build(deps): Bump morgan from 1.10.0 to 1.11.0 by dependabot[bot] · Pull Request #1744 · RequestNetwork/requestNetwork

dependabot · 2026-07-10T23:30:11Z

Bumps morgan from 1.10.0 to 1.11.0.

Release notes

1.11.0

What's Changed

feat: add :pid token by @ganesh3367 in expressjs/morgan#329

Security Fix:

Escape control characters in :remote-user token to prevent log injection

Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

New Contributors

@inigomarquinez made their first contribution in expressjs/morgan#291

@jonchurch made their first contribution in expressjs/morgan#299

@bjohansebas made their first contribution in expressjs/morgan#301

@UlisesGascon made their first contribution in expressjs/morgan#300

@ctcpip made their first contribution in expressjs/morgan#319

@ganesh3367 made their first contribution in expressjs/morgan#329

Full Changelog: expressjs/morgan@1.10.0...1.11.0

1.10.1

What's Changed

renaming simple to sample in readme by @ryhinchey in expressjs/morgan#237

adding installation instructions to readme by @ryhinchey in expressjs/morgan#233

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/morgan#291

ci: replace travis with github actions by @inigomarquinez in expressjs/morgan#290

docs: add example output for log formats by @jonchurch in expressjs/morgan#299

ci: use ubuntu-latest by @bjohansebas in expressjs/morgan#301

ci: apply OSSF Scorecard security best practices by @UlisesGascon in expressjs/morgan#300

remove --bail by @jonchurch in expressjs/morgan#314

⬆️ bump on-headers by @ctcpip in expressjs/morgan#319

New Contributors

@inigomarquinez made their first contribution in expressjs/morgan#291

@jonchurch made their first contribution in expressjs/morgan#299

@bjohansebas made their first contribution in expressjs/morgan#301

@UlisesGascon made their first contribution in expressjs/morgan#300

@ctcpip made their first contribution in expressjs/morgan#319

Full Changelog: expressjs/morgan@1.10.0...1.10.1

Changelog

Sourced from morgan's changelog.

1.11.0 / 2026-06-02

add :pid token

Security Fix:

Escape control characters in :remote-user token to prevent log injection

Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

1.10.1 / 2025-07-17

deps: on-headers@~1.1.0

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

Commits

e0e6f17 Release 1.11.0 (#350)
b3f5d9b Merge commit from fork
203c758 build(deps): bump github/codeql-action from 4.32.4 to 4.35.2 (#346)
002bc81 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#347)
561b0d7 build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.0 (#338)
2db705e build(deps): bump github/codeql-action from 3.29.7 to 4.32.4 (#337)
a373c5f build(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.3 (#327)
c8e72fa build(deps): bump actions/checkout from 4.1.1 to 6.0.1 (#324)
023300e build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (#307)
9d8d6c0 build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 (#306)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for morgan since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [morgan](https://github.com/expressjs/morgan) from 1.10.0 to 1.11.0. - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.10.0...1.11.0) --- updated-dependencies: - dependency-name: morgan dependency-version: 1.11.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

greptile-apps · 2026-07-10T23:31:19Z

Greptile Summary

This PR bumps morgan from 1.10.0 to 1.11.0 in the request-node package, picking up a security fix for CVE-2026-5078 (log injection via unescaped control characters in the :remote-user token) and a new :pid token.

The lock file also upgrades transitive dependencies: on-finished to ~2.4.1 and on-headers to ~1.1.0, the latter resolving CVE-2025-7339.
The debug@^4.3.5 entry in yarn.lock is deduplicated to point at the existing 4.3.7 resolution, which is a minor cleanup with no version change.

Confidence Score: 5/5

Safe to merge — this is a targeted dependency upgrade with no code changes, resolving two CVEs in the logging middleware stack.

The change is limited to bumping morgan and its transitive dependencies in one package. The new version fixes a log injection vulnerability and is fully backward-compatible; the only new API is an optional :pid token. Lock file changes are consistent with the version upgrade.

No files require special attention.

Important Files Changed

Filename	Overview
packages/request-node/package.json	Bumps morgan from 1.10.0 to 1.11.0 to pick up the log injection security fix (CVE-2026-5078)
yarn.lock	Lock file updates morgan to 1.11.0 and transitively upgrades on-finished (~2.4.1) and on-headers (~1.1.0, which fixes CVE-2025-7339); also deduplicates the debug@^4.3.5 entry

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Client
    participant morgan 1.11.0
    participant Express App
    participant Logger

    Client->>morgan 1.11.0: HTTP Request (with :remote-user)
    morgan 1.11.0->>morgan 1.11.0: Escape control characters in :remote-user token
    morgan 1.11.0->>Express App: next()
    Express App-->>morgan 1.11.0: Response (via on-headers 1.1.0)
    morgan 1.11.0->>Logger: Write sanitized log entry

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Client
    participant morgan 1.11.0
    participant Express App
    participant Logger

    Client->>morgan 1.11.0: HTTP Request (with :remote-user)
    morgan 1.11.0->>morgan 1.11.0: Escape control characters in :remote-user token
    morgan 1.11.0->>Express App: next()
    Express App-->>morgan 1.11.0: Response (via on-headers 1.1.0)
    morgan 1.11.0->>Logger: Write sanitized log entry

_{Reviews (1): Last reviewed commit: "build(deps): Bump morgan from 1.10.0 to ..." | Re-trigger Greptile}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): Bump morgan from 1.10.0 to 1.11.0#1744

build(deps): Bump morgan from 1.10.0 to 1.11.0#1744
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/morgan-1.11.0

dependabot Bot commented on behalf of github Jul 10, 2026

Uh oh!

greptile-apps Bot commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 10, 2026

1.11.0

What's Changed

New Contributors

1.10.1

What's Changed

New Contributors

1.11.0 / 2026-06-02

1.10.1 / 2025-07-17

Uh oh!

greptile-apps Bot commented Jul 10, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants