Bump morgan from 1.11.0 to 1.12.0

[dependabot]

Bumps morgan from 1.11.0 to 1.12.0.

Release notes

Sourced from morgan's releases.

1.12.0

What's Changed

• fix: upgrade http:// to https:// in README by @​hanu-14 in expressjs/morgan#363
• build: bump github actions and dev dependencies by @​sheplu in expressjs/morgan#369
• chore(ci): npm-publish via reusable workflows by @​sheplu in expressjs/morgan#334
• docs: add ES modules import example by @​aladi-debug in expressjs/morgan#352
• docs: fix README lint errors by @​UlisesGascon in expressjs/morgan#373
• ci: use latest patch per Node.js major, add 23-26 by @​UlisesGascon in expressjs/morgan#374
• feat: pass objects through to streams in objectMode by @​UlisesGascon in expressjs/morgan#375
• feat: NO_COLOR env var removes color in dev format by @​jonchurch in expressjs/morgan#377

New Contributors

• @​hanu-14 made their first contribution in expressjs/morgan#363
• @​sheplu made their first contribution in expressjs/morgan#369
• @​aladi-debug made their first contribution in expressjs/morgan#352

Full Changelog: expressjs/morgan@1.11.0...1.12.0

Changelog

Sourced from morgan's changelog.

1.12.0

• Security fix for CVE-2026-15603(GHSA-jxfw-x594-9x9m)
• Allow format functions to return objects for streams in objectMode
• Respect the NO_COLOR environment variable in the dev format

Commits

• 063f084 1.12.0 (#376)
• fbf9383 fix: escape all token values in log output
• 0338399 feat: NO_COLOR env var removes color in dev format (#377)
• 51007f9 feat: pass objects through to streams in objectMode (#375)
• 4790f5d ci: use latest patch per Node.js major, add 23-26 (#374)
• 786c66d docs: fix README lint errors (#373)
• 98d848c docs: add ES modules import example (#352)
• fb9a228 chore(ci): npm-publish via reusable workflows (#334)
• 4729fe8 build: bump github actions and dev dependencies (#369)
• bd171d7 docs: update link (#363)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for morgan since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Akanksha Jain (jainakanksha-msft)]

Copilot This PR was opened by Dependabot. Please take it the rest of the way before it's ready for human review:

1. Impact analysis — review the PR diff/description to identify what changed, including the package name and old → new version, then check where that dependency is actually used in the codebase, or whether it is unused, and summarize the potential impact.
2. Fix build/conflict issues — run npm ci --legacy-peer-deps, npm run build, and npm run lint; resolve any merge conflicts, build errors, or lint errors that surface.
3. Tests — add or update tests under tests/** to cover the changed usage, and make sure they meaningfully validate the change (not just re-assert the version bump).
4. Run the suite — run the relevant npm run test:* script(s) for the affected area (e.g. test:blob, test:queue, test:table) and keep fixing until they pass.
5. Changelog — append one bullet to ChangeLog.md under ## Upcoming Release → General:, matching the existing style and tone of the entries already there (package name in backticks, old → new version, why, and a one-line concise summary of any code changes made).
6. Comments — review any existing PR comments and review threads, including resolved/hidden ones, and address anything actionable.
7. Self-rate — rate this work 1-10 against: correctness, test coverage, changelog accuracy, build/lint health, and comment resolution.
8. Iterate — if it's not a 10, keep improving until it is before finishing.
9. Summary — your final response must use the following structure exactly (no free-form paragraph summary).

Impact analysis

• Package:
• Old version:
• New version:
• Change Impact:

Build/Conflict Issues

• Commands:
• Result:

Tests

• Added:
• Updated:
• Result:

Run the Suite

• Commands:
• Status:

Changelog

• Entry:
• Location:

Comments

• Reviewed:
• Actions:

Self-Rate

• Score:
• Reasoning:

Summary

• Why this matters:
• Risk of not taking change:

[Copilot]

Copilot This PR was opened by Dependabot. Please take it the rest of the way before it's ready for human review:

1. Impact analysis — review the PR diff/description to identify what changed, i...

Completed in 51c92d9.

• Impact: morgan 1.11.0 → 1.12.0 (lockfile only; package.json already allows ^1.11.0). Azurite uses morgan("common", { stream: accessLogWriteStream }) in BlobRequestListenerFactory, QueueRequestListenerFactory and TableRequestListenerFactory, so the fix for CVE-2026-15603 (log forging via unescaped U+0085/U+2028/U+2029 in log tokens) applies directly to Azurite access logs. No source changes required.
• Build/lint: npm ci --legacy-peer-deps, npm run build, npm run lint all clean; no merge conflicts.
• Tests: added tests/common/accessLog.test.ts (3 cases: single log line per request, Unicode line-separator escaping, ASCII control-character escaping). Verified the Unicode case fails against morgan 1.11.0 and passes on 1.12.0.
• Suites: npm run test:blob (568 passing), npm run test:queue (87 passing), npm run test:table (453 passing), plus tests/common.
• Changelog: bullet appended under ## Upcoming Release → General:.

[Copilot]

🟢 Approval recommended

The change is limited to a lockfile security update plus targeted regression tests and a changelog entry, with no production code modifications.

1. Impact analysis

   • Package: morgan
   • Version change: 1.11.0 → 1.12.0 (lockfile-resolved)
   • Usage: Access logging via morgan("common", { stream: this.accessLogWriteStream }) in Blob/Queue/Table request listener factories
   • Impact and risk: Applies upstream escaping fixes for token values to mitigate log forging; risk is limited to access-log output formatting changes for affected characters.

2. Build and conflict resolution

   • Commands run: - None
   • Issues found: - None
   • Result: - Not run in this review environment

3. Tests

   • Tests added or updated: - tests/common/accessLog.test.ts
   • Coverage: - Adds regression coverage for escaped access-log token values (Unicode line separators and ASCII control chars)
   • Result: - Not run in this review environment

4. Test suite

   • Commands run: - None
   • Passing: - None
   • Pending or failing: - Not run in this review environment

5. Changelog

   • Entry added: - Yes
   • Location: - ChangeLog.md → ## Upcoming Release → General

6. PR comments

   • Threads reviewed: - None
   • Actions taken: - None
   • Unresolved items: - None

7. Self-rating

   • Score: - 8/10
   • Reasoning: - Straightforward dependency security update with clear regression tests; limited residual risk due to upstream behavior changes affecting log output.

8. Iteration

   • Improvements made after self-review:
     • None

9. Summary

   • Why the update matters: - Addresses CVE-2026-15603 by ensuring access-log token values are safely escaped, preventing log record forgery.
   • Risk if not applied: - Potential for attacker-controlled values (e.g., Unicode line separators) to forge additional access log lines in downstream log parsers.
   • Final status: - Ready to approve

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Akanksha Jain (jainakanksha-msft)]

Copilot do we really need that test file?
We are just asserting the logging. That must be done at the morgan side no?
We are not testing any functionality. Can you justify the test file please

[Copilot]

Copilot do we really need that test file?
We are just asserting the logging. That must be done at the morgan side no?
We are not testing any functionality. Can you justify the test file please

You're right — I removed it in c137756.

The test spun up its own Express app with morgan("common", ...) and asserted the escaping of token values. That escaping is entirely morgan's implementation and is already covered by morgan's own test suite; Azurite contributes no logic there (we just pass a format string and a write stream). So the test was effectively re-testing an upstream library and would only ever break on a dependency change, adding maintenance cost without validating any Azurite behavior.

The PR is now lockfile-only plus the ChangeLog entry, which I also updated to drop the mention of the removed test coverage.

[Copilot]

🟡 Changes recommended

The CVE remediation is currently lockfile-only while package.json still declares morgan as ^1.11.0, which can allow downstream installs/consumer lockfiles to remain on 1.11.x and makes the changelog note potentially misleading.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

[Akanksha Jain (jainakanksha-msft)]

Copilot could you please validate this comment and take necessary action

[Copilot]

Validated and applied. I updated the declared dependency from morgan: ^1.11.0 to ^1.12.0 in package.json (and aligned package-lock.json), then updated the changelog entry to reflect that this is not lockfile-only. Addressed in commit e5dde12.

[Copilot]

🟢 Approval recommended

The PR is a straightforward dependency + lockfile update with an accurate changelog entry and no code-path changes in Azurite itself.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite