Repository navigation
build(deps): bump the npm-production group across 1 directory with 18 updates - #236
Merged
Merged
Conversation
… updates Bumps the npm-production group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@opentelemetry/exporter-metrics-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.222.0` | `0.223.0` | | [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` | | [fastify](https://github.com/fastify/fastify) | `5.12.5` | `5.12.7` | | [@hono/node-server](https://github.com/honojs/node-server) | `2.1.3` | `2.1.5` | | [hono](https://github.com/honojs/hono) | `4.13.12` | `4.13.13` | | [@vue/server-renderer](https://github.com/vuejs/core/tree/HEAD/packages/server-renderer) | `3.5.43` | `3.5.44` | | [vue](https://github.com/vuejs/core) | `3.5.43` | `3.5.44` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `12.1.2` | `12.1.3` | | [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `12.1.2` | `12.1.3` | | [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express) | `12.1.2` | `12.1.3` | | [@nestjs/platform-fastify](https://github.com/nestjs/nest/tree/HEAD/packages/platform-fastify) | `12.1.2` | `12.1.3` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.3` | `5.0.5` | | [tsdown](https://github.com/rolldown/tsdown) | `0.23.0` | `0.23.1` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.2` | `8.3.4` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.0.5` | Updates `@opentelemetry/exporter-metrics-otlp-http` from 0.222.0 to 0.223.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.222.0...experimental/v0.223.0) Updates `express` from 5.2.1 to 5.3.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v5.2.1...v5.3.0) Updates `fastify` from 5.12.5 to 5.12.7 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.12.5...v5.12.7) Updates `@hono/node-server` from 2.1.3 to 2.1.5 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.1.3...v2.1.5) Updates `hono` from 4.13.12 to 4.13.13 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.12...v4.13.13) Updates `@vue/server-renderer` from 3.5.43 to 3.5.44 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](https://github.com/vuejs/core/commits/v3.5.44/packages/server-renderer) Updates `vue` from 3.5.43 to 3.5.44 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.5.43...v3.5.44) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `@nestjs/common` from 12.1.2 to 12.1.3 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/common) Updates `@nestjs/core` from 12.1.2 to 12.1.3 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/core) Updates `@nestjs/platform-express` from 12.1.2 to 12.1.3 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/platform-express) Updates `@nestjs/platform-fastify` from 12.1.2 to 12.1.3 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/platform-fastify) Updates `@types/node` from 26.6.4 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitest/coverage-v8` from 5.0.3 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/coverage-v8) Updates `tsdown` from 0.23.0 to 0.23.1 - [Release notes](https://github.com/rolldown/tsdown/releases) - [Commits](rolldown/tsdown@v0.23.0...v0.23.1) Updates `vite` from 8.3.2 to 8.3.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite) Updates `vitest` from 5.0.3 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) --- updated-dependencies: - dependency-name: "@opentelemetry/exporter-metrics-otlp-http" dependency-version: 0.223.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: express dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: fastify dependency-version: 5.12.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@hono/node-server" dependency-version: 2.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: hono dependency-version: 4.13.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@vue/server-renderer" dependency-version: 3.5.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: vue dependency-version: 3.5.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@nestjs/common" dependency-version: 12.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@nestjs/core" dependency-version: 12.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@nestjs/platform-express" dependency-version: 12.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@nestjs/platform-fastify" dependency-version: 12.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@vitest/coverage-v8" dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: tsdown dependency-version: 0.23.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: vite dependency-version: 8.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production ... Signed-off-by: dependabot[bot] <support@github.com>
Goopil
added a commit
that referenced
this pull request
Oct 24, 2026
Clear the remaining pnpm audit findings (1 critical, 5 high, 4 low) left after merging the dependabot groups #236 and #237. Every affected path lives in examples, benchmarks or root devDependencies — no published package is affected. Range-scoped pnpm overrides lift shell-quote, launch-editor, follow-redirects, fastify, ip-address, body-parser and multer above their vulnerable ranges, following the existing overrides pattern. Also bumps turbo, @vitejs/plugin-react and @vitejs/plugin-vue, covering the superseded dependabot PR #235.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm-production group with 18 updates in the / directory:
0.222.00.223.05.2.15.3.05.12.55.12.72.1.32.1.54.13.124.13.133.5.433.5.443.5.433.5.4419.3.019.3.119.3.019.3.112.1.212.1.312.1.212.1.312.1.212.1.312.1.212.1.326.6.426.6.55.0.35.0.50.23.00.23.18.3.28.3.45.0.35.0.5Updates
@opentelemetry/exporter-metrics-otlp-httpfrom 0.222.0 to 0.223.0Release notes
Sourced from @opentelemetry/exporter-metrics-otlp-http's releases.
