diff --git a/libraries/fetch-utils/package.json b/libraries/fetch-utils/package.json
index b742161209..9021bb0521 100644
--- a/libraries/fetch-utils/package.json
+++ b/libraries/fetch-utils/package.json
@@ -17,10 +17,10 @@
   "license": "AGPL-3.0-only",
   "devDependencies": {
     "@types/node-fetch": "^2.6.13",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "chai": "^4.3.6",
     "chai-as-promised": "^7.1.1",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "mocha": "^11.1.0",
     "mocha-junit-reporter": "^2.2.1",
     "mocha-multi-reporters": "^1.5.1",
diff --git a/package-lock.json b/package-lock.json
index 0533ef652b..a2669456f4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -248,10 +248,10 @@
       },
       "devDependencies": {
         "@types/node-fetch": "^2.6.13",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "chai": "^4.3.6",
         "chai-as-promised": "^7.1.1",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "mocha": "^11.1.0",
         "mocha-junit-reporter": "^2.2.1",
         "mocha-multi-reporters": "^1.5.1",
@@ -24781,22 +24781,23 @@
       "dev": true
     },
     "node_modules/body-parser": {
-      "version": "1.20.3",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.3.tgz",
-      "integrity": "sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==",
+      "version": "1.20.4",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.4.tgz",
+      "integrity": "sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==",
+      "license": "MIT",
       "dependencies": {
-        "bytes": "3.1.2",
+        "bytes": "~3.1.2",
         "content-type": "~1.0.5",
         "debug": "2.6.9",
         "depd": "2.0.0",
-        "destroy": "1.2.0",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "on-finished": "2.4.1",
-        "qs": "6.13.0",
-        "raw-body": "2.5.2",
+        "destroy": "~1.2.0",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "on-finished": "~2.4.1",
+        "qs": "~6.14.0",
+        "raw-body": "~2.5.3",
         "type-is": "~1.6.18",
-        "unpipe": "1.0.0"
+        "unpipe": "~1.0.0"
       },
       "engines": {
         "node": ">= 0.8",
@@ -24819,6 +24820,26 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/body-parser/node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/body-parser/node_modules/ms": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
@@ -24835,6 +24856,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/body-parser/node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/bonjour-service": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/bonjour-service/-/bonjour-service-1.3.0.tgz",
@@ -30797,39 +30827,39 @@
       }
     },
     "node_modules/express": {
-      "version": "4.21.2",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.21.2.tgz",
-      "integrity": "sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==",
+      "version": "4.22.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
+      "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.20.3",
-        "content-disposition": "0.5.4",
+        "body-parser": "~1.20.3",
+        "content-disposition": "~0.5.4",
         "content-type": "~1.0.4",
-        "cookie": "0.7.1",
-        "cookie-signature": "1.0.6",
+        "cookie": "~0.7.1",
+        "cookie-signature": "~1.0.6",
         "debug": "2.6.9",
         "depd": "2.0.0",
         "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "finalhandler": "1.3.1",
-        "fresh": "0.5.2",
-        "http-errors": "2.0.0",
+        "finalhandler": "~1.3.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.0",
         "merge-descriptors": "1.0.3",
         "methods": "~1.1.2",
-        "on-finished": "2.4.1",
+        "on-finished": "~2.4.1",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.12",
+        "path-to-regexp": "~0.1.12",
         "proxy-addr": "~2.0.7",
