[dependabot]

Bumps the dev-dependencies group with 8 updates in the / directory:

Package	From	To
@astrojs/check	0.9.10	0.9.12
@playwright/test	1.62.1	1.64.1
@types/node	26.1.2	26.6.5
astro	7.1.6	7.4.2
chokidar	5.0.0	6.0.0
express	5.2.1	5.3.0
mermaid	11.4.1	12.2.0
typescript	6.0.3	7.0.2

Updates @astrojs/check from 0.9.10 to 0.9.12

Release notes

Sourced from @​astrojs/check's releases.

@​astrojs/check@​0.9.12

Patch Changes

• #18455 7af66fc Thanks @​astro-factory! - Fixes the astro-check binary ignoring its first two command-line arguments, so flags such as --help, --root, --watch, and --tsconfig are respected again. If your scripts padded the arguments to work around this (for example, astro-check -- -- --tsconfig ./tsconfig.app.json), remove the padding.
• Updated dependencies [044148d]:
  • @​astrojs/language-server@​2.17.3

@​astrojs/check@​0.9.11

Patch Changes

• #18445 d736df7 Thanks @​astro-factory! - Fixes the --preserveWatchOutput help text, which described the opposite of the flag's behavior. Setting it to true keeps output between checks in watch mode.

• #18444 c55134c Thanks @​astro-factory! - Fixes astro check --watch exiting immediately when the project path contains node_modules or .git

Changelog

Sourced from @​astrojs/check's changelog.

0.9.12

Patch Changes

• #18455 7af66fc Thanks @​astro-factory! - Fixes the astro-check binary ignoring its first two command-line arguments, so flags such as --help, --root, --watch, and --tsconfig are respected again. If your scripts padded the arguments to work around this (for example, astro-check -- -- --tsconfig ./tsconfig.app.json), remove the padding.
• Updated dependencies [044148d]:
  • @​astrojs/language-server@​2.17.3

0.9.11

Patch Changes

• #18445 d736df7 Thanks @​astro-factory! - Fixes the --preserveWatchOutput help text, which described the opposite of the flag's behavior. Setting it to true keeps output between checks in watch mode.

• #18444 c55134c Thanks @​astro-factory! - Fixes astro check --watch exiting immediately when the project path contains node_modules or .git

Commits

• 34c9535 [ci] release (#18459)
• 7af66fc Fix astro-check binary silently dropping the first two CLI arguments (#18455)
• e990df8 [ci] release (#18405)
• c55134c Fix astro check --watch exiting immediately when project path contains `nod...
• d736df7 Correct --preserveWatchOutput help text in astro check (#18445)
• 21feaab Update language-tools (#18347)
• 421d4a6 Update dependency @​astrojs/language-server to ^2.17.1 (#18320)
• 134af3e Update language-tools (#18312)
• da1333a Update dependency chokidar to v5 (#18107)
• 7cc0b00 Update language-tools (#17578)
• See full diff in compare view

Updates @playwright/test from 1.62.1 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• Additional commits viewable in compare view

Updates @types/node from 26.1.2 to 26.6.5

Commits

• See full diff in compare view

Updates astro from 7.1.6 to 7.4.2

Release notes

Sourced from astro's releases.

astro@7.4.2

Patch Changes

• #18430 dda9ec3 Thanks @​Abhirup-99! - Speeds up content sync with experimental.collectionStorage: "chunked" by computing each character's UTF-8 width from its code point instead of encoding every character through TextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.

• #18438 5e0eaa4 Thanks @​astro-factory! - Fixes astro dev with @astrojs/cloudflare failing with Calling `require` for "node-fetch" when a server dependency such as cross-fetch requires node-fetch

• #18376 a4e201d Thanks @​okxint! - Fixes astro dev treating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventing astro dev stop and astro dev --force from killing the unrelated process that owns the thread.

• #18467 d1fb7d3 Thanks @​astro-factory! - Fixes the defineConfig() types for i18n.defaultLocale, i18n.fallback, and i18n.domains so they accept a custom locale's path instead of its codes, matching how Astro validates and uses these values

• #18475 cf27e70 Thanks @​ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

• #18451 7a0ba6f Thanks @​DenisCDev! - Fixes astro sync, astro check and astro build replacing the optimized dependencies of a dev server running in the same project, which broke framework islands in that dev server until it was restarted with --force

• #18336 e943003 Thanks @​astro-factory! - Fixes inline styles in dev so that framework-transformed CSS is used, such as scoped styles and v-bind() in Vue single-file components

• #18399 829fc00 Thanks @​astro-factory! - Fixes a dev server error (Could not find server component name) for a server:defer island that imports astro:actions or astro:config/server, when its page was not the first island page loaded after starting the server

• #18330 4db9e0d Thanks @​Samuteg! - Fixes the astro:env/server virtual module being generated with invalid JS in dev when any environment variable contains $ replacement patterns ($`, $&, $', $1, …). The inlined env JSON was passed as a string to String.replace, so e.g. the KITTY_PUBLIC_KEY value set by default in Kitty terminals corrupted the module and broke dev with Failed to parse source for import analysis

• Updated dependencies [cf27e70]:

  • @​astrojs/telemetry@​3.4.1
  • @​astrojs/markdown-satteri@​0.4.5

astro@7.4.1

Patch Changes

• #18425 6fdc36e Thanks @​astro-factory! - Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

• #18419 395d195 Thanks @​astro-factory! - Fixes a typo in the error message shown when a font cssVariable is invalid

• #18401 484822f Thanks @​danielmlr! - Fixes a bug where projects whose path contains an apostrophe (') failed to load sessions, middleware, a cache provider, or a src/fetch.ts handler

• #18407 a6e00be Thanks @​astro-factory! - Fixes a TSCONFIG_ERROR during astro build when a parent directory contains a tsconfig.json that cannot be resolved, such as one extending astro/tsconfigs/strict without installed dependencies

• #18427 908f167 Thanks @​astro-factory! - Fixes an Unterminated string build error when application code imports from astro/config (for example, fontProviders in a shared fonts module)

• #18428 40e7d54 Thanks @​astro-factory! - Fixes missing styles in production builds for conditionally rendered framework components (e.g. Svelte components inside {#if} blocks) imported by a hydrated island

• #18424 617ff59 Thanks @​astro-factory! - Fixes style-only HMR in .astro components falling back to a full page reload when a PostCSS plugin (such as @unocss/postcss) lists the component as a dependency of its own style

• #18274 70834bb Thanks @​Princesseuh! - Fixes increasing memory usage when editing the Astro configuration while the dev server is running

astro@7.4.0

Minor Changes

• #17894 b7a1bd9 Thanks @​Princesseuh! - Adds a new --timings flag to astro build to help you find what slows down your builds

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.2

Patch Changes

• #18430 dda9ec3 Thanks @​Abhirup-99! - Speeds up content sync with experimental.collectionStorage: "chunked" by computing each character's UTF-8 width from its code point instead of encoding every character through TextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.

• #18438 5e0eaa4 Thanks @​astro-factory! - Fixes astro dev with @astrojs/cloudflare failing with Calling `require` for "node-fetch" when a server dependency such as cross-fetch requires node-fetch

• #18376 a4e201d Thanks @​okxint! - Fixes astro dev treating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventing astro dev stop and astro dev --force from killing the unrelated process that owns the thread.

• #18467 d1fb7d3 Thanks @​astro-factory! - Fixes the defineConfig() types for i18n.defaultLocale, i18n.fallback, and i18n.domains so they accept a custom locale's path instead of its codes, matching how Astro validates and uses these values

• #18475 cf27e70 Thanks @​ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

• #18451 7a0ba6f Thanks @​DenisCDev! - Fixes astro sync, astro check and astro build replacing the optimized dependencies of a dev server running in the same project, which broke framework islands in that dev server until it was restarted with --force

• #18336 e943003 Thanks @​astro-factory! - Fixes inline styles in dev so that framework-transformed CSS is used, such as scoped styles and v-bind() in Vue single-file components

• #18399 829fc00 Thanks @​astro-factory! - Fixes a dev server error (Could not find server component name) for a server:defer island that imports astro:actions or astro:config/server, when its page was not the first island page loaded after starting the server

• #18330 4db9e0d Thanks @​Samuteg! - Fixes the astro:env/server virtual module being generated with invalid JS in dev when any environment variable contains $ replacement patterns ($`, $&, $', $1, …). The inlined env JSON was passed as a string to String.replace, so e.g. the KITTY_PUBLIC_KEY value set by default in Kitty terminals corrupted the module and broke dev with Failed to parse source for import analysis

• Updated dependencies [cf27e70]:

  • @​astrojs/telemetry@​3.4.1
  • @​astrojs/markdown-satteri@​0.4.5

7.4.1

Patch Changes

• #18425 6fdc36e Thanks @​astro-factory! - Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

• #18419 395d195 Thanks @​astro-factory! - Fixes a typo in the error message shown when a font cssVariable is invalid

• #18401 484822f Thanks @​danielmlr! - Fixes a bug where projects whose path contains an apostrophe (') failed to load sessions, middleware, a cache provider, or a src/fetch.ts handler

• #18407 a6e00be Thanks @​astro-factory! - Fixes a TSCONFIG_ERROR during astro build when a parent directory contains a tsconfig.json that cannot be resolved, such as one extending astro/tsconfigs/strict without installed dependencies

• #18427 908f167 Thanks @​astro-factory! - Fixes an Unterminated string build error when application code imports from astro/config (for example, fontProviders in a shared fonts module)

