8000 Bump the npm-dependencies group across 1 directory with 24 updates by dependabot[bot] · Pull Request #4040 · fosrl/pangolin · GitHub
[go: up one dir, main page]
Skip to content {"props":{"docsUrl":"https://docs.github.com/get-started/accessibility/keyboard-shortcuts"}}

Bump the npm-dependencies group across 1 directory with 24 updates - #4040

Merged
oschwartz10612 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-62a1c1d7d9
Nov 2, 2026
Merged

Bump the npm-dependencies group across 1 directory with 24 updates#4040
oschwartz10612 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-62a1c1d7d9

Conversation

@dependabot
@dependabot dependabot Bot commented on behalf of github Nov 2, 2026
Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 24 updates in the / directory:

Package From To
@aws-sdk/client-s3 3.1152.0 3.1160.0
@hookform/resolvers 5.9.1 6.0.2
@react-email/render 2.1.0 2.2.0
@tanstack/react-query 5.104.3 5.105.0
axios 1.20.0 1.21.0
express-rate-limit 8.7.1 8.7.2
glob 13.0.6 14.0.3
gpt-tokenizer 4.0.3 4.1.0
lucide-react 1.57.0 1.64.0
next 16.4.2 16.4.3
nodemailer 10.1.1 10.3.1
posthog-node 5.56.1 5.60.1
react-hook-form 7.90.0 7.91.0
stripe 23.0.0 23.1.0
@dotenvx/dotenvx 2.37.0 2.38.2
@react-email/ui 6.11.3 6.11.6
@tanstack/react-query-devtools 5.104.3 5.105.0
@types/node 26.6.5 26.6.6
eslint 10.12.0 10.13.0
eslint-config-next 16.4.2 16.4.3
postcss 8.5.30 8.5.32
react-email 6.11.2 6.11.6
tsc-alias 1.9.7 1.9.9
typescript-eslint 8.71.2 8.72.1

Updates @aws-sdk/client-s3 from 3.1152.0 to 3.1160.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1160.0

3.1160.0(2026-10-29)

New Features
  • client-cleanrooms: Adds support for the PySpark 2.0 analysis template format and for choosing the file format (CSV or Parquet) of protected job results written to Amazon S3, including in a membership's default job result configuration. (8cb4c7eb)
  • client-bedrock-agentcore-control: Adds Session Endpoint Feature on AgentCore Runtime (07ecbbc3)
  • client-wafv2: AWS WAF customers using Targeted Bot Control, ATP, or ACFP managed rule groups can now enable automatic Challenge JavaScript SDK injection. When enabled, Amazon CloudFront injects the script tag into HTML responses on your behalf, removing the need for manual integration. (d4065359)
  • client-bedrock-agentcore: Adds AgentCore Runtime session endpoint support, including sessionEndpointUrl on the InvokeAgentRuntime response (dac2f977)
  • client-lightsail: This release adds support for instance health status checks and system status checks. (5bf15ec1)
  • client-imagebuilder: This release adds support for on-demand AMI scanning with Amazon Inspector. (a1a1c3ea)
  • checksums: add xxHash and SHA-512 checksum algorithms (#8383) (3aa504f3)
  • codegen: add Smithy RPCv2 JSON protocol (#8386) (ee519d02)

For list of updated packages, view updated-packages.md in assets-3.1160.0.zip

v3.1159.0

3.1159.0(2026-10-28)

