Skip to content

build(deps): bump the npm-production group across 1 directory with 18 updates - #236

Merged
Goopil merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-d919d69333
Oct 24, 2026
Merged

Goopil merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-d919d69333

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the npm-production group with 18 updates in the / directory:

Package From To
@opentelemetry/exporter-metrics-otlp-http 0.222.0 0.223.0
express 5.2.1 5.3.0
fastify 5.12.5 5.12.7
@hono/node-server 2.1.3 2.1.5
hono 4.13.12 4.13.13
@vue/server-renderer 3.5.43 3.5.44
vue 3.5.43 3.5.44
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
@nestjs/common 12.1.2 12.1.3
@nestjs/core 12.1.2 12.1.3
@nestjs/platform-express 12.1.2 12.1.3
@nestjs/platform-fastify 12.1.2 12.1.3
@types/node 26.6.4 26.6.5
@vitest/coverage-v8 5.0.3 5.0.5
tsdown 0.23.0 0.23.1
vite 8.3.2 8.3.4
vitest 5.0.3 5.0.5

Updates @opentelemetry/exporter-metrics-otlp-http from 0.222.0 to 0.223.0

Release notes

Sourced from @​opentelemetry/exporter-metrics-otlp-http's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

  • chore(web-common)!: clean up and deprecate network span utils #7114
    • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
    • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

  • refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.
Commits
  • 92b844e chore: prepare next v2.x release (#7151)
  • a859aff fix(web-common): export getElementXPath utility (#7124)
  • 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
  • d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
  • 5bd476e chore: move context manager to sdk-trace (#7086)
  • 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
  • 788922c ci: support maintenance branch releases (#7036)
  • See full diff in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
    app.query('/reports', (req, res) => {
      res.set('ETag', '"12345"');
      res.send(results); // now responds 304 Not Modified
    });
  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected
  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
    // -> Content-Type: text/plain; foo=bar; charset=utf-8
  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
    // before -> Content-Disposition: attachment; filename="user.html"
    // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
    app.query('/reports', (req, res) => {
      res.set('ETag', '"12345"');
      res.send(results); // now responds 304 Not Modified
    });
  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected
  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
    // -> Content-Type: text/plain; foo=bar; charset=utf-8
  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
    // before -> Content-Disposition: attachment; filename="user.html"
    // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates fastify from 5.12.5 to 5.12.7

Release notes

Sourced from fastify's releases.

v5.12.7

Full Changelog: fastify/fastify@v5.12.6...v5.12.7

v5.12.6

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

Commits
  • 9f40003 Bumped v5.12.7
  • 16469b9 Bumped v5.12.6
  • 63496de [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 (#7094)
  • 20b55d4 [Backport 5.x] fix: remove error when HTTP QUERY request has empty body (#7060)
  • 38d2b63 [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of...
  • 3241fbd [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/...
  • 1a46b1b [Backport 5.x] perf: use a FIFO cache for parsed content-types (#7072)
  • 7e06676 [Backport 5.x] fix: resolve reply.mediaType from raw response headers (#7067)
  • 1b0eb32 [Backport 5.x] perf: avoid resetting the level of request child loggers (#7058)
  • a636a10 [Backport 5.x] perf: decode string bodies once instead of per chunk (#7053)
  • Additional commits viewable in compare view

Updates @hono/node-server from 2.1.3 to 2.1.5

Release notes

Sourced from @​hono/node-server's releases.

v2.1.5

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

What's Changed

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

Commits

Updates hono from 4.13.12 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
  • docs(request): fix jsdoc comments for some getters in honojs/hono#5445
  • fix(jsx): allow JSXNode function component results in honojs/hono#5476
  • feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

Commits
  • 08a023c 4.13.13
  • ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
  • f23b146 fix(jsx): allow JSXNode function component results (#5476)
  • 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
  • deff529 test(client): simulate network error for undefined route in parseResponse tes...
  • See full diff in compare view

Updates @vue/server-renderer from 3.5.43 to 3.5.44

Release notes

Sourced from @​vue/server-renderer's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from @​vue/server-renderer's changelog.

