Update express deps

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
express (source)	~4.19.0 -> ~4.21.0
express-handlebars	^7.0.0 -> ^8.0.0

---

Release Notes

expressjs/express (express)

v4.21.2

Compare Source

v4.21.1

Compare Source

What's Changed

• Backport a fix for CVE-2024-47764 to the 4.x branch by @​joshbuker in https://github.com/expressjs/express/pull/6029
• Release: 4.21.1 by @​UlisesGascon in https://github.com/expressjs/express/pull/6031

Full Changelog: expressjs/express@4.21.0...4.21.1

v4.21.0

Compare Source

What's Changed

• Deprecate "back" magic string in redirects by @​blakeembrey in https://github.com/expressjs/express/pull/5935
• [email protected] by @​wesleytodd in https://github.com/expressjs/express/pull/5954
• fix(deps): [email protected] by @​wesleytodd in https://github.com/expressjs/express/pull/5951
• Upgraded dependency qs to 6.13.0 to match qs in body-parser by @​agadzinski93 in https://github.com/expressjs/express/pull/5946

New Contributors

• @​agadzinski93 made their first contribution in https://github.com/expressjs/express/pull/5946

Full Changelog: expressjs/express@4.20.0...4.21.0

v4.20.0

Compare Source

==========

• deps: [email protected]
  • Remove link renderization in html while redirecting
• deps: [email protected]
  • Remove link renderization in html while redirecting
• deps: [email protected]
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
• Remove link renderization in html while using res.redirect
• deps: [email protected]
  • Adds support for named matching groups in the routes using a regex
  • Adds backtracking protection to parameters without regexes defined
• deps: encodeurl@~2.0.0
  • Removes encoding of \, |, and ^ to align better with URL spec
• Deprecate passing options.maxAge and options.expires to res.clearCookie
  • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

v4.19.2

Compare Source

==========

• Improved fix for open redirect allow list bypass

v4.19.1

Compare Source

==========

• Allow passing non-strings to res.location with new encoding handling checks

express-handlebars/express-handlebars (express-handlebars)

v8.0.1

Compare Source

Bug Fixes

• remove module type (#​857) (efca370)

v8.0.0

Compare Source

Bug Fixes

• require node v20 (#​854) (cb0358e)

BREAKING CHANGES

• minimum node v20

7.1.3 (2024-06-19)

Bug Fixes

• deps: update dependency glob to ^10.4.2 (#​782) (676a537)

7.1.2 (2023-08-08)

Bug Fixes

• use types from handlebars for helpers (#​617) (bc38da4)

7.1.1 (2023-08-02)

Bug Fixes

• deps: update dependency handlebars to ^4.7.8 (#​616) (54ef900)

v7.1.3

Compare Source

Bug Fixes

• deps: update dependency glob to ^10.4.2 (#​782) (676a537)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.