Skip to content

chore(deps)(deps): bump the production-dependencies group with 6 updates - #122

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-dependencies-02de181dde
Closed

chore(deps)(deps): bump the production-dependencies group with 6 updates#122
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-dependencies-02de181dde

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 6 updates:

Package From To
axios 1.19.0 1.20.0
express-rate-limit 8.6.2 8.7.0
joi 18.2.5 18.2.8
mariadb 3.5.3 3.5.4
morgan 1.11.0 1.12.0
mysql2 3.23.4 3.24.3

Updates axios from 1.19.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

  • Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
  • Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
  • Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
  • CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

Changelog

Sourced from axios's changelog.

Changelog

Commits
  • 84a9f3b chore(release): prepare release 1.20.0 (#11152)
  • e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
  • d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
  • 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
  • d19040b fix: harden runtime option handling (#11141)
  • e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
  • d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
  • 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
  • 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
  • ba98559 docs: add ScrapingBee sponsor (#11137)
  • Additional commits viewable in compare view

Updates express-rate-limit from 8.6.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

Commits
  • 48db09e 8.7.0
  • dce5871 v8.7.0 changelog
  • 2f08044 Add inspect.software health badge (#673)
  • a29757c feat: add retryAfter option (#661)
  • 146e88b chore: rename license
  • 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
  • 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
  • 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
  • 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
  • 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
  • Additional commits viewable in compare view

Updates joi from 18.2.5 to 18.2.8

Commits
  • e30b50e 18.2.8
  • 1c9dede Merge pull request #3149 from hapijs/chore/optimize-schema-creation
  • cdad986 chore: optimize schema creation
  • 057dff2 18.2.7
  • a14051a Merge pull request #3148 from hapijs/chore/optimize-large-arrays
  • 62ee021 chore: optimize processing of large arrays
  • 883455e Merge pull request #3147 from hapijs/fix/failover-external-interaction
  • 8bacc2a fix: inner external shouldn't execute when parent failover applied
  • a4361e7 18.2.6
  • 00e2810 Merge pull request #3144 from hapijs/chore/add-regression-test
  • Additional commits viewable in compare view

Updates mariadb from 3.5.3 to 3.5.4

Release notes

Sourced from mariadb's releases.

MariaDB Connector/Node.js 3.5.4

3.5.4 (Jul 2026)

Full Changelog

Notable changes

  • CONJS-355: Avoid flat-cloning the connection options for every command, relying on a prototype-chain merge instead (#353 thanks to erulabs)
  • CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI
  • CONJS-365: Enable standard TLS certificate identity validation under Deno
  • CONJS-366: New option maxAllowedColumns (default 65535) bounding the column count announced by the server, a rogue server being otherwise able to have the client allocate metadata for a result-set that will never complete (report by fg0x0)

Issues Fixed

  • CONJS-329: An exception thrown by a callback was reported to that same callback as a database error, instead of propagating like it does from any other node-style callback (report by Assen Totin)
  • CONJS-356: Corrected ed25519 authentication with zero-configuration SSL
  • CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated
  • CONJS-359: Corrected the default maxAllowedPacket value when the option is not set
  • CONJS-360: batch() ignored the insertIdAsNumber / supportBigNumbers / bigNumberStrings options for insertId
  • CONJS-361: The connection stopped sending commands after a command ending on the last packet of a network chunk: a prepared statement was never executed, without error nor timeout (report by Assen Totin)
  • CONJS-362: Limit the parsec authentication PBKDF2 iteration factor and move the key derivation off the event loop, a rogue server being otherwise able to freeze the whole process for minutes (report by fg0x0)
  • CONJS-363: typeCast accessors returned corrupted values with prepared statements
  • CONJS-364: Types / TypeNumbers enums threw at runtime (#347, contribution by BrianDouglasIE)
  • CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)
  • CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)
  • CONJS-369: Fixed SQL injection through object keys in SET expansion when using permitSetMultiParamEntries (report by fg0x0)
Changelog

Sourced from mariadb's changelog.

3.5.4 (Jul 2026)

Full Changelog

Notable changes

  • CONJS-355: Avoid flat-cloning the connection options for every command, relying on a prototype-chain merge instead (#353 thanks to erulabs)
  • CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI
  • CONJS-365: Enable standard TLS certificate identity validation under Deno
  • CONJS-366: New option maxAllowedColumns (default 65535) bounding the column count announced by the server, a rogue server being otherwise able to have the client allocate metadata for a result-set that will never complete (report by fg0x0)

Issues Fixed

  • CONJS-329: An exception thrown by a callback was reported to that same callback as a database error, instead of propagating like it does from any other node-style callback (report by Assen Totin)
  • CONJS-356: Corrected ed25519 authentication with zero-configuration SSL
  • CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated
  • CONJS-359: Corrected the default maxAllowedPacket value when the option is not set
  • CONJS-360: batch() ignored the insertIdAsNumber / supportBigNumbers / bigNumberStrings options for insertId
  • CONJS-361: The connection stopped sending commands after a command ending on the last packet of a network chunk: a prepared statement was never executed, without error nor timeout (report by Assen Totin)
  • CONJS-362: Limit the parsec authentication PBKDF2 iteration factor and move the key derivation off the event loop, a rogue server being otherwise able to freeze the whole process for minutes (report by fg0x0)
  • CONJS-363: typeCast accessors returned corrupted values with prepared statements
  • CONJS-364: Types / TypeNumbers enums threw at runtime (#347, contribution by BrianDouglasIE)
  • CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)
  • CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)
  • CONJS-369: Fixed SQL injection through object keys in SET expansion when using permitSetMultiParamEntries (report by fg0x0)

3.4.7 (Jul 2026)

Full Changelog

Notable changes

  • CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI

Issues Fixed

  • CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated
  • CONJS-363: typeCast accessors returned corrupted values with prepared statements
  • CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)
  • CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)
  • CONJS-369: Fixed SQL injection through object keys in SET expansion when using permitSetMultiParamEntries (report by fg0x0)
  • Escape the server-supplied filename before building the LOCAL INFILE validation regular expression

3.3.4 (Jul 2026)

Full Changelog

Notable changes

  • CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI

Issues Fixed

  • CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated
  • CONJS-363: typeCast accessors returned corrupted values with prepared statements
  • CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)
  • CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)

... (truncated)

Commits
  • ff43a2c [misc] type definitions: StreamCallback declared as a value it never exports
  • 2044071 Merge pull request #356 from GiHoon1123/fix-sqlerror-instanceof
  • f7009c4 [misc] fix SqlError losing its constructor shape via namespace import
  • 1d9ae05 [misc] command queue: never discard a command that has not started
  • a666b5e [misc] test correction
  • 8efc399 bump 3.5.4 version
  • f050ee7 [misc] callback API: give callbacks to the command layer instead of a promise
  • 1e79cee [misc] test addition
  • 3fdaf48 [CONJS-329] Exception thrown by a callback reported as a database error
  • a0671c2 [CONJS-361] Connection stops sending commands after a command ends on the las...
  • Additional commits viewable in compare view

Updates morgan from 1.11.0 to 1.12.0

Release notes

Sourced from morgan's releases.

1.12.0

What's Changed

New Contributors

Full Changelog: expressjs/morgan@1.11.0...1.12.0

Changelog

Sourced from morgan's changelog.

1.12.0

  • Security fix for CVE-2026-15603(GHSA-jxfw-x594-9x9m)
  • Allow format functions to return objects for streams in objectMode
  • Respect the NO_COLOR environment variable in the dev format
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for morgan since your current version.


Updates mysql2 from 3.23.4 to 3.24.3

Release notes

Sourced from mysql2's releases.

v3.24.3

3.24.3 (2026-09-01)

Bug Fixes

  • typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

v3.24.2

3.24.2 (2026-08-24)

Bug Fixes

  • correct length-coded number size for the 3-byte range (#4500) (de56272)
  • promise: honour trace: false on every promise-API method (#4502) (1dcd8ef), closes #4501

v3.24.1

3.24.1 (2026-08-24)

Performance Improvements

  • single-pass utf8 string encoding for outgoing packets (#4495) (183e947)

v3.24.0

3.24.0 (2026-08-23)

Features

  • typed parameters, and adopt integer types the server reports (#4488) (8ec20f1)

Bug Fixes

  • zero dates come back as "undefined 00:00:00" with dateStrings (#4491) (5bf7bda)

Performance Improvements

  • remove per-query and per-row allocation hotspots (#4486) (c86fe5a)
  • serialize COM_STMT_EXECUTE in a single exact-size pass (#4494) (f3a60bc)
Changelog

Sourced from mysql2's changelog.

3.24.3 (2026-09-01)

Bug Fixes

  • typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

3.24.2 (2026-08-24)

Bug Fixes

  • correct length-coded number size for the 3-byte range (#4500) (de56272)
  • promise: honour trace: false on every promise-API method (#4502) (1dcd8ef), closes #4501

3.24.1 (2026-08-24)

Performance Improvements

  • single-pass utf8 string encoding for outgoing packets (#4495) (183e947)

3.24.0 (2026-08-23)

Features

  • typed parameters, and adopt integer types the server reports (#4488) (8ec20f1)

Bug Fixes

  • zero dates come back as "undefined 00:00:00" with dateStrings (#4491) (5bf7bda)

Performance Improvements

  • remove per-query and per-row allocation hotspots (#4486) (c86fe5a)
  • serialize COM_STMT_EXECUTE in a single exact-size pass (#4494) (f3a60bc)
Commits
  • 83bda80 chore(master): release 3.24.3 (#4514)
  • 6cac974 build(deps): bump lucide-react from 1.35.0 to 1.37.0 in /website (#4520)
  • d3f8ceb build(deps-dev): bump @​types/node from 26.3.0 to 26.4.0 in /website (#4519)
  • 05993b1 build(deps): bump lucide-react from 1.34.0 to 1.35.0 in /website (#4518)
  • 797f38e build(deps-dev): bump @​types/node from 26.3.0 to 26.4.0 (#4517)
  • f17babe build(deps-dev): bump @​biomejs/biome from 2.5.10 to 2.5.11 (#4516)
  • f4099d5 build(deps-dev): bump rollup from 4.62.5 to 4.63.1 in the rollup group (#4515)
  • 1281e1e fix(typings): PoolCluster node events emit a string nodeId (#4513)
  • 0957ae4 build(deps-dev): bump @​types/node from 26.2.0 to 26.3.0 (#4510)
  • a331feb build(deps-dev): bump @​types/node from 26.2.0 to 26.3.0 in /website (#4511)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): bump the production-dependencies group with 6 updates
003da72 
Bumps the production-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.19.0` | `1.20.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.2` | `8.7.0` |
| [joi](https://github.com/hapijs/joi) | `18.2.5` | `18.2.8` |
| [mariadb](https://github.com/mariadb-corporation/mariadb-connector-nodejs) | `3.5.3` | `3.5.4` |
| [morgan](https://github.com/expressjs/morgan) | `1.11.0` | `1.12.0` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.4` | `3.24.3` |


Updates `axios` from 1.19.0 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.19.0...v1.20.0)

Updates `express-rate-limit` from 8.6.2 to 8.7.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.6.2...v8.7.0)

Updates `joi` from 18.2.5 to 18.2.8
- [Commits](hapijs/joi@v18.2.5...v18.2.8)

Updates `mariadb` from 3.5.3 to 3.5.4
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-nodejs/blob/main/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-nodejs@3.5.3...3.5.4)

Updates `morgan` from 1.11.0 to 1.12.0
- [Release notes](https://github.com/expressjs/morgan/releases)
- [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md)
- [Commits](expressjs/morgan@1.11.0...1.12.0)

Updates `mysql2` from 3.23.4 to 3.24.3
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.23.4...v3.24.3)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: joi
  dependency-version: 18.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: mariadb
  dependency-version: 3.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: morgan
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mysql2
  dependency-version: 3.24.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: FutureSolutionDev. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 7, 2026
@github-actions github-actions Bot added the server Changes in server/src/ label Sep 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 21, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-02de181dde branch September 21, 2026 03:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file server Changes in server/src/

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants