-10-29)

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#1904) (47f2b25)

Commits

• 26555d0 Merge pull request #1906 from nodemailer/release-please--branches--master--co...
• 3e5bb55 chore(master): release 10.3.1
• 1d4087f fix: apply the otp option in MailComposer too
• 488ce9c chore(deps): update development dependencies
• 41eda65 chore(deps): update development dependencies
• 5de343d chore(master): release 10.3.0 (#1905)
• 7789e15 feat: add the otp option for the OTP-Token header
• 47f2b25 fix: encode a Content-ID header as a message id (#1904)
• a6e7a70 chore(services): add Groundmail (#1903)
• a0cea19 chore(deps): update development dependencies [skip ci]
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.