• #18428 40e7d54 Thanks @​astro-factory! - Fixes missing styles in production builds for conditionally rendered framework components (e.g. Svelte components inside {#if} blocks) imported by a hydrated island

• #18424 617ff59 Thanks @​astro-factory! - Fixes style-only HMR in .astro components falling back to a full page reload when a PostCSS plugin (such as @unocss/postcss) lists the component as a dependency of its own style

• #18274 70834bb Thanks @​Princesseuh! - Fixes increasing memory usage when editing the Astro configuration while the dev server is running

7.4.0

Minor Changes

... (truncated)

Commits

• 34c9535 [ci] release (#18459)
• cf27e70 fix: minimal support node version (#18475)
• 1efb9d6 Update dependency @​playwright/test to v1.64.1 (#18441)
• 5e0eaa4 fix(astro): stop excluding node-fetch from server dep optimization in workerd...
• a4e201d fix(dev): treat missing ps row as stale in lockfile process check (#18376)
• 7a0ba6f Use a separate Vite cache for the temporary sync server (#18451)
• d1fb7d3 fix(i18n): use locale path instead of codes in defineConfig i18n types (#18467)
• dda9ec3 fix(content): compute UTF-8 width arithmetically in getChunkEnd (#18430)
• 7af66fc Fix astro-check binary silently dropping the first two CLI arguments (#18455)
• 829fc00 Skip server island manifest in CSS ensureModulesLoaded to fix late-discovery ...
• Additional commits viewable in compare view

Updates chokidar from 5.0.0 to 6.0.0

Release notes

Sourced from chokidar's releases.

6.0.0

High-level changes

• Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
• Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
• Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
• Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
• Required Node.js 22.22 or later.

API changes

• Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
  • usePolling: true remains as a deprecated alias for backend: 'polling'.
• Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
  • The old names remain as deprecated aliases; the new names win when both are given.
• Changed the atomic default to false with polling. An explicit value is preserved.
• Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
• Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
• Emitted errors from add() as error events instead of unhandled rejections (#1378).
• Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
• Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

• Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
• Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
• Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
• Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
• Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
• Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
• Fixed false change events on Windows when many sibling files are written (#1466).
• Fixed duplicate add events for unchanged files under directory activity (#1465).
• Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
• Fixed persistent watching stopping after a watched directory was removed (#1463).
• Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
• Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
• Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
• Fixed files not being detected when their directory did not exist before watching (#1422).
• Fixed removed files being reported as unlinkDir instead of unlink (#1421).
• Fixed ignored files and directories still being watched in WSL (#1418).
• Fixed change being reported for every file when one file changed under Deno (#1417).
• Fixed changes not being detected after the second save (#1399).
• Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
• Fixed re-watching a path not honoring ignoreInitial (#1386).
• Fixed EISDIR errors during the initial scan of network drives (#1376).
• Fixed watching an array of absolute file paths (#1366).
• Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
• Documented that unwatched paths stay ignored until they are added again (#1439).

Misc

... (truncated)

Changelog

Sourced from chokidar's changelog.

6.0.0 (2026-10-19)

High-level changes

• Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
• Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
• Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
• Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
• Required Node.js 22.22 or later.

API changes

• Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
  • usePolling: true remains as a deprecated alias for backend: 'polling'.
• Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
  • The old names remain as deprecated aliases; the new names win when both are given.
• Changed the atomic default to false with polling. An explicit value is preserved.
• Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
• Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
• Emitted errors from add() as error events instead of unhandled rejections (#1378).
• Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
• Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

• Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
• Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
• Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
• Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
• Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
• Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
• Fixed false change events on Windows when many sibling files are written (#1466).
• Fixed duplicate add events for unchanged files under directory activity (#1465).
• Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
• Fixed persistent watching stopping after a watched directory was removed (#1463).
• Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
• Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
• Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
• Fixed files not being detected when their directory did not exist before watching (#1422).
• Fixed removed files being reported as unlinkDir instead of unlink (#1421).
• Fixed ignored files and directories still being watched in WSL (#1418).
• Fixed change being reported for every file when one file changed under Deno (#1417).
• Fixed changes not being detected after the second save (#1399).
• Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
• Fixed re-watching a path not honoring ignoreInitial (#1386).
• Fixed EISDIR errors during the initial scan of network drives (#1376).
• Fixed watching an array of absolute file paths (#1366).
• Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
• Documented that unwatched paths stay ignored until they are added again (#1439).

... (truncated)

Commits

• 4130839 Release 6.0.0.
• 53f3256 Bump devdeps
• 11ad48f More fixes
• b6812dd Change date
• 706ef2c Merge pull request #1492 from paulmillr/jg/private-public
• d85f4cc chore: expose tested members
• 97e1b93 Add changelog
• 8d5c07d More v6 fixes
• 7af52df Bump ci release.yml
• a0b05d9 Merge pull request #1478 from paulmillr/jg/sponsors
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with o...

  Description has been truncated