dependabot[bot] 963bb8159a Bump on-headers, compression, morgan and response-time (#7924)
Bumps [on-headers](https://github.com/jshttp/on-headers) to 1.1.0 and
updates ancestor dependencies
[on-headers](https://github.com/jshttp/on-headers),
[compression](https://github.com/expressjs/compression),
[morgan](https://github.com/expressjs/morgan) and
[response-time](https://github.com/expressjs/response-time). These
dependencies need to be updated together.

Updates `on-headers` from 1.0.2 to 1.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jshttp/on-headers/releases">on-headers's
releases</a>.</em></p>
<blockquote>
<h2>1.1.0</h2>
<h2>Important</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2025-7339">CVE-2025-7339</a>
(<a
href="https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q">GHSA-76c9-3jph-rj3q</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Migrate CI pipeline to GitHub actions by <a
href="https://github.com/carpasse"><code>@​carpasse</code></a> in <a
href="https://redirect.github.com/jshttp/on-headers/pull/12">jshttp/on-headers#12</a></li>
<li>fix README.md badges by <a
href="https://github.com/carpasse"><code>@​carpasse</code></a> in <a
href="https://redirect.github.com/jshttp/on-headers/pull/13">jshttp/on-headers#13</a></li>
<li>add OSSF scorecard action by <a
href="https://github.com/carpasse"><code>@​carpasse</code></a> in <a
href="https://redirect.github.com/jshttp/on-headers/pull/14">jshttp/on-headers#14</a></li>
<li>fix: use <code>ubuntu-latest</code> as ci runner by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/jshttp/on-headers/pull/19">jshttp/on-headers#19</a></li>
<li>ci: apply OSSF Scorecard security best practices by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/jshttp/on-headers/pull/20">jshttp/on-headers#20</a></li>
<li>👷 add upstream change detection by <a
href="https://github.com/ctcpip"><code>@​ctcpip</code></a> in <a
href="https://redirect.github.com/jshttp/on-headers/pull/31">jshttp/on-headers#31</a></li>
<li> add script to update known hashes by <a
href="https://github.com/ctcpip"><code>@​ctcpip</code></a> in <a
href="https://redirect.github.com/jshttp/on-headers/pull/32">jshttp/on-headers#32</a></li>
<li>💚 update CI - add newer node versions by <a
href="https://github.com/ctcpip"><code>@​ctcpip</code></a> in <a
href="https://redirect.github.com/jshttp/on-headers/pull/33">jshttp/on-headers#33</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/carpasse"><code>@​carpasse</code></a>
made their first contribution in <a
href="https://redirect.github.com/jshttp/on-headers/pull/12">jshttp/on-headers#12</a></li>
<li><a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
made their first contribution in <a
href="https://redirect.github.com/jshttp/on-headers/pull/19">jshttp/on-headers#19</a></li>
<li><a href="https://github.com/ctcpip"><code>@​ctcpip</code></a> made
their first contribution in <a
href="https://redirect.github.com/jshttp/on-headers/pull/31">jshttp/on-headers#31</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0">https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jshttp/on-headers/blob/master/HISTORY.md">on-headers's
changelog</a>.</em></p>
<blockquote>
<h1>1.1.0 / 2025-07-17</h1>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2025-7339">CVE-2025-7339</a>
(<a
href="https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q">GHSA-76c9-3jph-rj3q</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4b017af88f"><code>4b017af</code></a>
1.1.0</li>
<li><a
href="b636f2d08e"><code>b636f2d</code></a>
♻️ refactor header array code</li>
<li><a
href="3e2c2d46c3"><code>3e2c2d4</code></a>
 ignore falsy header keys, matching node behavior</li>
<li><a
href="172eb41b99"><code>172eb41</code></a>
 support duplicate headers</li>
<li><a
href="c6e384908c"><code>c6e3849</code></a>
🔒️ fix array handling</li>
<li><a
href="6893518341"><code>6893518</code></a>
💚 update CI - add newer node versions</li>
<li><a
href="56a345d82b"><code>56a345d</code></a>
 add script to update known hashes</li>
<li><a
href="175ab21715"><code>175ab21</code></a>
👷 add upstream change detection (<a
href="https://redirect.github.com/jshttp/on-headers/issues/31">#31</a>)</li>
<li><a
href="ce0b2c8fcd"><code>ce0b2c8</code></a>
ci: apply OSSF Scorecard security best practices (<a
href="https://redirect.github.com/jshttp/on-headers/issues/20">#20</a>)</li>
<li><a
href="1a38c543e7"><code>1a38c54</code></a>
fix: use <code>ubuntu-latest</code> as ci runner (<a
href="https://redirect.github.com/jshttp/on-headers/issues/19">#19</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~ulisesgascon">ulisesgascon</a>, a new
releaser for on-headers since your current version.</p>
</details>
<br />

