Skip to content

Bump the npm_and_yarn group across 1 directory with 19 updates - #44

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-e83e692796
Open

Bump the npm_and_yarn group across 1 directory with 19 updates#44
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-e83e692796

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 9, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 19 updates in the / directory:

Package From To
body-parser 1.20.3 1.20.8
joi 17.13.3 17.13.8
multer 2.1.1 2.4.0
mysql2 3.12.0 3.23.1
nodemailer 7.0.10 10.0.16
brace-expansion 1.1.12 1.1.21
@grpc/grpc-js 1.14.3 1.14.6
@humanfs/node 0.16.7 0.16.8
@opentelemetry/propagator-jaeger 1.30.1 2.12.0
axios 1.13.2 1.20.0
fast-copy 3.0.2 3.1.0
fast-uri 3.1.0 3.1.8
handlebars 4.7.8 4.7.10
ip-address 10.0.1 10.7.3
js-yaml 4.1.1 4.3.2
moment 2.30.1 2.31.0
protobufjs 7.5.4 7.6.6
proxy-addr 2.0.7 2.0.8
qs 6.13.0 6.16.0

Updates body-parser from 1.20.3 to 1.20.8

Release notes

Sourced from body-parser's releases.

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

New Contributors

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.8

  • Same code base as 1.20.7. This was created to test the new release process.

1.20.7

  • deps: qs@~6.16.0

1.20.6

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit

1.20.5

  • refactor(json): simplify strict mode error string construction
  • fix: extended urlencoded parsing of arrays with >100 elements (#716)
  • deps: qs@~6.15.1

1.20.4

  • deps: qs@~6.14.0
  • deps: use tilde notation for dependencies
  • deps: http-errors@~2.0.1
  • deps: raw-body@~2.5.3
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.


Updates joi from 17.13.3 to 17.13.8

Commits

Updates multer from 2.1.1 to 2.4.0

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from multer's changelog.

2.4.0

  • Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
  • Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
  • Accept a function for limits, called with the request, to set limits per request (#1133)
  • Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
  • Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
  • Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
  • Allow multer.diskStorage() to be called without options (#1471)
  • Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
  • Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
  • Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
  • Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
  • Files skipped by fileFilter no longer count towards maxCount (#1426)
  • Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
  • Remove the concat-stream dependency (#1356)
  • Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
  • Docs: add FormData upload examples (#896)
  • Docs: remove the translated READMEs (#1463)
  • Internal: run the test suite on macOS (#1464)

2.3.0

2.2.0

Commits
  • 35979e5 2.4.0 (#1469)
  • b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
  • e6bcd7d chore(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#1475)
  • 00dec43 chore(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#1476)
  • 8d5c3b7 feat: allow diskStorage without options (#1471)
  • 02f6e82 fix: report the decoded filename on LIMIT_FILE_SIZE (#1478)
  • bc3f72d fix: decode escaped field names, not just filenames (#1473)
  • 2661325 docs: add JSDoc to the public API (#1467)
  • 53337f9 fix: remove late-completing uploads aborted before the engine names them
  • 7f2c9ab feat: add streamHandler option to feed busboy from pre-consumed bodies (#1466)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.


Updates mysql2 from 3.12.0 to 3.23.1

Release notes

Sourced from mysql2's releases.

v3.23.1

3.23.1 (2026-07-19)

Bug Fixes

  • security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
  • parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

v3.23.0

3.23.0 (2026-07-13)

Features

  • return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
  • sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
  • support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

v3.22.6

3.22.6 (2026-07-07)

Bug Fixes

  • sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

v3.22.5

3.22.5 (2026-06-06)

Bug Fixes

  • keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#4327) (2af33a1)

v3.22.4

3.22.4 (2026-05-24)

Bug Fixes

v3.22.3

3.22.3 (2026-04-24)

Bug Fixes

  • allow resetOnRelease in connection config validation (#4278) (e72f923)

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.23.1 (2026-07-19)

Bug Fixes

  • security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
  • parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

3.23.0 (2026-07-13)

Features

  • return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
  • sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
  • support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

3.22.6 (2026-07-07)

Bug Fixes

  • sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

3.22.5 (2026-06-06)

Bug Fixes

  • keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#4327) (2af33a1)