Commits
92b844echore: prepare next v2.x release (#7151)a859afffix(web-common): export getElementXPath utility (#7124)2bd5a73chore(web-common)!: deprecateaddSpanNetworkEvents()et al instrumentation-...d60f05edoc(sdk-trace): add description for StackContextManager (#7089)5bd476echore: move context manager to sdk-trace (#7086)554c0c6chore: move sdk-trace-web utils to web-common (#7058)788922cci: support maintenance branch releases (#7036)Updates
expressfrom 5.2.1 to 5.3.0Release notes
Sourced from express's releases.
... (truncated)
Changelog
Sourced from express's changelog.
... (truncated)
Commits
cf6722b5.3.0 (#7468)8c2fcfcdocs: fix typos and a stale API reference in lib comments (#7512)9efc29edocs: fix pass-through typos (#7509)2717ae3build(deps): bump the github-actions group with 3 updates (#7499)de77771build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)9169cbedocs: add missing apostrophe in example (#7483)7ef9844build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)3b7e39fdeps: bump qs minimum to 6.16.0 (#7478)98bd4cddeps: proxy-addr@^2.0.8 (#7474)9a34acffix(res.send): preserve ETag generation with Transfer-Encoding (#7459)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.
Updates
fastifyfrom 5.12.5 to 5.12.7Release notes
Sourced from fastify's releases.
Commits
9f40003Bumped v5.12.716469b9Bumped v5.12.663496de[Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 (#7094)20b55d4[Backport 5.x] fix: remove error when HTTP QUERY request has empty body (#7060)38d2b63[Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of...3241fbd[Backport 5.x] fix(validation): lowercase header names in propertyNames enum/...1a46b1b[Backport 5.x] perf: use a FIFO cache for parsed content-types (#7072)7e06676[Backport 5.x] fix: resolve reply.mediaType from raw response headers (#7067)1b0eb32[Backport 5.x] perf: avoid resetting the level of request child loggers (#7058)a636a10[Backport 5.x] perf: decode string bodies once instead of per chunk (#7053)Updates
@hono/node-serverfrom 2.1.3 to 2.1.5Release notes
Sourced from @hono/node-server's releases.
Commits
4b47a0d2.1.5e77824afix(serve-static): only serve GET and HEAD requests (#405)1b6e6bffix(listener): abort the request signal when an HTTP/2 client resets the stre...d57ed9b2.1.492b014cchore: allow hono v5 as a peer dependency (#406)Updates
honofrom 4.13.12 to 4.13.13Release notes
Sourced from hono's releases.
Commits
08a023c4.13.13ae595defeat(mount): introduce Mount Middleware and deprecateapp.mount(#5221)f23b146fix(jsx): allow JSXNode function component results (#5476)6d73a74docs(request): fix jsdoc comments for some getters (#5445)deff529test(client): simulate network error for undefined route in parseResponse tes...Updates
@vue/server-rendererfrom 3.5.43 to 3.5.44Release notes
Sourced from @vue/server-renderer's releases.
Changelog
Sourced from @vue/server-renderer's changelog.
Commits
bf5f0ddrelease: v3.5.446930374fix(server-renderer): propagate async setup errors (#15857)c11c5c8fix(ssr): honor falsy vnode content overrides (#15769)ad19e7dfix(runtime-core): render nothing for an invalid v-for range in production (#...a084e44fix(runtime-dom): treat playsinline as a boolean attribute (#15627)Updates
vuefrom 3.5.43 to 3.5.44Release notes
Sourced from vue's releases.
Changelog
Sourced from vue's changelog.
Commits
bf5f0ddrelease: v3.5.446930374fix(server-renderer): propagate async setup errors (#15857)8e8c547chore(deps): update all non-major dependencies (#15585)4cb0ca8chore(deps): update playground (#15685)e38478fchore(deps): update dawidd6/action-download-artifact action to v27 (#15768)1caed5achore(deps): update compiler (#15586)a49f451chore(deps): update lint (#15680)219b858chore(deps): update build (#15679)ff35014fix(transition): handle comment-wrapped component roots (#15853)d084b90fix(compiler-core): parenthesise v-for key in v-memo cache guard (#15724)Updates
reactfrom 19.3.0 to 19.3.1Release notes
Sourced from react's releases.
Commits
61aa00d[19.3.x][Flight] Improve transport protocol (#37845)Updates
react-domfrom 19.3.0 to 19.3.1Release notes
Sourced from react-dom's releases.
Commits
61aa00d[19.3.x][Flight] Improve transport protocol (#37845)Updates
@nestjs/commonfrom 12.1.2 to 12.1.3Release notes
Sourced from @nestjs/common's releases.