chore(deps): bump the backend-minor-patch group in /backend with 9 updates by dependabot[bot] · Pull Request #989 · FinChippay/Finchippay-Solution

dependabot · 2026-08-31T09:49:31Z

Bumps the backend-minor-patch group in /backend with 9 updates:

Package	From	To
@opentelemetry/auto-instrumentations-node	`0.78.0`	`0.79.0`
@opentelemetry/sdk-node	`0.220.0`	`0.221.0`
@sentry/node	`10.69.0`	`10.71.0`
axios	`1.18.0`	`1.20.0`
morgan	`1.11.0`	`1.12.0`
nodemailer	`9.0.5`	`9.0.6`
pg	`8.22.0`	`8.23.0`
jest	`30.3.0`	`30.5.0`
nock	`14.0.15`	`14.0.17`

Updates @opentelemetry/auto-instrumentations-node from 0.78.0 to 0.79.0

Release notes

Sourced from @opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.79.0

0.79.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

Bug Fixes

auto-instrumentations-node: avoid duplicate diag logger warning in register.js (#3601) (3ae8a1b)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.75.0 to ^0.76.0

@opentelemetry/instrumentation-bunyan bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-connect bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-cucumber bumped from ^0.36.0 to ^0.37.0

@opentelemetry/instrumentation-dataloader bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-dns bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-express bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-fs bumped from ^0.39.0 to ^0.40.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-graphql bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-hapi bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.3.0 to ^0.4.0

@opentelemetry/instrumentation-ioredis bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.29.0 to ^0.30.0

@opentelemetry/instrumentation-knex bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-koa bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-memcached bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-mongodb bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-mongoose bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-net bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-openai bumped from ^0.18.0 to ^0.19.0

@opentelemetry/instrumentation-oracledb bumped from ^0.45.0 to ^0.46.0

@opentelemetry/instrumentation-pg bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-pino bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-redis bumped from ^0.68.0 to ^0.69.0

... (truncated)

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.79.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

Bug Fixes

auto-instrumentations-node: avoid duplicate diag logger warning in register.js (#3601) (3ae8a1b)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.75.0 to ^0.76.0

@opentelemetry/instrumentation-bunyan bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-connect bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-cucumber bumped from ^0.36.0 to ^0.37.0

@opentelemetry/instrumentation-dataloader bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-dns bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-express bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-fs bumped from ^0.39.0 to ^0.40.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-graphql bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-hapi bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.3.0 to ^0.4.0

@opentelemetry/instrumentation-ioredis bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.29.0 to ^0.30.0

@opentelemetry/instrumentation-knex bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-koa bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-memcached bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-mongodb bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-mongoose bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-net bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-openai bumped from ^0.18.0 to ^0.19.0

@opentelemetry/instrumentation-oracledb bumped from ^0.45.0 to ^0.46.0

@opentelemetry/instrumentation-pg bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-pino bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-redis bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-restify bumped from ^0.65.0 to ^0.66.0

... (truncated)

Commits

27e172a chore: release main (#3596)
466d5de feat(deps): update deps matching '@opentelemetry/*' (#3629)
b7efd7b chore(*): migrate to sdk-trace (#3599)
3ae8a1b fix(auto-instrumentations-node): avoid duplicate diag logger warning in regis...
See full diff in compare view

Updates @opentelemetry/sdk-node from 0.220.0 to 0.221.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @pichlermarc

feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @raphael-theriault-swi

Commits

76fa6b5 chore: prepare next release (#6942)
3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
f6d8fbe chore(deps): lock file maintenance (#6559)
9612732 chore: remove examples/dice from workspaces (#6937)
7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
b9f57c6 chore(deps): update dependency @types/webpack-env to v1.18.8 (#6877)
cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
Additional commits viewable in compare view

Updates @sentry/node from 10.69.0 to 10.71.0

Release notes

Sourced from @sentry/node's releases.

10.71.0

Important Changes

feat(v10/core)!: Enable logs by default (#23311)

The enableLogs client option now defaults to true, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call the Sentry.logger.* APIs or add a log-forwarding integration (such as consoleLoggingIntegration, pinoIntegration, or the winston transport), and you can set enableLogs: false to opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.

Other Changes

feat(v10/core): Deprecate scope.clear() method (#23231)

fix(v10/core): Bound child span tracking on long-lived spans (#23406)

fix(v10/core): Read Supabase PostgREST headers from Headers instances (#23241)

fix(v10/hono): Use captureException from scope, not from Client (#23280)

fix(v10/nuxt): Delete source maps after Nitro finishes building (#23508)

fix(v10/react-router): Carry multi-byte UTF-8 across SSR stream chunk boundaries (#23421)

fix(v10/react): Match TanStack Router pageload against the router location (#23494)

test(v10/nextjs): Add e2e app for a user-owned OpenTelemetry setup (#23278)

Bundle size 📦

Path Size

@sentry/browser 27.1 KB

@sentry/browser - with treeshaking flags 25.58 KB

@sentry/browser (incl. Tracing) 45.51 KB

@sentry/browser (incl. Tracing + Span Streaming) 47.25 KB

@sentry/browser (incl. Tracing, Profiling) 50.15 KB

@sentry/browser (incl. Tracing, Replay) 83.83 KB

@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.71 KB

@sentry/browser (incl. Tracing, Replay with Canvas) 88.45 KB

@sentry/browser (incl. Tracing, Replay, Feedback) 100.79 KB

@sentry/browser (incl. Feedback) 43.87 KB

@sentry/browser (incl. sendFeedback) 31.78 KB

@sentry/browser (incl. FeedbackAsync) 36.79 KB

@sentry/browser (incl. Metrics) 28.16 KB

@sentry/browser (incl. Logs) 28.38 KB

@sentry/browser (incl. Metrics & Logs) 29.06 KB

@sentry/react 28.86 KB

@sentry/react (incl. Tracing) 47.72 KB

@sentry/vue 32.4 KB

@sentry/vue (incl. Tracing) 47.43 KB

@sentry/svelte 27.12 KB

CDN Bundle 29.43 KB

CDN Bundle (incl. Tracing) 47.43 KB

... (truncated)

Changelog

Sourced from @sentry/node's changelog.

10.71.0

Important Changes

feat(v10/core)!: Enable logs by default (#23311)

The enableLogs client option now defaults to true, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call the Sentry.logger.* APIs or add a log-forwarding integration (such as consoleLoggingIntegration, pinoIntegration, or the winston transport), and you can set enableLogs: false to opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.

Other Changes

feat(v10/core): Deprecate scope.clear() method (#23231)

fix(v10/core): Bound child span tracking on long-lived spans (#23406)

fix(v10/core): Read Supabase PostgREST headers from Headers instances (#23241)

fix(v10/hono): Use captureException from scope, not from Client (#23280)

fix(v10/nuxt): Delete source maps after Nitro finishes building (#23508)

fix(v10/react-router): Carry multi-byte UTF-8 across SSR stream chunk boundaries (#23421)

fix(v10/react): Match TanStack Router pageload against the router location (#23494)

test(v10/nextjs): Add e2e app for a user-owned OpenTelemetry setup (#23278)

10.70.0

feat(v10/core): Support stable MCP SDK v2 (#22986)

feat(v10/deps): Bump @sentry/node-cpu-profiler to 2.4.3 (#22992)

feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)

fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23189)

fix(v10/cloudflare): Get original waituntil in workflows (#23192)

fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy (#23190)

fix(v10/cloudflare): Set agent conversation id on the onRequest path (#22985)

fix(v10/cloudflare): Set conversation id independent of session name (#23193)

fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)

fix(v10/cloudflare): Use gen_ai.agent.name for class names (#22987)

fix(v10/core,browser): Handle errors from other realms (#23201)

fix(v10/core): Sample errors after beforeSend while preserving session updates (#22819)

fix(v10/hono): Include originalException in captured exception hint (#22990)

fix(v10/nextjs): meriyah issue for standalone build (#23055)

fix(v10/nextjs): Remove tracing from middleware wrappers (#22904)

fix(v10/profiling-node): Respect profileSessionSampleRate in trace profile lifecycle (#22940)

fix(v10/react-router): Preserve sourcemaps.disable when unstable_sentryVitePluginOptions is set (#22966)

fix(v10/react): Remove routes from shared set on <Routes> unmount (#22948)

fix(v10/sveltekit): Export metrics from worker entry point (#23027)

... (truncated)

Commits

9fcb063 release: 10.71.0
fbc14d8 meta(changelog): Update changelog for 10.71.0 (#23517)
671f4b1 fix(v10/nuxt): Delete source maps after Nitro finishes building (#23508)
0211227 fix(v10/react): Match TanStack Router pageload against the router location (#...
bbea828 feat(v10/core)!: Enable logs by default (#23311)
7ded310 fix(v10/core): Bound child span tracking on long-lived spans (#23406)
245d807 fix(v10/react-router): Carry multi-byte UTF-8 across SSR stream chunk boundar...
1d439a3 fix(v10/core): Read Supabase PostgREST headers from Headers instances (#23241)
8f03efe test(v10/nextjs): Add e2e app for a user-owned OpenTelemetry setup (#23278)
c884ae1 fix(v10/hono): Use captureException from scope, not from Client (#23280)
Additional commits viewable in compare view

Updates axios from 1.18.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

... (truncated)

Commits

84a9f3b chore(release): prepare release 1.20.0 (#11152)
e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
d19040b fix: harden runtime option handling (#11141)
e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
ba98559 docs: add ScrapingBee sponsor (#11137)
Additional commits viewable in compare view

Updates morgan from 1.11.0 to 1.12.0

Release notes

Sourced from morgan's releases.

1.12.0

What's Changed

fix: upgrade http:// to https:// in README by @hanu-14 in expressjs/morgan#363

build: bump github actions and dev dependencies by @sheplu in expressjs/morgan#369

chore(ci): npm-publish via reusable workflows by @sheplu in expressjs/morgan#334

docs: add ES modules import example by @aladi-debug in expressjs/morgan#352

docs: fix README lint errors by @UlisesGascon in expressjs/morgan#373

ci: use latest patch per Node.js major, add 23-26 by @UlisesGascon in expressjs/morgan#374

feat: pass objects through to streams in objectMode by @UlisesGascon in expressjs/morgan#375

feat: NO_COLOR env var removes color in dev format by @jonchurch in expressjs/morgan#377

New Contributors

@hanu-14 made their first contribution in expressjs/morgan#363

@sheplu made their first contribution in expressjs/morgan#369

@aladi-debug made their first contribution in expressjs/morgan#352

Full Changelog: expressjs/morgan@1.11.0...1.12.0

Changelog

Sourced from morgan's changelog.

1.12.0

Security fix for CVE-2026-15603(GHSA-jxfw-x594-9x9m)

Allow format functions to return objects for streams in objectMode

Respect the NO_COLOR environment variable in the dev format

Commits

063f084 1.12.0 (#376)
fbf9383 fix: escape all token values in log output
0338399 feat: NO_COLOR env var removes color in dev format (#377)
51007f9 feat: pass objects through to streams in objectMode (#375)
4790f5d ci: use latest patch per Node.js major, add 23-26 (#374)
786c66d docs: fix README lint errors (#373)
98d848c docs: add ES modules import example (#352)
fb9a228 chore(ci): npm-publish via reusable workflows (#334)
4729fe8 build: bump github actions and dev dependencies (#369)
bd171d7 docs: update link (#363)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for morgan since your current version.

Updates nodemailer from 9.0.5 to 9.0.6

Release notes

Sourced from nodemailer's releases.

v9.0.6

9.0.6 (2026-08-27)

Bug Fixes

addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)

harden copies of user supplied keys and URL fetching (2f667f4)

Changelog

Sourced from nodemailer's changelog.

9.0.6 (2026-08-27)

Bug Fixes

addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)

harden copies of user supplied keys and URL fetching (2f667f4)

Commits

4e467a8 chore(master): release 9.0.6 (#1844)
e989a22 fix(addressparser): recover the addr-spec from an angle-addr holding whitespace
7237b91 chore(deps): update dev dependencies
34bc3d8 docs: reframe the EmailEngine README mentions
2f667f4 fix: harden copies of user supplied keys and URL fetching
See full diff in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

Add support for query pipelineing.