Updates `compression` from 1.8.0 to 1.8.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/compression/releases">compression's
releases</a>.</em></p>
<blockquote>
<h2>v1.8.1</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(docs): update multiple links from http to https by <a
href="https://github.com/Phillip9587"><code>@​Phillip9587</code></a> in
<a
href="https://redirect.github.com/expressjs/compression/pull/222">expressjs/compression#222</a></li>
<li>ci: add dependabot for github actions by <a
href="https://github.com/bjohansebas"><code>@​bjohansebas</code></a> in
<a
href="https://redirect.github.com/expressjs/compression/pull/207">expressjs/compression#207</a></li>
<li>build(deps): bump github/codeql-action from 2.23.2 to 3.28.15 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/compression/pull/228">expressjs/compression#228</a></li>
<li>build(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/compression/pull/229">expressjs/compression#229</a></li>
<li>build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/compression/pull/230">expressjs/compression#230</a></li>
<li>build(deps-dev): bump supertest from 6.2.3 to 6.3.4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/compression/pull/231">expressjs/compression#231</a></li>
<li>[StepSecurity] ci: Harden GitHub Actions by <a
href="https://github.com/step-security-bot"><code>@​step-security-bot</code></a>
in <a
href="https://redirect.github.com/expressjs/compression/pull/235">expressjs/compression#235</a></li>
<li>build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/compression/pull/243">expressjs/compression#243</a></li>
<li>build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/compression/pull/239">expressjs/compression#239</a></li>
<li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/compression/pull/240">expressjs/compression#240</a></li>
<li>build(deps): bump actions/checkout from 4.1.1 to 4.2.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/compression/pull/241">expressjs/compression#241</a></li>
<li>build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/compression/pull/244">expressjs/compression#244</a></li>
<li>deps: on-headers@1.1.0 by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/compression/pull/246">expressjs/compression#246</a></li>
<li>Release: 1.8.1 by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/compression/pull/247">expressjs/compression#247</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
made their first contribution in <a
href="https://redirect.github.com/expressjs/compression/pull/228">expressjs/compression#228</a></li>
<li><a
href="https://github.com/step-security-bot"><code>@​step-security-bot</code></a>
made their first contribution in <a
href="https://redirect.github.com/expressjs/compression/pull/235">expressjs/compression#235</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/expressjs/compression/compare/1.8.0...v1.8.1">https://github.com/expressjs/compression/compare/1.8.0...v1.8.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/compression/blob/master/HISTORY.md">compression's
changelog</a>.</em></p>
<blockquote>
<h1>1.8.1 / 2025-07-17</h1>
<ul>
<li>deps: on-headers@~1.1.0
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2025-7339">CVE-2025-7339</a>
(<a
href="https://github.com/expressjs/on-headers/security/advisories/GHSA-76c9-3jph-rj3q">GHSA-76c9-3jph-rj3q</a>)</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="83a0c45fe1"><code>83a0c45</code></a>
1.8.1</li>
<li><a
href="ce62713129"><code>ce62713</code></a>
deps: on-headers@1.1.0 (<a
href="https://redirect.github.com/expressjs/compression/issues/246">#246</a>)</li>
<li><a
href="f4acb23985"><code>f4acb23</code></a>
build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (<a
href="https://redirect.github.com/expressjs/compression/issues/244">#244</a>)</li>
<li><a
href="6eaebe63f2"><code>6eaebe6</code></a>
build(deps): bump actions/checkout from 4.1.1 to 4.2.2 (<a
href="https://redirect.github.com/expressjs/compression/issues/241">#241</a>)</li>
<li><a
href="37e062312f"><code>37e0623</code></a>
build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 (<a
href="https://redirect.github.com/expressjs/compression/issues/240">#240</a>)</li>
<li><a
href="bc436b2628"><code>bc436b2</code></a>
build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (<a
href="https://redirect.github.com/expressjs/compression/issues/239">#239</a>)</li>
<li><a
href="2f9f572675"><code>2f9f572</code></a>
build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 (<a
href="https://redirect.github.com/expressjs/compression/issues/243">#243</a>)</li>
<li><a
href="5f13b148d2"><code>5f13b14</code></a>
[StepSecurity] ci: Harden GitHub Actions (<a
href="https://redirect.github.com/expressjs/compression/issues/235">#235</a>)</li>
<li><a
href="76e0945481"><code>76e0945</code></a>
build(deps-dev): bump supertest from 6.2.3 to 6.3.4 (<a
href="https://redirect.github.com/expressjs/compression/issues/231">#231</a>)</li>
<li><a
href="ae6ee809dc"><code>ae6ee80</code></a>
build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 (<a
href="https://redirect.github.com/expressjs/compression/issues/230">#230</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/expressjs/compression/compare/1.8.0...v1.8.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `morgan` from 1.10.0 to 1.10.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/morgan/releases">morgan's
releases</a>.</em></p>
<blockquote>
<h2>1.10.1</h2>
<h2>What's Changed</h2>
<ul>
<li>renaming simple to sample in readme by <a
href="https://github.com/ryhinchey"><code>@​ryhinchey</code></a> in <a
href="https://redirect.github.com/expressjs/morgan/pull/237">expressjs/morgan#237</a></li>
<li>adding installation instructions to readme by <a
href="https://github.com/ryhinchey"><code>@​ryhinchey</code></a> in <a
href="https://redirect.github.com/expressjs/morgan/pull/233">expressjs/morgan#233</a></li>
<li>chore: add support for OSSF scorecard reporting by <a
href="https://github.com/inigomarquinez"><code>@​inigomarquinez</code></a>
in <a
href="https://redirect.github.com/expressjs/morgan/pull/291">expressjs/morgan#291</a></li>
<li>ci: replace travis with github actions by <a
href="https://github.com/inigomarquinez"><code>@​inigomarquinez</code></a>
in <a
href="https://redirect.github.com/expressjs/morgan/pull/290">expressjs/morgan#290</a></li>
<li>docs: add example output for log formats by <a
href="https://github.com/jonchurch"><code>@​jonchurch</code></a> in <a
href="https://redirect.github.com/expressjs/morgan/pull/299">expressjs/morgan#299</a></li>
<li>ci: use ubuntu-latest by <a
href="https://github.com/bjohansebas"><code>@​bjohansebas</code></a> in
<a
href="https://redirect.github.com/expressjs/morgan/pull/301">expressjs/morgan#301</a></li>
<li>ci: apply OSSF Scorecard security best practices by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/morgan/pull/300">expressjs/morgan#300</a></li>
<li>remove --bail by <a
href="https://github.com/jonchurch"><code>@​jonchurch</code></a> in <a
href="https://redirect.github.com/expressjs/morgan/pull/314">expressjs/morgan#314</a></li>
<li>⬆️ bump on-headers by <a
href="https://github.com/ctcpip"><code>@​ctcpip</code></a> in <a
href="https://redirect.github.com/expressjs/morgan/pull/319">expressjs/morgan#319</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/inigomarquinez"><code>@​inigomarquinez</code></a>
made their first contribution in <a
href="https://redirect.github.com/expressjs/morgan/pull/291">expressjs/morgan#291</a></li>
<li><a href="https://github.com/jonchurch"><code>@​jonchurch</code></a>
made their first contribution in <a
href="https://redirect.github.com/expressjs/morgan/pull/299">expressjs/morgan#299</a></li>
<li><a
href="https://github.com/bjohansebas"><code>@​bjohansebas</code></a>
made their first contribution in <a
href="https://redirect.github.com/expressjs/morgan/pull/301">expressjs/morgan#301</a></li>
<li><a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
made their first contribution in <a
href="https://redirect.github.com/expressjs/morgan/pull/300">expressjs/morgan#300</a></li>
<li><a href="https://github.com/ctcpip"><code>@​ctcpip</code></a> made
their first contribution in <a
href="https://redirect.github.com/expressjs/morgan/pull/319">expressjs/morgan#319</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/expressjs/morgan/compare/1.10.0...1.10.1">https://github.com/expressjs/morgan/compare/1.10.0...1.10.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/morgan/blob/master/HISTORY.md">morgan's
changelog</a>.</em></p>
<blockquote>
<h1>1.10.1 / 2025-07-17</h1>
<ul>
<li>deps: on-headers@~1.1.0
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2025-7339">CVE-2025-7339</a>
(<a
href="https://github.com/expressjs/on-headers/security/advisories/GHSA-76c9-3jph-rj3q">GHSA-76c9-3jph-rj3q</a>)</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c1c7f107d2"><code>c1c7f10</code></a>
🔖 1.10.1</li>
<li><a
href="eb896c2421"><code>eb896c2</code></a>
⬆️ bump on-headers</li>
<li><a
href="1c3eec6ca5"><code>1c3eec6</code></a>
remove --bail (<a
href="https://redirect.github.com/expressjs/morgan/issues/314">#314</a>)</li>
<li><a
href="b144728e07"><code>b144728</code></a>
ci: apply OSSF Scorecard security best practices (<a
href="https://redirect.github.com/expressjs/morgan/issues/300">#300</a>)</li>
<li><a
href="68c2d2140d"><code>68c2d21</code></a>
ci: use ubuntu-latest (<a
href="https://redirect.github.com/expressjs/morgan/issues/301">#301</a>)</li>
<li><a
href="8740a194bf"><code>8740a19</code></a>
docs: add example output for log formats (<a
href="https://redirect.github.com/expressjs/morgan/issues/299">#299</a>)</li>
<li><a
href="efd6bff1ad"><code>efd6bff</code></a>
ci: migra to GitHub actions (<a
href="https://redirect.github.com/expressjs/morgan/issues/290">#290</a>)</li>
<li><a
href="3b89789447"><code>3b89789</code></a>
ci: add support for OSSF scorecard reporting (<a
href="https://redirect.github.com/expressjs/morgan/issues/291">#291</a>)</li>
<li><a
href="19a6aa5369"><code>19a6aa5</code></a>
docs: add installation section</li>
<li><a
href="b94f3ffe5c"><code>b94f3ff</code></a>
docs: change simple to sample in example descriptions</li>
<li>Additional commits viewable in <a
href="https://github.com/expressjs/morgan/compare/1.10.0...1.10.1">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~ulisesgascon">ulisesgascon</a>, a new
releaser for morgan since your current version.</p>
</details>
<br />

Updates `response-time` from 2.3.3 to 2.3.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/response-time/releases">response-time's
releases</a>.</em></p>
<blockquote>
<h2>v2.3.4</h2>
<h2>What's Changed</h2>
<ul>
<li>ci: add CodeQL (SAST) by <a
href="https://github.com/bjohansebas"><code>@​bjohansebas</code></a> in
<a
href="https://redirect.github.com/expressjs/response-time/pull/34">expressjs/response-time#34</a></li>
<li>ci: limit the scope to main branch by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/response-time/pull/33">expressjs/response-time#33</a></li>
<li>[StepSecurity] Apply security best practices by <a
href="https://github.com/step-security-bot"><code>@​step-security-bot</code></a>
in <a
href="https://redirect.github.com/expressjs/response-time/pull/37">expressjs/response-time#37</a></li>
<li>build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/response-time/pull/38">expressjs/response-time#38</a></li>
<li>build(deps-dev): bump eslint-plugin-import from 2.10.0 to 2.31.0 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/response-time/pull/40">expressjs/response-time#40</a></li>
<li>build(deps-dev): bump eslint-plugin-standard from 3.0.1 to 3.1.0 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/response-time/pull/41">expressjs/response-time#41</a></li>
<li>build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/response-time/pull/42">expressjs/response-time#42</a></li>
<li>build(deps): bump github/codeql-action from 3.27.0 to 3.28.18 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/response-time/pull/43">expressjs/response-time#43</a></li>
<li>build(deps-dev): bump eslint-plugin-promise from 3.7.0 to 3.8.0 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/response-time/pull/46">expressjs/response-time#46</a></li>
<li>build(deps-dev): bump eslint-plugin-markdown from 1.0.0-beta.6 to
1.0.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/response-time/pull/44">expressjs/response-time#44</a></li>
<li>build(deps-dev): bump mocha from 6.1.4 to 6.2.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/response-time/pull/45">expressjs/response-time#45</a></li>
<li>build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/response-time/pull/47">expressjs/response-time#47</a></li>
<li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/response-time/pull/48">expressjs/response-time#48</a></li>
<li>deps: on-headers@1.1.0 by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/response-time/pull/49">expressjs/response-time#49</a></li>
<li>🔖 v2.3.4 by <a
href="https://github.com/ctcpip"><code>@​ctcpip</code></a> in <a
href="https://redirect.github.com/expressjs/response-time/pull/50">expressjs/response-time#50</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/bjohansebas"><code>@​bjohansebas</code></a>
made their first contribution in <a
href="https://redirect.github.com/expressjs/response-time/pull/34">expressjs/response-time#34</a></li>
<li><a
href="https://github.com/step-security-bot"><code>@​step-security-bot</code></a>
made their first contribution in <a
href="https://redirect.github.com/expressjs/response-time/pull/37">expressjs/response-time#37</a></li>
<li><a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
made their first contribution in <a
href="https://redirect.github.com/expressjs/response-time/pull/38">expressjs/response-time#38</a></li>
<li><a href="https://github.com/ctcpip"><code>@​ctcpip</code></a> made
their first contribution in <a
href="https://redirect.github.com/expressjs/response-time/pull/50">expressjs/response-time#50</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/expressjs/response-time/compare/2.3.3...v2.3.4">https://github.com/expressjs/response-time/compare/2.3.3...v2.3.4</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/response-time/blob/master/HISTORY.md">response-time's
changelog</a>.</em></p>
<blockquote>
<h1>2.3.4 / 2025-07-17</h1>
<ul>
<li>deps: on-headers@~1.1.0
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2025-7339">CVE-2025-7339</a>
(<a
href="https://github.com/expressjs/on-headers/security/advisories/GHSA-76c9-3jph-rj3q">GHSA-76c9-3jph-rj3q</a>)</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="81090b8293"><code>81090b8</code></a>
🔖 v2.3.4 (<a
href="https://redirect.github.com/expressjs/response-time/issues/50">#50</a>)</li>
<li><a
href="c9c8566dd0"><code>c9c8566</code></a>
deps: on-headers@1.1.0 (<a
href="https://redirect.github.com/expressjs/response-time/issues/49">#49</a>)</li>
<li><a
href="fabc31f897"><code>fabc31f</code></a>
build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 (<a
href="https://redirect.github.com/expressjs/response-time/issues/48">#48</a>)</li>
<li><a
href="f53fa10286"><code>f53fa10</code></a>
build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (<a
href="https://redirect.github.com/expressjs/response-time/issues/47">#47</a>)</li>
<li><a
href="97138acd8e"><code>97138ac</code></a>
build(deps-dev): bump mocha from 6.1.4 to 6.2.3 (<a
href="https://redirect.github.com/expressjs/response-time/issues/45">#45</a>)</li>
<li><a
href="77d4e1d2a4"><code>77d4e1d</code></a>
build(deps-dev): bump eslint-plugin-markdown from 1.0.0-beta.6 to 1.0.2
(<a
href="https://redirect.github.com/expressjs/response-time/issues/44">#44</a>)</li>
<li><a
href="6679ce0300"><code>6679ce0</code></a>
build(deps-dev): bump eslint-plugin-promise from 3.7.0 to 3.8.0 (<a
href="https://redirect.github.com/expressjs/response-time/issues/46">#46</a>)</li>
<li><a
href="8af656205d"><code>8af6562</code></a>
build(deps): bump github/codeql-action from 3.27.0 to 3.28.18 (<a
href="https://redirect.github.com/expressjs/response-time/issues/43">#43</a>)</li>
<li><a
href="e648da6442"><code>e648da6</code></a>
build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.2 (<a
href="https://redirect.github.com/expressjs/response-time/issues/42">#42</a>)</li>
<li><a
href="4f8b029be6"><code>4f8b029</code></a>
build(deps-dev): bump eslint-plugin-standard from 3.0.1 to 3.1.0 (<a
href="https://redirect.github.com/expressjs/response-time/issues/41">#41</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/expressjs/response-time/compare/2.3.3...v2.3.4">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/compiler-explorer/compiler-explorer/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-23 00:51:26 +02:00
2025-06-18 09:04:23 -05:00
2025-04-24 12:10:37 -05:00
2025-06-19 08:46:57 -05:00
2025-07-21 11:34:04 -05:00
2023-04-17 23:13:43 +02:00
2025-05-12 08:31:59 -05:00
2025-06-18 14:21:25 +00:00
2022-05-09 23:13:50 -05:00
2025-05-30 09:26:45 -05:00
2025-06-18 09:04:23 -05:00
2022-05-09 23:13:50 -05:00
2024-03-08 22:25:09 -06:00
2024-02-04 13:33:19 -06:00

Build Status codecov

logo

Compiler Explorer

Compiler Explorer is an interactive compiler exploration website. Edit code in C, C++, C#, F#, Rust, Go, D, Haskell, Swift, Pascal, ispc, Python, Java, or any of the other 30+ supported languages, and see how that code looks after being compiled in real time.

Bug Report · Compiler Request · Feature Request · Language Request · Library Request · Report Vulnerability

Overview

Multiple compilers are supported for each language, many different tools and visualizations are available, and the UI layout is configurable (thanks to GoldenLayout).

Try out at godbolt.org, or run your own local instance. An overview of what the site lets you achieve, why it's useful, and how to use it is available here.

Compiler Explorer follows a Code of Conduct which aims to foster an open and welcoming environment.

Compiler Explorer was started in 2012 to show how C++ constructs are translated to assembly code. It started as a tmux session with vi running in one pane and watch gcc -S foo.cc -o - running in the other.

Since then, it has become a public website serving over 3,000,000 compilations per week.

You can financially support this project on Patreon, GitHub, Paypal, or by buying cool gear on the Compiler Explorer store.

Using Compiler Explorer

FAQ

There is now a FAQ section in the repository wiki. If your question is not present, please contact us as described below, so we can help you. If you find that the FAQ is lacking some important point, please feel free to contribute to it and/or ask us to clarify it.

Videos

Several videos showcase some features of Compiler Explorer:

A Road map is available which gives a little insight into the future plans for Compiler Explorer.

Developing

Compiler Explorer is written in TypeScript, on Node.js.

Assuming you have a compatible version of node installed, on Linux simply running make ought to get you up and running with an Explorer running on port 10240 on your local machine: http://localhost:10240/. If this doesn't work for you, please contact us, as we consider it important you can quickly and easily get running. Currently, Compiler Explorer requires node 20 or higher installed, either on the path or at NODE_DIR (an environment variable or make parameter).

Running with make EXTRA_ARGS='--language LANG' will allow you to load LANG exclusively, where LANG is one for the language ids/aliases defined in lib/languages.ts. For example, to only run Compiler Explorer with C++ support, you'd run make EXTRA_ARGS='--language c++'. You can supply multiple --language arguments to restrict to more than one language. The Makefile will automatically install all the third-party libraries needed to run; using npm to install server-side and client-side components.

For development, we suggest using make dev to enable some useful features, such as automatic reloading on file changes and shorter startup times.

You can also use npm run dev to run if make dev doesn't work on your machine.

When making UI changes, we recommend following the UI Testing Checklist to ensure all components work correctly.

Some languages need extra tools to demangle them, e.g. rust, d, or haskell. Such tools are kept separately in the tools repo.

Configuring compiler explorer is achieved via configuration files in the etc/config directory. Values are key=value. Options in a {type}.local.properties file (where {type} is c++ or similar) override anything in the {type}.defaults.properties file. There is a .gitignore file to ignore *.local.* files, so these won't be checked into git, and you won't find yourself fighting with updated versions when you git pull. For more information see Adding a Compiler.

Check CONTRIBUTING.md for detailed information about how you can contribute to Compiler Explorer, and the docs folder for specific details regarding various things you might want to do, such as how to add new compilers or languages to the site.

Running a local instance

If you want to point it at your own GCC or similar binaries, either edit the etc/config/LANG.defaults.properties or else make a new one with the name LANG.local.properties, substituting LANG as needed. *.local.properties files have the highest priority when loading properties.

If you want to support multiple compilers and languages like godbolt.org, you can use the bin/ce_install install compilers command in the infra project to install all or some of the compilers. Compilers installed in this way can be loaded through the configuration in etc/config/*.amazon.properties. If you need to deploy in a completely offline environment, you may need to remove some parts of the configuration that are pulled from www.godbolt.ms@443.

When running in a corporate setting the URL shortening service can be replaced by an internal one if the default storage driver isn't appropriate for your environment. To do this, add a new module in lib/shortener/myservice.js and set the urlShortenService variable in configuration. This module should export a single function, see the tinyurl module for an example.

RESTful API

There's a simple restful API that can be used to do compiles to asm and to list compilers.

You can find the API documentation here.

Contact us

We run a Compiler Explorer Discord, which is a place to discuss using or developing Compiler Explorer. We also have a presence on the cpplang Slack channel #compiler_explorer and we have a public mailing list.

There's a development channel on the discord, and also a development mailing list.

Feel free to raise an issue on github or email Matt directly for more help.

Official domains

Following are the official domains for Compiler Explorer:

The domains allow arbitrary subdomains, e.g., https://foo.godbolt.org/, which is convenient since each subdomain has an independent local state. Also, language subdomains such as https://rust.compiler-explorer.com/ will load with that language already selected.

Credits

Compiler Explorer is maintained by the awesome people listed in the AUTHORS file.

We would like to thank the contributors listed in the CONTRIBUTORS file, who have helped shape Compiler Explorer.

We would also like to especially thank these people for their contributions to Compiler Explorer:

Many amazing sponsors, both individuals and companies, have helped fund and promote Compiler Explorer.

Description
Run compilers interactively from your web browser and interact with the assembly
Readme BSD-2-Clause 118 MiB
Languages
TypeScript 88.3%
Python 6.8%
SCSS 2.1%
Pug 1.9%
JavaScript 0.2%
Other 0.4%