fix(deps): update external major (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@semantic-release/exec	6.0.3 → 7.1.0			devDependencies	major
actions/checkout	v4 → v6			action	major
actions/setup-node	v4 → v6			action	major
express (source)	^4.19.2 → ^5.0.0			dependencies	major
matcher	^5.0.0 → ^6.0.0			dependencies	major
node	20 → 24			uses-with	major
p-queue	8.1.1 → 9.1.0			dependencies	major
semantic-release	24.2.9 → 25.0.3			devDependencies	major
serve-static	^1.15.0 → ^2.0.0			dependencies	major
yargs (source)	17.7.2 → 18.0.0			dependencies	major

---

Release Notes

semantic-release/exec (@​semantic-release/exec)

v7.1.0

Compare Source

Features

• error: print more useful error for non-process failure (#​449) (a285bc5)

v7.0.3

Compare Source

Bug Fixes

• deps: update dependency execa to v9 (643e2eb)

v7.0.2

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/error to v4 (#​353) (471f963)

v7.0.1

Compare Source

Bug Fixes

• deps: update dependency parse-json to v8 (#​394) (080440f)

v7.0.0

Compare Source

Features

• ES Module (#​411) (b4462db)

BREAKING CHANGES

• the minimum required version of semantic-release to use @semantic-release/exec is now v24.1.0; the warn logger method/function is now available to use in plugin

• @semantic-release/exec is now a native ES Module. It has named exports for each plugin hook (verifyConditions, analyzeCommits, verifyRelease, generateNotes, prepare, publish, addChannel, success, fail)

actions/checkout (actions/checkout)

v6

Compare Source

v5

Compare Source

actions/setup-node (actions/setup-node)

v6

Compare Source

v5

Compare Source

expressjs/express (express)

v5.2.1

Compare Source

=======================

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

v5.2.0

Compare Source

========================

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
• deps: body-parser@^2.2.1
• A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

v5.1.0

Compare Source

========================

• Add support for Uint8Array in res.send()
• Add support for ETag option in res.sendFile()
• Add support for multiple links with the same rel in res.links()
• Add funding field to package.json
• perf: use loop for acceptParams
• refactor: prefix built-in node module imports
• deps: remove setprototypeof
• deps: remove safe-buffer
• deps: remove utils-merge
• deps: remove methods
• deps: remove depd
• deps: debug@^4.4.0
• deps: body-parser@^2.2.0
• deps: router@^2.2.0
• deps: content-type@^1.0.5
• deps: finalhandler@^2.1.0
• deps: qs@^6.14.0
• deps: server-static@2.2.0
• deps: type-is@2.0.1

v5.0.1

Compare Source

==========

• Update cookie semver lock to address CVE-2024-47764

v5.0.0

Compare Source

=========================

• remove:
  • path-is-absolute dependency - use path.isAbsolute instead
• breaking:
  • res.status() accepts only integers, and input must be greater than 99 and less than 1000
    • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
    • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
  • deps: send@​1.0.0
  • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
• change:
  • res.clearCookie will ignore user provided maxAge and expires options
• deps: cookie-signature@^1.2.1
• deps: debug@​4.3.6
• deps: merge-descriptors@^2.0.0
• deps: serve-static@^2.1.0
• deps: qs@​6.13.0
• deps: accepts@^2.0.0
• deps: mime-types@^3.0.0
  • application/javascript => text/javascript
• deps: type-is@^2.0.0
• deps: content-disposition@^1.0.0
• deps: finalhandler@^2.0.0
• deps: fresh@^2.0.0
• deps: body-parser@^2.0.1
• deps: send@^1.1.0

sindresorhus/matcher (matcher)

v6.0.0

Compare Source

Breaking

• Require Node.js 20 f2c4926

---

actions/node-versions (node)

v24.13.1: 24.13.1

Compare Source

Node.js 24.13.1

v24.13.0: 24.13.0

Compare Source

Node.js 24.13.0

v24.12.0: 24.12.0

Compare Source

Node.js 24.12.0

v24.11.1: 24.11.1

Compare Source

Node.js 24.11.1

v24.11.0: 24.11.0

Compare Source

Node.js 24.11.0

v24.10.0: 24.10.0

Compare Source

Node.js 24.10.0

v24.9.0: 24.9.0

Compare Source

Node.js 24.9.0

v24.8.0: 24.8.0

Compare Source

Node.js 24.8.0

v24.7.0: 24.7.0

Compare Source

Node.js 24.7.0

v24.6.0: 24.6.0

Compare Source

Node.js 24.6.0

v24.5.0: 24.5.0

Compare Source

Node.js 24.5.0

v24.4.1: 24.4.1

Compare Source

Node.js 24.4.1

v24.4.0: 24.4.0

Compare Source

Node.js 24.4.0

v24.3.0: 24.3.0

Compare Source

Node.js 24.3.0

v24.2.0: 24.2.0

Compare Source

Node.js 24.2.0

v24.1.0: 24.1.0

Compare Source

Node.js 24.1.0

v24.0.2: 24.0.2

Compare Source

Node.js 24.0.2

v24.0.1: 24.0.1

Compare Source

Node.js 24.0.1

v24.0.0: 24.0.0

Compare Source

Node.js 24.0.0

v22.22.0: 22.22.0

Compare Source

Node.js 22.22.0

v22.21.1: 22.21.1

Compare Source

Node.js 22.21.1

v22.21.0: 22.21.0

Compare Source

Node.js 22.21.0

v22.20.0: 22.20.0

Compare Source

Node.js 22.20.0

v22.19.0: 22.19.0

Compare Source

Node.js 22.19.0

v22.18.0: 22.18.0

Compare Source

Node.js 22.18.0

v22.17.1: 22.17.1

Compare Source

Node.js 22.17.1

v22.17.0: 22.17.0

Compare Source

Node.js 22.17.0

v22.16.0: 22.16.0

Compare Source

Node.js 22.16.0

v22.15.1: 22.15.1

Compare Source

Node.js 22.15.1

v22.15.0: 22.15.0

Compare Source

Node.js 22.15.0

v22.14.0: 22.14.0

Compare Source

Node.js 22.14.0

v22.13.1: 22.13.1

Compare Source

Node.js 22.13.1

v22.13.0: 22.13.0

Compare Source

Node.js 22.13.0

v22.12.0: 22.12.0

Compare Source

Node.js 22.12.0

v22.11.0: 22.11.0

Compare Source

Node.js 22.11.0

v22.10.0: 22.10.0

Compare Source

Node.js 22.10.0

v22.9.0: 22.9.0

Compare Source

Node.js 22.9.0

v22.8.0: 22.8.0

Compare Source

Node.js 22.8.0

v22.7.0: 22.7.0

Compare Source

Node.js 22.7.0

v22.6.0: 22.6.0

Compare Source

Node.js 22.6.0

v22.5.1: 22.5.1

Compare Source

Node.js 22.5.1

v22.5.0: 22.5.0

Compare Source

Node.js 22.5.0

v22.4.1: 22.4.1

Compare Source

Node.js 22.4.1

v22.4.0: 22.4.0

Compare Source

Node.js 22.4.0

v22.3.0: 22.3.0

Compare Source

Node.js 22.3.0

v22.2.0: 22.2.0

Compare Source

Node.js 22.2.0

v22.1.0: 22.1.0

Compare Source

Node.js 22.1.0

v22.0.0: 22.0.0

Compare Source

Node.js 22.0.0

sindresorhus/p-queue (p-queue)

v9.1.0

Compare Source

• Add strict option for sliding window rate limiting 03b8156

---

v9.0.1

Compare Source

• Fix: Remove abort listener when operation completes (#​235) e9074f0

---

v9.0.0

Compare Source

Breaking

• Require Node.js 20 b2600d5
• Remove throwOnTimeout option - timeouts now always throw e48716f
  • It was a mistake to not throw on timeouts and the option made it complicated to handle types.
  • If you really need the old behavior back:

    const result = await queue.add(fn).catch(error => {
      if (error instanceof TimeoutError) {
      	return undefined;
      }
    
      throw error;
    });

Improvements

• Rename carryoverConcurrencyCount option to carryoverIntervalCount a6096de
  • The old name still works, but will be removed in the next major version.
• Add .onError() 7c27e1d
• Add .onPendingZero() (#​230) 62efb74
• Add pendingZero event (#​230) 62efb74
• Add .runningTasks fad8ee4
• Add .isSaturated fad8ee4
• Add .onRateLimit() 701453e
• Add .onRateLimitCleared() 701453e
• Add .isRateLimited 701453e
• Add rateLimit event 701453e
• Add rateLimitCleared event 701453e

Fixes

• Fix stack overflow with many aborted tasks 81cbae2
• Fix interval cap race condition with high concurrency 7fea658
• Fix interval timing when queue becomes empty between task additions 7b3f53e
• Fix priority default handling for undefined values 439d512

---

semantic-release/semantic-release (semantic-release)

v25.0.3

Compare Source

Bug Fixes

• deps: remove deprecated semver-diff (#​3980) (f404124)

v25.0.2

Compare Source

Bug Fixes

• deps: update dependency read-package-up to v12 (#​3935) (1494cb9)

v25.0.1

Compare Source

Bug Fixes

• deps: update to the latest version of the npm plugin to add trusted publishing support (fad173e), closes semantic-release/npm#958

v25.0.0

Compare Source

Bug Fixes

• deps: update dependency hosted-git-info to v9 (9fa04f8)
• deps: update dependency yargs to v18 (#​3745) (cde9a72)
• deps: update to the stable version of the github plugin (f12cf81)
• deps: update to the stable version of the release-notes-generator plugin (d9def72)
• deps: updated to the stable version of the commit-analyzer plugin (291533b)
• deps: upgrade to the new major version of the npm plugin, which upgrades npm to v11 for publishing (1be8290)

Features

• node-versions: drop support for node versions v20, v21, and v23 (56d16f4)
• node-versions: raise the minimum node version for the v24 range (116a188)

BREAKING CHANGES

• node-versions: the minimum node version for the v24 range is now v24.10.0
• node-versions: a minimum of node v22.14 is now required

expressjs/serve-static (serve-static)

v2.2.1

Compare Source

==================

• Minor changes (documentation, package metadata...)

v2.2.0

Compare Source

==================

• deps: send@^1.2.0

v2.1.0

Compare Source

===================

• Changes from 1.16.0
• deps: send@^1.2.0

v2.0.0

Compare Source

==================

• deps:
  • parseurl@^1.3.3
  • excape-html@^1.0.3
  • encodeurl@^2.0.0
  • supertest@^6.3.4
  • safe-buffer@^5.2.1
  • nyc@^17.0.0
  • mocha@^10.7.0
• Changes from 1.x

yargs/yargs (yargs)

v18.0.0

Compare Source

⚠ BREAKING CHANGES

• command names are not derived from modules passed to command.
• singleton usage of yargs yargs.foo, yargs().argv, has been removed.
• minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23.
• yargs is now ESM first

Features

• commandDir now works with ESM files (#​2461) (27eec18)
• locale: adds hebrew translation (#​2357) (4266485)
• yargs is now ESM first (d90af45)
• zsh: Add default completion as fallback (#​2331) (e02c91b)

Bug Fixes

• addDirectory do not support absolute command dir (#​2465) (3a40a78)
• allows ESM modules commands to be extensible using visit option (#​2468) (200e1aa)
• browser: fix shims so that yargs continues working in browser context (#​2457) (4ae5f57)
• build: address problems with typescript compilation (#​2445) (8d72fb3)
• coerce should play well with parser configuration (#​2308) (8343c66)
• deps: update dependency yargs-parser to v22 (#​2470) (639130d)
• exit after async handler done (#​2313) (e326cde)
• handle spaces in bash completion (#​2452) (83b7788)
• parser-configuration should work well with generated completion script (#​2332) (888db19)
• propagate Dictionary including undefined in value type (#​2393) (2b2f7f5)
• zsh: completion no longer requires double tab when using autoloaded (0dd8fe4)

Code Refactoring

• command names are not derived from modules passed to command. (d90af45)
• singleton usage of yargs yargs.foo, yargs().argv, has been removed. (d90af45)

Build System

• minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23. (d90af45)

---

Configuration

📅 Schedule: Branch creation - "after 2pm on Monday" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.