Chores
  • readability, require braces for control flow (#8389) (2a160140)
New Features
  • client-connectparticipant: Amazon Connect Participant Service now supports the optional UrlContentDisposition parameter on GetAttachment, which returns a pre-signed URL that renders a chat attachment inline in the browser instead of forcing a download. (264a9efc)
  • client-connect: Amazon Connect APIs - CreateTaskTemplate and UpdateTaskTemplate accept a new ContactHooks parameter called WrapUpFlowId to identify the flow module that runs when an agent attempts to disconnect from a task created with the template. Use this to verify an agent's work or update external case repos. (86f44373)
  • client-ec2: Amazon EC2 Capacity Manager adds supportability checks and capacity fulfillment metrics. Use GetCapacityManagerSupportabilityScores to score how well instance types and Availability Zones can support a capacity request, and GetCapacityManagerMetricData to retrieve fulfillment metrics. (2ab44578)
  • client-opensearch: This release adds APIs to simplify setting up a replication relationship between OpenSearch clusters. The APIs include new Switchover and Failover actions for planned switchovers and unplanned failovers to ensure high availability for OpenSearch in the event of disaster in a single region. (59cc8c0d)
  • client-ivs: InsertAdBreak now allows setting a customized adBreakId on a request and also adds a new field targetStartAt for a delayed ad insertion (c0656dd6)
  • client-acm: AWS Certificate Manager now supports the Automatic Certificate Management Environment (ACME) protocol in the AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. (5b43833f)
  • client-securityagent: Adds support for attaching client certificates for mutual TLS (mTLS) authentication to penetration test target endpoints via the new ClientCertificates field on Assets, enabling pentesting of endpoints that require client certificate authentication. (fe783883)
  • client-kafkaconnect: Amazon MSK Connect now supports updating a connector's custom plugin and worker configuration via the UpdateConnector API. MSK Connect checks connector and task health after the update and rolls back on failure. Each call returns an operation ARN to track with DescribeConnectorOperation. (c9a2aa5a)
  • client-artifact: Update support mode for Assurance Assistance (18fff2c6)
  • client-medialive: AWS Elemental MediaLive now supports SMPTE 2022-7 seamless protection switching for multicast inputs on MediaLive Anywhere. Support for MulticastSettings sources to add a redundant copy of the stream received on a second network interface. (d44798e5)
  • client-neptunedata: Get Storage API analyzes storage usage to identify database bloat and your storage footprint. Index Rebuild API triggers on-demand index reconstruction to eliminate bloat and restore query performance. (278cca93)
Bug Fixes
  • middleware-sdk-s3: scope S3 Express cache by identity (#8387) (7485eaac)

For list of updated packages, view updated-packages.md in assets-3.1159.0.zip

v3.1158.0

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1160.0 (2026-10-29)

Note: Version bump only for package @​aws-sdk/client-s3

3.1159.0 (2026-10-28)

Note: Version bump only for package @​aws-sdk/client-s3

3.1158.0 (2026-10-27)

Bug Fixes

  • client-s3: isolate special character e2e test keys (#8382) (d9c091f)

3.1157.0 (2026-10-26)

Note: Version bump only for package @​aws-sdk/client-s3

3.1156.0 (2026-10-22)

Note: Version bump only for package @​aws-sdk/client-s3

3.1155.0 (2026-10-21)

Note: Version bump only for package @​aws-sdk/client-s3

... (truncated)

Commits
  • 40bf3f7 Publish v3.1160.0
  • c1fb86e Publish v3.1159.0
  • 2d08e1c Publish v3.1158.0
  • d9c091f fix(client-s3): isolate special character e2e test keys (#8382)
  • e5988ec Publish v3.1157.0
  • f9d9119 chore(codegen): sync for service default socket timeout and RPC v2 JSON (#8378)
  • 163a566 Publish v3.1156.0
  • 7c2f089 Publish v3.1155.0
  • 5f53137 chore(codegen): sync for JSON string serializer buffer fix and retryMode docs...
  • f6ff312 Publish v3.1154.0
  • Additional commits viewable in compare view

Updates @hookform/resolvers from 5.9.1 to 6.0.2

Release notes

Sourced from @​hookform/resolvers's releases.

v6.0.2

6.0.2 (2026-10-28)

Bug Fixes

  • typebox: preserve escaped field names in validation errors (#886) (813d0ea)

v6.0.1

6870 6.0.1 (2026-10-27)

Bug Fixes

  • typeschema: drop @​typeschema/main from peerDependencies (#883) (0430340), closes #753 #882

v6.0.0

6.0.0 (2026-10-19)

Features

BREAKING CHANGES

  • effect-ts: the effect-ts resolver now requires effect@^4.0.0; Effect v3 is no longer supported. Schemas must be migrated to the Effect v4 Schema API (e.g. Schema.nonEmptyString() -> .check(Schema.isNonEmpty()), Schema.Union(a, b) -> Schema.Union([a, b]), Schema.transform -> Schema.decodeTo). Error type values follow Effect v4 issue tags: Type -> InvalidType, Missing -> MissingKey, Refinement -> Filter, Unexpected -> UnexpectedKey, plus new AnyOf and InvalidValue. Default error messages now come from Effect v4 (e.g. is missing -> Missing key, and the received value is no longer included).