3.5.44 (2026-10-13)

Bug Fixes

  • compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
  • compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
  • compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
  • compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
  • compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
  • custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
  • hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
  • KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
  • reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
  • reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
  • reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
  • reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
  • runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
  • runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
  • runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
  • runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
  • runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
  • runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
  • server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
  • ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
  • suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
  • suspense: skip rendering async components unmounted while pending (4ab865a)
  • teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
  • transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
  • transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500
Commits
  • bf5f0dd release: v3.5.44
  • 6930374 fix(server-renderer): propagate async setup errors (#15857)
  • c11c5c8 fix(ssr): honor falsy vnode content overrides (#15769)
  • ad19e7d fix(runtime-core): render nothing for an invalid v-for range in production (#...
  • a084e44 fix(runtime-dom): treat playsinline as a boolean attribute (#15627)
  • See full diff in compare view

Updates vue from 3.5.43 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

  • compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
  • compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
  • compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
  • compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
  • compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
  • custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
  • hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
  • KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
  • reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
  • reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
  • reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
  • reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
  • runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
  • runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
  • runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
  • runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
  • runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
  • runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
  • server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
  • ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
  • suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
  • suspense: skip rendering async components unmounted while pending (4ab865a)
  • teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
  • transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
  • transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500
Commits

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates @nestjs/common from 12.1.2 to 12.1.3

Release notes

Sourced from @​nestjs/common's releases.

v12.1.3 (2026-10-12)

Bug fixes

… updates

Bumps the npm-production group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@opentelemetry/exporter-metrics-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.222.0` | `0.223.0` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [fastify](https://github.com/fastify/fastify) | `5.12.5` | `5.12.7` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.3` | `2.1.5` |
| [hono](https://github.com/honojs/hono) | `4.13.12` | `4.13.13` |
| [@vue/server-renderer](https://github.com/vuejs/core/tree/HEAD/packages/server-renderer) | `3.5.43` | `3.5.44` |
| [vue](https://github.com/vuejs/core) | `3.5.43` | `3.5.44` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `12.1.2` | `12.1.3` |
| [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `12.1.2` | `12.1.3` |
| [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express) | `12.1.2` | `12.1.3` |
| [@nestjs/platform-fastify](https://github.com/nestjs/nest/tree/HEAD/packages/platform-fastify) | `12.1.2` | `12.1.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.3` | `5.0.5` |
| [tsdown](https://github.com/rolldown/tsdown) | `0.23.0` | `0.23.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.2` | `8.3.4` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.0.5` |



Updates `@opentelemetry/exporter-metrics-otlp-http` from 0.222.0 to 0.223.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.222.0...experimental/v0.223.0)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `fastify` from 5.12.5 to 5.12.7
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.12.5...v5.12.7)

Updates `@hono/node-server` from 2.1.3 to 2.1.5
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.3...v2.1.5)

Updates `hono` from 4.13.12 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.12...v4.13.13)

Updates `@vue/server-renderer` from 3.5.43 to 3.5.44
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](https://github.com/vuejs/core/commits/v3.5.44/packages/server-renderer)

Updates `vue` from 3.5.43 to 3.5.44
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.43...v3.5.44)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@nestjs/common` from 12.1.2 to 12.1.3
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/common)

Updates `@nestjs/core` from 12.1.2 to 12.1.3
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/core)

Updates `@nestjs/platform-express` from 12.1.2 to 12.1.3
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/platform-express)

Updates `@nestjs/platform-fastify` from 12.1.2 to 12.1.3
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/platform-fastify)

Updates `@types/node` from 26.6.4 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 5.0.3 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/coverage-v8)

Updates `tsdown` from 0.23.0 to 0.23.1
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](rolldown/tsdown@v0.23.0...v0.23.1)

Updates `vite` from 8.3.2 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

Updates `vitest` from 5.0.3 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@opentelemetry/exporter-metrics-otlp-http"
  dependency-version: 0.223.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: fastify
  dependency-version: 5.12.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@vue/server-renderer"
  dependency-version: 3.5.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: vue
  dependency-version: 3.5.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@nestjs/common"
  dependency-version: 12.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@nestjs/core"
  dependency-version: 12.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@nestjs/platform-express"
  dependency-version: 12.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@nestjs/platform-fastify"
  dependency-version: 12.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: tsdown
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026
@dependabot
dependabot Bot requested a review from Goopil as a code owner October 19, 2026 04:26
@Goopil
Goopil merged commit b170f3c into main Oct 24, 2026
13 checks passed
@Goopil
Goopil deleted the dependabot/npm_and_yarn/npm-production-d919d69333 branch October 24, 2026 09:56
Goopil added a commit that referenced this pull request Oct 24, 2026
Clear the remaining pnpm audit findings (1 critical, 5 high, 4 low) left
after merging the dependabot groups #236 and #237. Every affected path
lives in examples, benchmarks or root devDependencies — no published
package is affected.

Range-scoped pnpm overrides lift shell-quote, launch-editor,
follow-redirects, fastify, ip-address, body-parser and multer above
their vulnerable ranges, following the existing overrides pattern.
Also bumps turbo, @vitejs/plugin-react and @vitejs/plugin-vue,
covering the superseded dependabot PR #235.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant