From 6dd57478ff054929ba8ffedc3f0b7ab5cc853981 Mon Sep 17 00:00:00 2001
From: szdziedzic <szymon@expo.dev>
Date: Mon, 6 Jul 2026 23:47:21 +0200
Subject: [PATCH 1/2] Bump Koa dependency

---
 packages/worker/package.json |  2 +-
 yarn.lock                    | 21 ++++++++++++++-------
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/packages/worker/package.json b/packages/worker/package.json
index 124424d545..e6254db6a3 100644
--- a/packages/worker/package.json
+++ b/packages/worker/package.json
@@ -36,7 +36,7 @@
     "fast-glob": "3.3.2",
     "filesize": "7.0.0",
     "fs-extra": "11.2.0",
-    "koa": "3.1.1",
+    "koa": "3.1.2",
     "koa-body": "7.0.1",
     "koa-router": "14.0.0",
     "lodash": "4.17.21",
diff --git a/yarn.lock b/yarn.lock
index 1324fbf043..34c0602e4b 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3590,7 +3590,7 @@ __metadata:
     filesize: "npm:7.0.0"
     fs-extra: "npm:11.2.0"
     jest: "npm:29.7.0"
-    koa: "npm:3.1.1"
+    koa: "npm:3.1.2"
     koa-body: "npm:7.0.1"
     koa-router: "npm:14.0.0"
     lodash: "npm:4.17.21"
@@ -10256,7 +10256,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"content-disposition@npm:0.5.4, content-disposition@npm:~0.5.4":
+"content-disposition@npm:0.5.4":
   version: 0.5.4
   resolution: "content-disposition@npm:0.5.4"
   dependencies:
@@ -10265,6 +10265,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"content-disposition@npm:~1.0.1":
+  version: 1.0.1
+  resolution: "content-disposition@npm:1.0.1"
+  checksum: 10c0/bd7ff1fe8d2542d3a2b9a29428cc3591f6ac27bb5595bba2c69664408a68f9538b14cbd92479796ea835b317a09a527c8c7209c4200381dedb0c34d3b658849e
+  languageName: node
+  linkType: hard
+
 "content-type@npm:^1.0.4, content-type@npm:^1.0.5, content-type@npm:~1.0.4, content-type@npm:~1.0.5":
   version: 1.0.5
   resolution: "content-type@npm:1.0.5"
@@ -15133,12 +15140,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"koa@npm:3.1.1":
-  version: 3.1.1
-  resolution: "koa@npm:3.1.1"
+"koa@npm:3.1.2":
+  version: 3.1.2
+  resolution: "koa@npm:3.1.2"
   dependencies:
     accepts: "npm:^1.3.8"
-    content-disposition: "npm:~0.5.4"
+    content-disposition: "npm:~1.0.1"
     content-type: "npm:^1.0.5"
     cookies: "npm:~0.9.1"
     delegates: "npm:^1.0.0"
@@ -15155,7 +15162,7 @@ __metadata:
     statuses: "npm:^2.0.1"
     type-is: "npm:^2.0.1"
     vary: "npm:^1.1.2"
-  checksum: 10c0/2329fa9b2352dbbed8b5073b3b0d5b71678357222c7b8bc4d29e3383fa31c3dc23c6648a3445efa0e6b01e44de0349f8ec2f43d70cd0d37ce7ba1ce50337be15
+  checksum: 10c0/d686eec15cd185106a67ff19c8e2cf6ccef8a8001340bb81fb5d6dd8c0f6418dbbbf2decbfa7bb3a5d00b7d59ac95bb4053ec90e5041c98ea6f972416d9de5be
   languageName: node
   linkType: hard
 

From e8015e4d45a3e1fa461f16c754766cd0fafd7bd8 Mon Sep 17 00:00:00 2001
From: szdziedzic <szymon@expo.dev>
Date: Mon, 6 Jul 2026 23:48:46 +0200
Subject: [PATCH 2/2] Add changelog entry for Koa bump

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd94fe7868..6d3bd9dad2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ This is the log of notable changes to EAS CLI and related packages.
 
 ### 🧹 Chores
 
+- [worker] Bump `koa` to `3.1.2`. ([#3974](https://github.com/expo/eas-cli/pull/3974) by [@szdziedzic](https://github.com/szdziedzic))
+
 ## [20.5.1](https://github.com/expo/eas-cli/releases/tag/v20.5.1) - 2026-07-01
 
 ### 🐛 Bug fixes