deps(server)(deps): bump the security-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the security-dependencies group with 3 updates in the /server directory: express-rate-limit, express-validator and sanitize-html.

Updates express-rate-limit from 8.3.0 to 8.5.2

Release notes

Sourced from express-rate-limit's releases.

v8.5.2

You can view the changelog here.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

v8.4.1

You can view the changelog here.

v8.4.0

You can view the changelog here.

v8.3.2

You can view the changelog here.

v8.3.1

You can view the changelog here.

Commits

• 9774693 8.5.2
• 0e94cc0 v8.5.2 changelog
• 9a583c5 feat: simplify IPv6 key generation (#633)
• 4f4b3fb chore(deps-dev): bump lint-staged from 16.4.0 to 17.0.4 (#632)
• 3c1d6c5 chore(deps-dev): bump the development-dependencies group with 7 updates (#631)
• 18884b6 chore(deps): bump basic-ftp from 5.2.0 to 5.3.1 (#630)
• dacc980 chore(deps): bump handlebars from 4.7.8 to 4.7.9 (#629)
• 486d0c6 chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#627)
• 50cc3f6 8.5.1
• 92c8e3e chore: bump ip-address library to latest (#626)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.

Updates express-validator from 7.3.1 to 7.3.2

Release notes

Sourced from express-validator's releases.

v7.3.2

What's Changed

• bump lodash to 4.17.23 to fix CVE-2025-13465 by @​mahmoodhamdi in express-validator/express-validator#1355

Plus several docs changes.

New Contributors

• @​mahmoodhamdi made their first contribution in express-validator/express-validator#1357

Full Changelog: express-validator/express-validator@v7.3.1...v7.3.2

Commits

• 7d06bc3 7.3.2
• 73fb78b ci: bump node version used across several action jobs
• 8a6c2d6 deps: upgrade docusaurus and friends
• 2db1d81 deps: further bump lodash to v4.18.1
• 0b1dbe3 docs: fix incorrect type references in oneOf and validation-result docs (#1358)
• 0386b00 docs: fix duplicate variable declaration in matchedData example (#1359)
• 97fde88 fix(deps): bump lodash to 4.17.23 to fix CVE-2025-13465 (#1355)
• 6c2df4d docs: fix incorrect checkSchema().run() example (#1357)
• See full diff in compare view

Updates sanitize-html from 2.17.2 to 2.17.4

Changelog

Sourced from sanitize-html's changelog.

2.17.4

Changes

• sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

• Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

• Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

Commits

• See full diff in compare view

[dependabot]

Assignees

The following users could not be added as assignees: fernandocarvalho. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: backend, dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.