Commits

df274d1 Publish
eb19d0f Add opt-in query pipelining (#3652)
See full diff in compare view

Updates jest from 30.3.0 to 30.5.0

Release notes

Sourced from jest's releases.

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴

This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @timkindberg (#16053):
const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
fn.whenCalledWith('banana').mockReturnValue('yellow');
fn.whenCalledWith(expect.any(Number)).mockReturnValue('numeric');
fn('apple'); // 'red'
fn('banana'); // 'yellow'
fn(42); // 'numeric'
fn('grape'); // undefined
The returned object is a real Mock, so mockReturnValueOnce, mockResolvedValue, mockImplementation etc. all chain here too. Argument slots accept literals or any asymmetric matcher, with the same equality semantics as toHaveBeenCalledWith(). Calls that match nothing fall through to the base mock. See the Mock Functions docs for matching and precedence details.

Describe-level retries

jest.retryTimes() can now retry a whole describe block instead of a single test, contributed by @soltonigiri (#16322). Each attempt reruns the block's beforeAll/afterAll hooks, child tests and nested describes, which helps when tests in a block depend on shared state:
describe('workflow', () => {
  jest.retryTimes(3, {entireDescribe: true});
test('first step', () => {});
test('second step', () => {}); // a failure retries the entire block
});
New file watcher

The non-watchman path of jest-haste-map is rewritten. @parcel/watcher replaces the homegrown NodeWatcher and FSEventsWatcher (#16188), and fdir replaces the hand-rolled directory recursion in the crawler (#16187). A batch of fixes also makes watching and indexing survive locked files on Windows, watchman failures, and duplicate manual mocks (#16295, #16358, #16355, #16360).

If you can, please run your suite with --no-watchman (in and out of watch mode) to exercise the new crawler and watchers, and report anything odd 👍

Long-requested dependency updates

babel-plugin-istanbul is updated to v8 (#16049)

glob is updated to v13 (#16397)

... (truncated)

Changelog

Sourced from jest's changelog.

30.5.0

Features

[@jest/expect-utils, jest-mock] Add mockFn.whenCalledWith(...args) for configuring return values per argument list, with first-class asymmetric-matcher support (#16053)

[@jest/expect-utils] Export AsymmetricMatcher and FunctionParameters types (previously private to expect) (#16053)

[jest-circus, jest-core, jest-jasmine2, jest-test-result, jest-types] --collectTests now expands test.each/describe.each cases and reports per-status counts (skipped/todo via the new wouldRun flag for selected tests) plus a summary line that match a real run, including under --testNamePattern and .only/fdescribe focus on both the circus and jasmine2 runners (#16259)

[jest-circus, jest-environment, jest-runtime, jest-types] Add describe-level retries via jest.retryTimes(..., {entireDescribe: true}) (#16322)

[jest-circus, jest-message-util, jest-reporters, jest-types] Add retryMessages to AssertionResult and export formatErrorStack, so the retry log renders nested cause and AggregateError sections with code frames instead of serialize...
Description has been truncated

Bumps the backend-minor-patch group in /backend with 9 updates: | Package | From | To | | --- | --- | --- | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.78.0` | `0.79.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.221.0` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.69.0` | `10.71.0` | | [axios](https://github.com/axios/axios) | `1.18.0` | `1.20.0` | | [morgan](https://github.com/expressjs/morgan) | `1.11.0` | `1.12.0` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.0.6` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.3.0` | `30.5.0` | | [nock](https://github.com/nock/nock) | `14.0.15` | `14.0.17` | Updates `@opentelemetry/auto-instrumentations-node` from 0.78.0 to 0.79.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.79.0/packages/auto-instrumentations-node) Updates `@opentelemetry/sdk-node` from 0.220.0 to 0.221.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.221.0) Updates `@sentry/node` from 10.69.0 to 10.71.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.71.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.69.0...10.71.0) Updates `axios` from 1.18.0 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.18.0...v1.20.0) Updates `morgan` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.11.0...1.12.0) Updates `nodemailer` from 9.0.5 to 9.0.6 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v9.0.5...v9.0.6) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) Updates `jest` from 30.3.0 to 30.5.0 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.0/packages/jest) Updates `nock` from 14.0.15 to 14.0.17 - [Release notes](https://github.com/nock/nock/releases) - [Changelog](https://github.com/nock/nock/blob/main/CHANGELOG.md) - [Commits](nock/nock@v14.0.15...v14.0.17) --- updated-dependencies: - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.79.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.221.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: "@sentry/node" dependency-version: 10.71.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: morgan dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: nodemailer dependency-version: 9.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-minor-patch - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: jest dependency-version: 30.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: nock dependency-version: 14.0.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: backend-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-31T09:49:32Z

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-08-31T10:05:15Z

🤖 Greptile AI Code Review

Greptile will automatically review this PR (3 file(s) changed).

Review gates:

✅ CodeQL Security Scan
✅ Custom rules (.greptile/config.json)
✅ Architecture guidelines (.greptile/rules.md)

To manually trigger a re-review, comment @greptileai on this PR.
To skip review, add the skip-review label.

dependabot Bot added backend Express backend issues dependencies dependencies security Security-related issues labels Aug 31, 2026

github-actions Bot added the needs-review PR ready for Greptile AI code review label Aug 31, 2026

Navigation Menu

Uh oh!

chore(deps): bump the backend-minor-patch group in /backend with 9 updates - #989

chore(deps): bump the backend-minor-patch group in /backend with 9 updates#989
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-minor-patch-18223f7919

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Path	Size
`@sentry/browser`	27.1 KB
`@sentry/browser` - with treeshaking flags	25.58 KB
`@sentry/browser` (incl. Tracing)	45.51 KB
`@sentry/browser` (incl. Tracing + Span Streaming)	47.25 KB
`@sentry/browser` (incl. Tracing, Profiling)	50.15 KB
`@sentry/browser` (incl. Tracing, Replay)	83.83 KB
`@sentry/browser` (incl. Tracing, Replay) - with treeshaking flags	73.71 KB
`@sentry/browser` (incl. Tracing, Replay with Canvas)	88.45 KB
`@sentry/browser` (incl. Tracing, Replay, Feedback)	100.79 KB
`@sentry/browser` (incl. Feedback)	43.87 KB
`@sentry/browser` (incl. sendFeedback)	31.78 KB
`@sentry/browser` (incl. FeedbackAsync)	36.79 KB
`@sentry/browser` (incl. Metrics)	28.16 KB
`@sentry/browser` (incl. Logs)	28.38 KB
`@sentry/browser` (incl. Metrics & Logs)	29.06 KB
`@sentry/react`	28.86 KB
`@sentry/react` (incl. Tracing)	47.72 KB
`@sentry/vue`	32.4 KB
`@sentry/vue` (incl. Tracing)	47.43 KB
`@sentry/svelte`	27.12 KB
CDN Bundle	29.43 KB
CDN Bundle (incl. Tracing)	47.43 KB

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026

auto-instrumentations-node: v0.79.0

0.79.0 (2026-07-23)

Features

Bug Fixes

Dependencies

0.79.0 (2026-07-23)

Features

Bug Fixes

Dependencies

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

10.71.0

Important Changes

Other Changes

Bundle size 📦

10.71.0

Important Changes

Other Changes

10.70.0

v1.20.0 — August 19, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.19.0 - July 22, 2026

🔒 Security Fixes

Changelog

v1.19.0 — July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

1.12.0

What's Changed

New Contributors

1.12.0

v9.0.6

9.0.6 (2026-08-27)

Bug Fixes

9.0.6 (2026-08-27)

Bug Fixes

pg@8.23.0

v30.5.0

Highlights

whenCalledWith

Describe-level retries

New file watcher

Long-requested dependency updates

30.5.0

Features

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Labels

Uh oh!

github-actions Bot commented Aug 31, 2026

🤖 Greptile AI Code Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`whenCalledWith`