build(deps): bump morgan from 1.10.1 to 1.12.0 by dependabot[bot] · Pull Request #4473 · ever-co/ever-teams

dependabot · 2026-09-10T16:09:05Z

Bumps morgan from 1.10.1 to 1.12.0.

Release notes

1.12.0

What's Changed

fix: upgrade http:// to https:// in README by @hanu-14 in expressjs/morgan#363

build: bump github actions and dev dependencies by @sheplu in expressjs/morgan#369

chore(ci): npm-publish via reusable workflows by @sheplu in expressjs/morgan#334

docs: add ES modules import example by @aladi-debug in expressjs/morgan#352

docs: fix README lint errors by @UlisesGascon in expressjs/morgan#373

ci: use latest patch per Node.js major, add 23-26 by @UlisesGascon in expressjs/morgan#374

feat: pass objects through to streams in objectMode by @UlisesGascon in expressjs/morgan#375

feat: NO_COLOR env var removes color in dev format by @jonchurch in expressjs/morgan#377

New Contributors

@hanu-14 made their first contribution in expressjs/morgan#363

@sheplu made their first contribution in expressjs/morgan#369

@aladi-debug made their first contribution in expressjs/morgan#352

Full Changelog: expressjs/morgan@1.11.0...1.12.0

1.11.0

What's Changed

feat: add :pid token by @ganesh3367 in expressjs/morgan#329

Security Fix:

Escape control characters in :remote-user token to prevent log injection

Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

New Contributors

@inigomarquinez made their first contribution in expressjs/morgan#291

@jonchurch made their first contribution in expressjs/morgan#299

@bjohansebas made their first contribution in expressjs/morgan#301

@UlisesGascon made their first contribution in expressjs/morgan#300

@ctcpip made their first contribution in expressjs/morgan#319

@ganesh3367 made their first contribution in expressjs/morgan#329

Full Changelog: expressjs/morgan@1.10.0...1.11.0

Changelog

Sourced from morgan's changelog.

1.12.0

Security fix for CVE-2026-15603(GHSA-jxfw-x594-9x9m)

Allow format functions to return objects for streams in objectMode

Respect the NO_COLOR environment variable in the dev format

1.11.0

add :pid token

Security Fix:

Escape control characters in :remote-user token to prevent log injection

Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

Commits

063f084 1.12.0 (#376)
fbf9383 fix: escape all token values in log output
0338399 feat: NO_COLOR env var removes color in dev format (#377)
51007f9 feat: pass objects through to streams in objectMode (#375)
4790f5d ci: use latest patch per Node.js major, add 23-26 (#374)
786c66d docs: fix README lint errors (#373)
98d848c docs: add ES modules import example (#352)
fb9a228 chore(ci): npm-publish via reusable workflows (#334)
4729fe8 build: bump github actions and dev dependencies (#369)
bd171d7 docs: update link (#363)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for morgan since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Updates morgan from 1.10.1 to 1.12.0. This brings in security fixes for log injection (CVE-2026-5078) and CVE-2026-15603, plus new :pid token and NO_COLOR support. Also bumps the on-finished dependency to ~2.4.1.

^{Written for commit 0452021. Summary will update on new commits.}

Bumps [morgan](https://github.com/expressjs/morgan) from 1.10.1 to 1.12.0. - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.10.1...1.12.0) --- updated-dependencies: - dependency-name: morgan dependency-version: 1.12.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Copilot wasn't able to review any files in this pull request.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

coderabbitai · 2026-09-10T16:09:14Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 57d09521-ea05-4830-a6df-bc2ea24edf31

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

cla-assistant · 2026-09-10T16:09:28Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

socket-security · 2026-09-10T16:10:48Z

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

codacy-production · 2026-09-10T16:11:23Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

sonarqubecloud · 2026-09-10T16:11:34Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot AI lite review requested due to automatic review settings September 10, 2026 16:09

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 10, 2026

dependabot Bot mentioned this pull request Sep 10, 2026

build(deps): bump morgan from 1.10.1 to 1.11.0 #4386

Closed

Copilot AI reviewed Sep 10, 2026

View reviewed changes

Navigation Menu

Uh oh!

build(deps): bump morgan from 1.10.1 to 1.12.0 - #4473

build(deps): bump morgan from 1.10.1 to 1.12.0#4473
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/morgan-1.12.0

dependabot Bot commented on behalf of github Sep 10, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot commented Sep 10, 2026

Review skipped

Uh oh!

cla-assistant Bot commented Sep 10, 2026

Uh oh!

socket-security Bot commented Sep 10, 2026

Uh oh!

codacy-production Bot commented Sep 10, 2026

Uh oh!

sonarqubecloud Bot commented Sep 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 10, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.12.0

What's Changed

New Contributors

1.11.0

What's Changed

New Contributors

1.12.0

1.11.0

Summary by cubic

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Sep 10, 2026

Review skipped

Uh oh!

cla-assistant Bot commented Sep 10, 2026

Uh oh!

socket-security Bot commented Sep 10, 2026

Uh oh!

codacy-production Bot commented Sep 10, 2026

Up to standards ✅

Uh oh!

sonarqubecloud Bot commented Sep 10, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 10, 2026 •

edited by cubic-dev-ai Bot

Loading