  • chore(deps): sync bun.lock with ata-validator ^1.23.0

v5.9.2

5.9.2 (2026-10-17)

Bug Fixes

  • ajv: preserve escaped field names in validation errors (#879) (71e6052)
Commits
  • 813d0ea fix(typebox): preserve escaped field names in validation errors (#886)
  • 511d7f6 ci: bump GitHub Actions to Node 24 compatible versions (#885)
  • 0430340 fix(typeschema): drop @​typeschema/main from peerDependencies (#883)
  • 3bcf122 update readme
  • a5ab308 feat(effect-ts): support Effect v4 (#880)
  • 71e6052 fix(ajv): preserve escaped field names in validation errors (#879)
  • 8d088d4 chore(deps): bump ata-validator to ^1.23.0 (#877)
  • See full diff in compare view

Updates @react-email/render from 2.1.0 to 2.2.0

Release notes

Sourced from @​react-email/render's releases.

@​react-email/render@​2.2.0

Minor Changes

  • 8748196: Update html-to-text to v10. The minimum supported Node.js version is now 20.19.0, matching react-email.

@​react-email/render@​2.1.1

Patch Changes

  • f356e81: render now only loads prettier when pretty: true is used, so rendering without it no longer fails with "Failed to load external module prettier" in Next.js dev with Turbopack on Bun
Changelog

Sourced from @​react-email/render's changelog.

2.2.0

Minor Changes

  • 8748196: Update html-to-text to v10. The minimum supported Node.js version is now 20.19.0, matching react-email.

2.1.1

Patch Changes

  • f356e81: render now only loads prettier when pretty: true is used, so rendering without it no longer fails with "Failed to load external module prettier" in Next.js dev with Turbopack on Bun
Commits

Updates @tanstack/react-query from 5.104.3 to 5.105.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.105.0
    • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-next-experimental@​5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-persist-client@​5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.105.0
    • @​tanstack/react-query@​5.105.0

@​tanstack/react-query@​5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.105.0

@​tanstack/react-query-devtools@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5
    • @​tanstack/query-devtools@​5.104.5

@​tanstack/react-query-next-experimental@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5

@​tanstack/react-query-persist-client@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5
    • @​tanstack/query-persist-client-core@​5.104.5

@​tanstack/react-query@​5.104.5

Patch Changes

  • #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.105.0

5.104.5

Patch Changes

  • #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
  • Updated dependencies [f608f93]:
    • @​tanstack/query-core@​5.104.5

5.104.4

Patch Changes

  • #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [1fee044, fce89dd]:

    • @​tanstack/query-core@​5.104.4
Commits
  • 5cc606e ci: Version Packages (#12301)
  • 14cc330 style(packages): write durations in 'count * unit * 1000' order (#12382)
  • d7c0418 chore(react-query/{useQuery,useInfiniteQuery}): remove the unused '@​eslint-re...
  • aa3e26b chore(react-query/{HydrationBoundary,utils}): explain why 'react-hooks-js/ref...
  • b2801aa test(react-query/useMutation): assert that the mutation settles in the cache ...
  • 43636c4 test(react-query/useMutation): wait for the mutation to settle after unmount ...
  • 1eed9d9 chore(*): explain why 'vitest-js/valid-expect' is disabled for the 'expectTyp...
  • 6bdeb13 test(*/useQuery): rename the 'throwOnError' callback parameter to 'err' to av...
  • 86b9f20 test(*/useMutationState): rename the built 'mutation' to 'existingMutation' t...
  • d09972b test(*): rename the 'queryKey' test helper to 'createKey' since it creates ke...
  • Additional commits viewable in compare view