-        "qs": "6.13.0",
+        "qs": "~6.14.0",
         "range-parser": "~1.2.1",
         "safe-buffer": "5.2.1",
-        "send": "0.19.0",
-        "serve-static": "1.16.2",
+        "send": "~0.19.0",
+        "serve-static": "~1.16.2",
         "setprototypeof": "1.2.0",
-        "statuses": "2.0.1",
+        "statuses": "~2.0.1",
         "type-is": "~1.6.18",
         "utils-merge": "1.0.1",
         "vary": "~1.1.2"
@@ -44649,11 +44679,12 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.13.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
-      "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
+      "version": "6.14.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.1.tgz",
+      "integrity": "sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==",
+      "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.0.6"
+        "side-channel": "^1.1.0"
       },
       "engines": {
         "node": ">=0.6"
@@ -44768,19 +44799,58 @@
       "integrity": "sha512-dgH4T44TzKVO9CLArNto62hJOwlWJMLUjVVr/ii0uUzZXEXthDNr7/yefW5z/1vvHAfycc1tnuiYyNJ8CTRB3g=="
     },
     "node_modules/raw-body": {
-      "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz",
-      "integrity": "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==",
+      "version": "2.5.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
+      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
+      "license": "MIT",
       "dependencies": {
-        "bytes": "3.1.2",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "unpipe": "1.0.0"
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "unpipe": "~1.0.0"
       },
       "engines": {
         "node": ">= 0.8"
       }
     },
+    "node_modules/raw-body/node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/raw-body/node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/raw-body/node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/react": {
       "version": "18.3.1",
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
@@ -54180,14 +54250,14 @@
         "@isomorphic-git/lightning-fs": "^4.6.0",
         "@overleaf/promise-utils": "*",
         "@overleaf/validation-tools": "*",
-        "@testing-library/cypress": "^10.0.3",
+        "@testing-library/cypress": "10.0.3",
         "@types/adm-zip": "^0.5.7",
         "@types/uuid": "^9.0.8",
         "adm-zip": "^0.5.12",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "cypress": "13.13.2",
         "cypress-multi-reporters": "^2.0.5",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "isomorphic-git": "^1.33.1",
         "js-yaml": "^4.1.1",
         "mocha-junit-reporter": "^2.2.1",
@@ -54226,12 +54296,12 @@
         "@overleaf/stream-utils": "^0.1.0",
         "@overleaf/validation-tools": "*",
         "bluebird": "^3.7.2",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bull": "^3.18.0",
         "camelcase-keys": "^4.2.0",
         "csv": "^5.4.0",
         "east": "^2.0.3",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "json2csv": "^4.5.4",
         "lodash": "^4.17.21",
         "minimist": "^1.2.7",
@@ -54672,9 +54742,9 @@
         "@overleaf/mongo-utils": "*",
         "@overleaf/settings": "*",
         "async": "^3.2.5",
-        "body-parser": "^1.20.3",
-        "exegesis-express": "^4.0.0",
-        "express": "^4.21.2",
+        "body-parser": "1.20.4",
+        "exegesis-express": "4.0.0",
+        "express": "4.22.1",
         "mongodb": "6.12.0"
       },
       "devDependencies": {
@@ -54686,7 +54756,7 @@
         "mocha": "^11.1.0",
         "mocha-junit-reporter": "^2.2.1",
         "mocha-multi-reporters": "^1.5.1",
-        "request": "^2.88.2",
+        "request": "2.88.2",
         "sandboxed-module": "^2.0.4",
         "sinon": "^9.2.4",
         "timekeeper": "^2.2.0",
@@ -54705,10 +54775,10 @@
         "@overleaf/stream-utils": "*",
         "archiver": "5.3.2",
         "async": "^3.2.5",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
         "dockerode": "^4.0.9",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "lodash": "^4.17.21",
         "p-limit": "^3.1.0",
         "request": "^2.88.2",
@@ -54743,9 +54813,9 @@
         "@overleaf/settings": "*",
         "@overleaf/stream-utils": "*",
         "@overleaf/validation-tools": "*",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
-        "express": "^4.21.2",
+        "express": "^4.22.1",
         "p-limit": "^3.1.0",
         "tar-fs": "^3.1.1"
       },
@@ -54767,7 +54837,7 @@
         "@overleaf/settings": "*",
         "bunyan": "^1.8.15",
         "cookie": "^0.4.1",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "glob": "^12.0.0",
         "p-limit": "^3.1.0"
       },
@@ -54951,9 +55021,9 @@
         "@overleaf/mongo-utils": "*",
         "@overleaf/settings": "*",
         "async": "^3.2.5",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "mongodb": "6.12.0",
         "request": "^2.88.2",
         "underscore": "~1.13.1"
@@ -55024,10 +55094,10 @@
         "@overleaf/settings": "*",
         "@overleaf/stream-utils": "^0.1.0",
         "async": "^3.2.5",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
         "celebrate": "^15.0.3",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "lodash": "^4.17.21",
         "mongodb-legacy": "6.1.3",
         "p-map": "^4.0.0"
@@ -55487,11 +55557,11 @@
         "@overleaf/settings": "*",
         "@types/chai-as-promised": "^7.1.8",
         "async": "^3.2.5",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bull": "^3.18.0",
         "bunyan": "^1.8.15",
         "diff-match-patch": "overleaf/diff-match-patch#89805f9c671a77a263fc53461acd62aa7498f688",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "lodash": "^4.17.21",
         "minimist": "^1.2.8",
         "mongodb-legacy": "6.1.3",
@@ -55524,9 +55594,9 @@
         "@overleaf/object-persistor": "*",
         "@overleaf/settings": "*",
         "@overleaf/stream-utils": "^0.1.0",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "glob": "^12.0.0",
         "lodash.once": "^4.1.1",
         "node-fetch": "^2.7.0",
@@ -56098,7 +56168,7 @@
         "@overleaf/fetch-utils": "*",
         "@overleaf/logger": "*",
         "@overleaf/metrics": "*",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "is-valid-hostname": "^1.0.2",
         "tar-stream": "^2.2.0"
       },
@@ -56125,9 +56195,9 @@
         "@overleaf/settings": "*",
         "async": "^3.2.5",
         "base64-stream": "^0.1.2",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "lodash": "^4.17.21",
         "mongodb-legacy": "6.1.3",
         "nock": "^13.5.6",
@@ -56250,13 +56320,13 @@
         "archiver": "^5.3.0",
         "basic-auth": "^2.0.1",
         "bluebird": "^3.7.2",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bull": "^4.16.5",
         "bunyan": "^1.8.12",
         "check-types": "^11.1.2",
         "command-line-args": "^3.0.3",
         "config": "^3.3.12",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "fs-extra": "^9.0.1",
         "generic-pool": "^2.1.1",
         "helmet": "^3.22.0",
@@ -56515,7 +56585,7 @@
       "name": "@overleaf/idp",
       "dependencies": {
         "ejs": "^3.1.10",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "samlp": "^7.0.2"
       },
       "devDependencies": {
@@ -56541,7 +56611,7 @@
         "cookie-parser": "^1.4.6",
         "cross-env": "^7.0.3",
         "es6-promise": "^4.2.8",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "express-basic-auth": "^1.2.0",
         "express-flash": "0.0.2",
         "express-rate-limit": "^2.11.0",
@@ -57266,9 +57336,9 @@
         "@overleaf/settings": "*",
         "@overleaf/validation-tools": "*",
         "async": "^3.2.5",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "method-override": "^3.0.0",
         "mongodb-legacy": "6.1.3",
         "zod": "^4.1.7",
@@ -57683,12 +57753,12 @@
         "@overleaf/settings": "*",
         "@overleaf/stream-utils": "*",
         "async": "^3.2.5",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
         "celebrate": "^15.0.3",
         "diff-match-patch": "overleaf/diff-match-patch#89805f9c671a77a263fc53461acd62aa7498f688",
         "esmock": "^2.6.3",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "lodash": "^4.17.20",
         "minimist": "^1.2.8",
         "mongodb-legacy": "6.1.3",
@@ -57761,11 +57831,11 @@
         "@overleaf/validation-tools": "*",
         "async": "^3.2.5",
         "base64id": "0.1.0",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
         "connect-redis": "^6.1.3",
         "cookie-parser": "^1.4.6",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "express-session": "^1.17.1",
         "lodash": "^4.17.21",
         "proxy-addr": "^2.0.7",
@@ -58738,7 +58808,7 @@
         "@overleaf/settings": "*",
         "async": "^3.2.5",
         "bunyan": "^1.8.15",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "ioredis": "^4.16.1",
         "lodash": "^4.17.19"
       },
@@ -58773,9 +58843,9 @@
         "@overleaf/settings": "*",
         "args-js": "0.10.12",
         "async": "^3.2.5",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "install": "^0.13.0",
         "lodash": "^4.17.21",
         "marked": "^4.1.0",
@@ -58806,10 +58876,10 @@
         "@overleaf/o-error": "*",
         "@overleaf/settings": "*",
         "async": "^3.2.5",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
         "dropbox": "^10.34.0",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "lodash": "^4.17.21",
         "lru-cache": "^4.1.5",
         "minimatch": "^7.4.2",
@@ -58933,9 +59003,9 @@
         "@overleaf/promise-utils": "*",
         "@overleaf/settings": "*",
         "async": "^3.2.5",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
-        "express": "^4.21.0",
+        "express": "4.22.1",
         "lodash": "^4.17.21",
         "lru-cache": "^5.1.1",
         "mongodb-legacy": "6.1.3",
@@ -59005,10 +59075,10 @@
         "@overleaf/o-error": "*",
         "@overleaf/redis-wrapper": "*",
         "@overleaf/settings": "*",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bunyan": "^1.8.15",
         "dtrace-provider": "^0.8.8",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "express-basic-auth": "^1.2.0",
         "ioredis": "^4.16.0",
         "lodash": "^4.17.15",
@@ -59018,7 +59088,7 @@
       "devDependencies": {
         "chai": "^4.3.6",
         "chai-as-promised": "^7.1.1",
-        "chai-http": "^4.4.0",
+        "chai-http": "4.4.0",
         "mocha": "^11.1.0",
         "mocha-junit-reporter": "^2.2.1",
         "mocha-multi-reporters": "^1.5.1",
@@ -59064,7 +59134,7 @@
         "base-x": "^4.0.1",
         "basic-auth": "^2.0.1",
         "bcrypt": "^5.0.0",
-        "body-parser": "^1.20.3",
+        "body-parser": "1.20.4",
         "bowser": "^2.11.0",
         "bull": "^3.18.0",
         "bunyan": "^1.8.15",
@@ -59081,7 +59151,7 @@
         "ejs": "^3.1.10",
         "email-addresses": "^5.0.0",
         "eventsource-parser": "^1.1.2",
-        "express": "^4.21.2",
+        "express": "4.22.1",
         "express-bearer-token": "^2.4.0",
         "express-http-proxy": "^1.6.0",
         "express-session": "^1.17.1",
diff --git a/package.json b/package.json
index 923e7ea0b4..34cc41bdc0 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,8 @@
   "overrides": {
     "request@2.88.2": {
       "tough-cookie": "5.1.2",
-      "form-data": "2.5.5"
+      "form-data": "2.5.5",
+      "qs": "6.14.1"
     },
     "streamdown": {
       "mermaid": "file:./services/web/stubs/mermaid-stub"
diff --git a/patches/body-parser+1.20.3.patch b/patches/body-parser+1.20.4.patch
similarity index 100%
rename from patches/body-parser+1.20.3.patch
rename to patches/body-parser+1.20.4.patch
diff --git a/server-ce/test/package.json b/server-ce/test/package.json
index 657f318462..e0610cbb2e 100644
--- a/server-ce/test/package.json
+++ b/server-ce/test/package.json
@@ -13,16 +13,16 @@
   },
   "devDependencies": {
     "@isomorphic-git/lightning-fs": "^4.6.0",
-    "@overleaf/validation-tools": "*",
     "@overleaf/promise-utils": "*",
-    "@testing-library/cypress": "^10.0.3",
+    "@overleaf/validation-tools": "*",
+    "@testing-library/cypress": "10.0.3",
     "@types/adm-zip": "^0.5.7",
     "@types/uuid": "^9.0.8",
     "adm-zip": "^0.5.12",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "cypress": "13.13.2",
     "cypress-multi-reporters": "^2.0.5",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "isomorphic-git": "^1.33.1",
     "js-yaml": "^4.1.1",
     "mocha-junit-reporter": "^2.2.1",
diff --git a/services/chat/package.json b/services/chat/package.json
index 0bdfa3e4c8..3817311e6a 100644
--- a/services/chat/package.json
+++ b/services/chat/package.json
@@ -23,9 +23,9 @@
     "@overleaf/mongo-utils": "*",
     "@overleaf/settings": "*",
     "async": "^3.2.5",
-    "body-parser": "^1.20.3",
-    "exegesis-express": "^4.0.0",
-    "express": "^4.21.2",
+    "body-parser": "1.20.4",
+    "exegesis-express": "4.0.0",
+    "express": "4.22.1",
     "mongodb": "6.12.0"
   },
   "devDependencies": {
@@ -37,7 +37,7 @@
     "mocha": "^11.1.0",
     "mocha-junit-reporter": "^2.2.1",
     "mocha-multi-reporters": "^1.5.1",
-    "request": "^2.88.2",
+    "request": "2.88.2",
     "sandboxed-module": "^2.0.4",
     "sinon": "^9.2.4",
     "timekeeper": "^2.2.0",
diff --git a/services/clsi/package.json b/services/clsi/package.json
index fb30e2b4e7..6a6418df17 100644
--- a/services/clsi/package.json
+++ b/services/clsi/package.json
@@ -26,10 +26,10 @@
     "@overleaf/stream-utils": "*",
     "archiver": "5.3.2",
     "async": "^3.2.5",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "bunyan": "^1.8.15",
     "dockerode": "^4.0.9",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "lodash": "^4.17.21",
     "p-limit": "^3.1.0",
     "request": "^2.88.2",
diff --git a/services/contacts/package.json b/services/contacts/package.json
index ed894f5391..ffcbf5c649 100644
--- a/services/contacts/package.json
+++ b/services/contacts/package.json
@@ -23,9 +23,9 @@
     "@overleaf/mongo-utils": "*",
     "@overleaf/settings": "*",
     "async": "^3.2.5",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "bunyan": "^1.8.15",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "mongodb": "6.12.0",
     "request": "^2.88.2",
     "underscore": "~1.13.1"
diff --git a/services/docstore/package.json b/services/docstore/package.json
index e111d719da..e672eb5951 100644
--- a/services/docstore/package.json
+++ b/services/docstore/package.json
@@ -28,10 +28,10 @@
     "@overleaf/settings": "*",
     "@overleaf/stream-utils": "^0.1.0",
     "async": "^3.2.5",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "bunyan": "^1.8.15",
     "celebrate": "^15.0.3",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "lodash": "^4.17.21",
     "mongodb-legacy": "6.1.3",
     "p-map": "^4.0.0"
diff --git a/services/document-updater/package.json b/services/document-updater/package.json
index 6ebfe0d8e8..13f6ebb2fd 100644
--- a/services/document-updater/package.json
+++ b/services/document-updater/package.json
@@ -29,11 +29,11 @@
     "@overleaf/settings": "*",
     "@types/chai-as-promised": "^7.1.8",
     "async": "^3.2.5",
-    "body-parser": "^1.20.3",
-    "bunyan": "^1.8.15",
+    "body-parser": "1.20.4",
     "bull": "^3.18.0",
+    "bunyan": "^1.8.15",
     "diff-match-patch": "overleaf/diff-match-patch#89805f9c671a77a263fc53461acd62aa7498f688",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "lodash": "^4.17.21",
     "minimist": "^1.2.8",
     "mongodb-legacy": "6.1.3",
diff --git a/services/filestore/package.json b/services/filestore/package.json
index a255a67514..0f7f444e40 100644
--- a/services/filestore/package.json
+++ b/services/filestore/package.json
@@ -27,9 +27,9 @@
     "@overleaf/object-persistor": "*",
     "@overleaf/settings": "*",
     "@overleaf/stream-utils": "^0.1.0",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "bunyan": "^1.8.15",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "glob": "^12.0.0",
     "lodash.once": "^4.1.1",
     "node-fetch": "^2.7.0",
diff --git a/services/history-v1/package.json b/services/history-v1/package.json
index d9ba77c2a5..b93fed28bd 100644
--- a/services/history-v1/package.json
+++ b/services/history-v1/package.json
@@ -21,13 +21,13 @@
     "archiver": "^5.3.0",
     "basic-auth": "^2.0.1",
     "bluebird": "^3.7.2",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "bull": "^4.16.5",
     "bunyan": "^1.8.12",
     "check-types": "^11.1.2",
     "command-line-args": "^3.0.3",
     "config": "^3.3.12",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "fs-extra": "^9.0.1",
     "generic-pool": "^2.1.1",
     "helmet": "^3.22.0",
diff --git a/services/notifications/package.json b/services/notifications/package.json
index 1e56a4d00c..c1720a394b 100644
--- a/services/notifications/package.json
+++ b/services/notifications/package.json
@@ -29,9 +29,9 @@
     "@overleaf/promise-utils": "*",
     "@overleaf/validation-tools": "*",
     "async": "^3.2.5",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "bunyan": "^1.8.15",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "method-override": "^3.0.0",
     "mongodb-legacy": "6.1.3",
     "zod": "^4.1.7",
diff --git a/services/project-history/package.json b/services/project-history/package.json
index 8163799e75..85b613766d 100644
--- a/services/project-history/package.json
+++ b/services/project-history/package.json
@@ -28,12 +28,12 @@
     "@overleaf/settings": "*",
     "@overleaf/stream-utils": "*",
     "async": "^3.2.5",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "bunyan": "^1.8.15",
     "celebrate": "^15.0.3",
     "diff-match-patch": "overleaf/diff-match-patch#89805f9c671a77a263fc53461acd62aa7498f688",
     "esmock": "^2.6.3",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "lodash": "^4.17.20",
     "minimist": "^1.2.8",
     "mongodb-legacy": "6.1.3",
diff --git a/services/real-time/package.json b/services/real-time/package.json
index f1bbfa5fc7..4acc573bf5 100644
--- a/services/real-time/package.json
+++ b/services/real-time/package.json
@@ -26,11 +26,11 @@
     "@overleaf/validation-tools": "*",
     "async": "^3.2.5",
     "base64id": "0.1.0",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "bunyan": "^1.8.15",
     "connect-redis": "^6.1.3",
     "cookie-parser": "^1.4.6",
-    "express": "^4.21.2",
+    "express": "4.22.1",
     "express-session": "^1.17.1",
     "lodash": "^4.17.21",
     "proxy-addr": "^2.0.7",
diff --git a/services/web/package.json b/services/web/package.json
index cdcd777625..73fe6a32c0 100644
--- a/services/web/package.json
+++ b/services/web/package.json
@@ -116,7 +116,7 @@
     "base-x": "^4.0.1",
     "basic-auth": "^2.0.1",
     "bcrypt": "^5.0.0",
-    "body-parser": "^1.20.3",
+    "body-parser": "1.20.4",
     "bowser": "^2.11.0",
     "bull": "^3.18.0",
     "bunyan": "^1.8.15",
@@ -133,10 +133,10 @@
     "ejs": "^3.1.10",
     "email-addresses": "^5.0.0",
     "eventsource-parser": "^1.1.2",
-    "express": "^4.21.2",
     "express-bearer-token": "^2.4.0",
     "express-http-proxy": "^1.6.0",
     "express-session": "^1.17.1",
+    "express": "4.22.1",
     "file-type": "^21.0.0",
     "focus-trap-react": "^11.0.4",
     "globby": "^5.0.0",