Updates axios from 1.20.0 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge sema 8000 ntics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • aa54a5e docs: remove cancelled sponsors from README (#11369)
  • e6b79d9 chore(release): prepare release 1.21.0 (#11346)
  • fceeb10 chore(deps-dev): bump the development_dependencies group with 4 updates (#11342)
  • 7d15df3 docs: refresh sponsor data (#11341)
  • 8d8e844 docs: correct interceptor options and request lifecycle guide (#11335)
  • 326843a test(no-proxy): cover the request-hostname path with a long dotted host (#11235)
  • e5195ec feat(core): expose request duration on the response (#11214)
  • 8d415e6 fix(headers): bind matcher callbacks to the headers instance (#11216)
  • b16dd77 fix(xhr): remove progress event listeners on request completion (#11225)
  • 790b2ca chore(deps): bump the github-actions group with 3 updates (#11323)
  • Additional commits viewable in compare view

Updates express-rate-limit from 8.7.1 to 8.7.2

Release notes

Sourced from express-rate-limit's releases.

v8.7.2

You can view the changelog here.

Commits
  • 3fa4577 8.7.2
  • 7427a5c v8.7.2 changelog
  • da5b115 fix: don't un-count requests that complete after the window resets (#707)
  • 28331a7 docs: Restore hyphenated anchor links for error codes (#705)
  • 404bc3a docs: show how to reset the key of an IPv6 client (#704)
  • e0b3886 docs: fix inverted skipSuccessfulRequests and ipv6Subnet descriptions (#703)
  • 97bc073 chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 (#702)
  • 991c16d chore(deps): bump ip-address from 10.7.1 to 10.7.3 (#699)
  • a6ace2a chore(deps-dev): bump the development-dependencies group with 9 updates (#698)
  • 518a0d5 chore(deps): bump ip-address from 10.7.0 to 10.7.1 (#696)
  • See full diff in compare view

Updates glob from 13.0.6 to 14.0.3

Changelog

Sourced from glob's changelog.

changeglob

14

  • Use minimatch 11. Each portion of a pattern with magic is now matched with a Matcher from @isaacs/nonrecursive-glob-match in place of a RegExp, so patterns can no longer cause ReDoS. Matching follows the minimatch 11 changes, which are closer to Bash in ...

    Description has been truncated

@dependabot
Bump the npm-dependencies group across 1 directory with 24 updates
f8860bf 
Bumps the npm-dependencies group with 24 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1152.0` | `3.1160.0` |
| [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.9.1` | `6.0.2` |
| [@react-email/render](https://github.com/resend/react-email/tree/HEAD/packages/render) | `2.1.0` | `2.2.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.104.3` | `5.105.0` |
| [axios](https://github.com/axios/axios) | `1.20.0` | `1.21.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.7.1` | `8.7.2` |
| [glob](https://github.com/isaacs/node-glob) | `13.0.6` | `14.0.3` |
| [gpt-tokenizer](https://github.com/niieani/gpt-tokenizer) | `4.0.3` | `4.1.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.57.0` | `1.64.0` |
| [next](https://github.com/vercel/next.js) | `16.4.2` | `16.4.3` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `10.1.1` | `10.3.1` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.56.1` | `5.60.1` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.90.0` | `7.91.0` |
| [stripe](https://github.com/stripe/stripe-node) | `23.0.0` | `23.1.0` |
| [@dotenvx/dotenvx](https://github.com/dotenvx/dotenvx) | `2.37.0` | `2.38.2` |
| [@react-email/ui](https://github.com/resend/react-email/tree/HEAD/packages/ui) | `6.11.3` | `6.11.6` |
| [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.104.3` | `5.105.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.2` | `16.4.3` |
| [postcss](https://github.com/postcss/postcss) | `8.5.30` | `8.5.32` |
| [react-email](https://github.com/resend/react-email/tree/HEAD/packages/react-email) | `6.11.2` | `6.11.6` |
| [tsc-alias](https://github.com/justkey007/tsc-alias) | `1.9.7` | `1.9.9` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.2` | `8.72.1` |



Updates `@aws-sdk/client-s3` from 3.1152.0 to 3.1160.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1160.0/clients/client-s3)

Updates `@hookform/resolvers` from 5.9.1 to 6.0.2
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](react-hook-form/resolvers@v5.9.1...v6.0.2)

Updates `@react-email/render` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/resend/react-email/releases)
- [Changelog](https://github.com/resend/react-email/blob/canary/packages/render/CHANGELOG.md)
- [Commits](https://github.com/resend/react-email/commits/@react-email/render@2.2.0/packages/render)

Updates `@tanstack/react-query` from 5.104.3 to 5.105.0
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.105.0/packages/react-query)

Updates `axios` from 1.20.0 to 1.21.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.20.0...v1.21.0)

Updates `express-rate-limit` from 8.7.1 to 8.7.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.7.1...v8.7.2)

Updates `glob` from 13.0.6 to 14.0.3
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v13.0.6...v14.0.3)

Updates `gpt-tokenizer` from 4.0.3 to 4.1.0
- [Release notes](https://github.com/niieani/gpt-tokenizer/releases)
- [Commits](niieani/gpt-tokenizer@4.0.3...4.1.0)

Updates `lucide-react` from 1.57.0 to 1.64.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.64.0/packages/lucide-react)

Updates `next` from 16.4.2 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.2...v16.4.3)

Updates `nodemailer` from 10.1.1 to 10.3.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.1.1...v10.3.1)

Updates `posthog-node` from 5.56.1 to 5.60.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.60.1/packages/node)

Updates `react-hook-form` from 7.90.0 to 7.91.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.90.0...v7.91.0)

Updates `stripe` from 23.0.0 to 23.1.0
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-node@v23.0.0...v23.1.0)

Updates `@dotenvx/dotenvx` from 2.37.0 to 2.38.2
- [Release notes](https://github.com/dotenvx/dotenvx/releases)
- [Changelog](https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md)
- [Commits](dotenvx/dotenvx@v2.37.0...v2.38.2)

Updates `@react-email/ui` from 6.11.3 to 6.11.6
- [Release notes](https://github.com/resend/react-email/releases)
- [Changelog](https://github.com/resend/react-email/blob/canary/packages/ui/CHANGELOG.md)
- [Commits](https://github.com/resend/react-email/commits/@react-email/ui@6.11.6/packages/ui)

Updates `@tanstack/react-query-devtools` from 5.104.3 to 5.105.0
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.105.0/packages/react-query-devtools)

Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint` from 10.12.0 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.13.0)

Updates `eslint-config-next` from 16.4.2 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-config-next)

Updates `postcss` from 8.5.30 to 8.5.32
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.30...8.5.32)

Updates `react-email` from 6.11.2 to 6.11.6
- [Release notes](https://github.com/resend/react-email/releases)
- [Changelog](https://github.com/resend/react-email/blob/canary/packages/react-email/CHANGELOG.md)
- [Commits](https://github.com/resend/react-email/commits/react-email@6.11.6/packages/react-email)

Updates `tsc-alias` from 1.9.7 to 1.9.9
- [Release notes](https://github.com/justkey007/tsc-alias/releases)
- [Commits](justkey007/tsc-alias@v1.9.7...v1.9.9)

Updates `typescript-eslint` from 8.71.2 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1160.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@hookform/resolvers"
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@react-email/render"
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.105.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: axios
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: glob
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: gpt-tokenizer
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: lucide-react
  dependency-version: 1.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: next
  dependency-version: 16.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: nodemailer
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: posthog-node
  dependency-version: 5.60.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: react-hook-form
  dependency-version: 7.91.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: stripe
  dependency-version: 23.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@dotenvx/dotenvx"
  dependency-version: 2.38.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@react-email/ui"
  dependency-version: 6.11.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@tanstack/react-query-devtools"
  dependency-version: 5.105.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: eslint-config-next
  dependency-version: 16.4.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: postcss
  dependency-version: 8.5.32
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: react-email
  dependency-version: 6.11.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: tsc-alias
  dependency-version: 1.9.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 2, 2026
@dependabot
dependabot Bot requested a review from oschwartz10612 as a code owner November 2, 2026 01:40
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Nov 2, 2026
@dependabot
dependabot Bot requested a review from miloschwartz as a code owner November 2, 2026 01:40
@oschwartz10612
oschwartz10612 merged commit ff1fe20 into main Nov 2, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-dependencies-62a1c1d7d9 branch November 2, 2026 20:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@oschwartz10612 oschwartz10612 oschwartz10612 approved these changes
@miloschwartz miloschwartz Awaiting requested review from miloschwartz miloschwartz is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@oschwartz10612
0