3.22.4 (2026-05-26)

Bug Fixes

3.22.3 (2026-04-24)

Bug Fixes

  • allow resetOnRelease in connection config validation (#4278) (e72f923)

3.22.2 (2026-04-21)

Bug Fixes

... (truncated)

Commits
  • 3de28fb chore(master): release 3.23.1 (#4408)
  • 01f1092 fix(parser): call typeCast for NULL values in the binary protocol (#3368) (#4...
  • 534c552 build(deps): bump lucide-react from 1.24.0 to 1.25.0 in /website (#4407)
  • 7c48343 Merge commit from fork
  • 3e13d7b docs: establish security charter (#4404)
  • 26c135b build(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /website (#4403)
  • f86cfb1 chore(master): release 3.23.0 (#4387)
  • 6316492 build(deps): bump the docusaurus group in /website with 2 updates (#4396)
  • 6b933f6 feat(sql-escaper): add Temporal support when escaping values (#4392)
  • 457c316 build(deps): bump lucide-react from 1.23.0 to 1.24.0 in /website (#4391)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mysql2 since your current version.


Updates nodemailer from 7.0.10 to 10.0.16

Release notes

Sourced from nodemailer's releases.

v10.0.16

10.0.16 (2026-10-07)

Bug Fixes

  • addressparser: keep an escaped parenthesis inside a comment (c4ae20d)
  • fetch: keep the case of cookie names (#1888) (9f16eed)
  • fetch: read the cookie name-value pair by position (645e97c)

v10.0.15

10.0.15 (2026-10-05)

Bug Fixes

  • errors: inherit NodemailerError code from ErrnoException (e99db61), closes #1884
  • errors: keep NodemailerError compatible with @​types/node 26 ErrnoException (#1885) (b660328)

v10.0.14

10.0.14 (2026-10-03)

Bug Fixes

  • addressparser: keep a quoted display name that holds no "@" out of the address (3570d26)
  • addressparser: keep the group recursion depth out of the options object (a680254)
  • addressparser: stop a "[" from hiding the operators after it (5619784)
  • dkim: trim a header field name in linear time (c6f7a55)
  • mime-funcs: read and write header parameters per rfc2045 and rfc2231 (b8ccad7)
  • search only the new bytes for the end of the proxy CONNECT response (81efd7b)

v10.0.13

10.0.13 (2026-09-30)

Bug Fixes

  • read the advertised SASL methods without backtracking regexes (b5a896f)
  • strip comments inside an angle-addr before it becomes the address (a502247)

v10.0.12

10.0.12 (2026-09-28)

Bug Fixes

  • settle every send on a connection error, back off pool requeues, turn a bare CR into CRLF, bound fetch, honour requireTLS (63ccd66)

v10.0.11

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.0.16 (2026-10-07)

Bug Fixes

  • addressparser: keep an escaped parenthesis inside a comment (c4ae20d)
  • fetch: keep the case of cookie names (#1888) (9f16eed)
  • fetch: read the cookie name-value pair by position (645e97c)

10.0.15 (2026-10-05)

Bug Fixes

  • errors: inherit NodemailerError code from ErrnoException (e99db61), closes #1884
  • errors: keep NodemailerError compatible with @​types/node 26 ErrnoException (#1885) (b660328)

10.0.14 (2026-10-03)

Bug Fixes

  • addressparser: keep a quoted display name that holds no "@" out of the address (3570d26)
  • addressparser: keep the group recursion depth out of the options object (a680254)
  • addressparser: stop a "[" from hiding the operators after it (5619784)
  • dkim: trim a header field name in linear time (c6f7a55)
  • mime-funcs: read and write header parameters per rfc2045 and rfc2231 (b8ccad7)
  • search only the new bytes for the end of the proxy CONNECT response (81efd7b)

10.0.13 (2026-09-30)

Bug Fixes

  • read the advertised SASL methods without backtracking regexes (b5a896f)
  • strip comments inside an angle-addr before it becomes the address (a502247)

10.0.12 (2026-09-28)

Bug Fixes

  • settle every send on a connection error, back off pool requeues, turn a bare CR into CRLF, bound fetch, honour requireTLS (63ccd66)

10.0.11 (2026-09-27)

Bug Fixes

  • fetch: report a form body that can not be encoded through the returned stream (74d40bf)

... (truncated)

Commits
  • afa8815 chore(master): release 10.0.16 (#1889)
  • c4ae20d fix(addressparser): keep an escaped parenthesis inside a comment
  • 645e97c fix(fetch): read the cookie name-value pair by position
  • e2e7fa3 chore(deps): update dependencies
  • 9f16eed fix(fetch): keep the case of cookie names (#1888)
  • c17efc0 chore(master): release 10.0.15 (#1886)
  • 8d423d0 chore(deps): update dependencies
  • e99db61 fix(errors): inherit NodemailerError code from ErrnoException
  • b660328 fix(errors): keep NodemailerError compatible with @​types/node 26 ErrnoExcepti...
  • aefd1da chore(master): release 10.0.14 (#1880)
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates brace-expansion from 1.1.12 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates @grpc/grpc-js from 1.14.3 to 1.14.6

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.14.6

@​grpc/grpc-js 1.14.5

  • Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)
  • Fix a bug that caused getAuthContext to return unverified certificates as though they were verified in some configurations (advisory GHSA-m9gg-hp2v-232j)
  • Fix a bug that could cause stale call data to accumulate if a channel failed to connect for a long period of time (#3078)
  • Fix a bug that could cause call status to be reported with expected fields missing (#3079)
  • Avoid redundant end() calls on completed HTTP/2 streams (#3082 contributed by @​olavloite)
  • Unify call numbers and avoid disabled trace allocations (#3084 contributed by @​olavloite)

@​grpc/grpc-js 1.14.4

Commits
  • c63ed15 Merge pull request #3105 from murgatroid99/grpc-js_error_details_1.14
  • 025cc24 Merge pull request #3107 from olavloite/backport-perf-to-1.14.x
  • 9b50778 grpc-js: Increment version to 1.14.6
  • 1126061 grpc-js: Don't transmit error details by default in server interceptors
  • 40b61a0 perf(grpc-js): avoid allocations for empty CallCredentials on the RPC hot pat...
  • aed1745 test(grpc-js): stabilize weighted round robin tests on slow runners (#3104)
  • 8db8a06 perf(grpc-js): avoid redundant metadata clone in RetryingCall on initial atte...
  • 2aa8b88 perf(grpc-js): memoize method config lookup in default config selector (#3098)
  • e4ccd66 perf(grpc-js): cache precomputed serviceUrl in InternalChannel (#3097)
  • 17c61a5 test(grpc-js): fix Windows CI test failures (#3094)
  • Additional commits viewable in compare view

Updates @humanfs/node from 0.16.7 to 0.16.8

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

  • Include type dependencies at runtime (956ce7a), closes #145

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​humanfs/core bumped from ^0.19.1 to ^0.19.2
Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

  • Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
  • Include type dependencies at runtime (956ce7a), closes #145

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​humanfs/core bumped from ^0.19.1 to ^0.19.2
Commits

Updates @opentelemetry/propagator-jaeger from 1.30.1 to 2.12.0

Release notes

Sourced from @​opentelemetry/propagator-jaeger's releases.

v2.12.0

2.12.0

🚀 Features

  • chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #7086

🏠 Internal

  • feat(ci): support releasing from maintenance branches #6767 @​pichlermarc
    • The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.

v2.11.0

2.11.0

🚀 Features

  • feat(context-async-hooks): implement attach() on AsyncLocalStorageContextManager #6845 @​pichlermarc
    • On Node.js 25.9+, delegates to AsyncLocalStorage.withScope() returning a native RunScope. On older Node.js, falls back to enterWith() with a manual disposable wrapper.
  • feat(sdk-trace): allow configuring the force flush timeout per call #6929 @​LarryHu0217

🐛 Bug Fixes

  • fix(sdk-metrics): ignore Infinity in exponential histograms #7015 @​mwear

🏠 Internal

  • perf(sdk-metrics): reuse a single DataView for exponential histogram bit reads #6998 @​mwear
  • chore(ci): run documentation tests on a weekly schedule #6920 @​LarryHu0217
  • feat(ci): support pre-releases and major version bumps in the release workflow #6768 @​pichlermarc
  • chore(resources): Ensure that multiple uses of serviceInstanceIdDetector.detect() return the same value for service.instance.id

v2.10.0

2.10.0

🚀 Features

  • feat(sdk-logs): implement log processor metrics #6554 @​anuraaga
  • feat(otlp-exporter): implement exporter metrics #6480 @​anuraaga
  • feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
    • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

  • fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @​LarryHu0217
  • fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890

@dependabot
Bump the npm_and_yarn group across 1 directory with 19 updates
e18e6ab 
Bumps the npm_and_yarn group with 19 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.3` | `1.20.8` |
| [joi](https://github.com/hapijs/joi) | `17.13.3` | `17.13.8` |
| [multer](https://github.com/expressjs/multer) | `2.1.1` | `2.4.0` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.12.0` | `3.23.1` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `7.0.10` | `10.0.16` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.21` |
| [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.14.3` | `1.14.6` |
| [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.7` | `0.16.8` |
| [@opentelemetry/propagator-jaeger](https://github.com/open-telemetry/opentelemetry-js) | `1.30.1` | `2.12.0` |
| [axios](https://github.com/axios/axios) | `1.13.2` | `1.20.0` |
| [fast-copy](https://github.com/planttheidea/fast-copy) | `3.0.2` | `3.1.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.8` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.10` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.0.1` | `10.7.3` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.2` |
| [moment](https://github.com/moment/moment) | `2.30.1` | `2.31.0` |
| [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.5.4` | `7.6.6` |
| [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` |
| [qs](https://github.com/ljharb/qs) | `6.13.0` | `6.16.0` |



Updates `body-parser` from 1.20.3 to 1.20.8
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.3...1.20.8)

Updates `joi` from 17.13.3 to 17.13.8
- [Commits](hapijs/joi@v17.13.3...v17.13.8)

Updates `multer` from 2.1.1 to 2.4.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.1.1...v2.4.0)

Updates `mysql2` from 3.12.0 to 3.23.1
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.12.0...v3.23.1)

Updates `nodemailer` from 7.0.10 to 10.0.16
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v7.0.10...v10.0.16)

Updates `brace-expansion` from 1.1.12 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21)

Updates `@grpc/grpc-js` from 1.14.3 to 1.14.6
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.6)

Updates `@humanfs/node` from 0.16.7 to 0.16.8
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

Updates `@opentelemetry/propagator-jaeger` from 1.30.1 to 2.12.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/v2.12.0/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v1.30.1...v2.12.0)

Updates `axios` from 1.13.2 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.2...v1.20.0)

Updates `fast-copy` from 3.0.2 to 3.1.0
- [Release notes](https://github.com/planttheidea/fast-copy/releases)
- [Changelog](https://github.com/planttheidea/fast-copy/blob/v3.1.0/CHANGELOG.md)
- [Commits](planttheidea/fast-copy@v3.0.2...v3.1.0)

Updates `fast-uri` from 3.1.0 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.8)

Updates `handlebars` from 4.7.8 to 4.7.10
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.10)

Updates `ip-address` from 10.0.1 to 10.7.3
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.0.1...v10.7.3)

Updates `js-yaml` from 4.1.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.2)

Updates `moment` from 2.30.1 to 2.31.0
- [Release notes](https://github.com/moment/moment/releases)
- [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md)
- [Commits](moment/moment@2.30.1...2.31.0)

Updates `protobufjs` from 7.5.4 to 7.6.6
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.6/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v7.5.4...protobufjs-v7.6.6)

Updates `proxy-addr` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

Updates `qs` from 6.13.0 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.16.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 1.20.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: joi
  dependency-version: 17.13.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: multer
  dependency-version: 2.4.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: mysql2
  dependency-version: 3.23.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 10.0.16
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@grpc/grpc-js"
  dependency-version: 1.14.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@opentelemetry/propagator-jaeger"
  dependency-version: 2.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-copy
  dependency-version: 3.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.10
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.7.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: moment
  dependency-version: 2.31.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: protobufjs
  dependency-version: 7.6.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 9, 2026 07:46
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 9, 2026
@dependabot
dependabot Bot requested a review from cB-Abhinav-Gautam October 9, 2026 07:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cB-Abhinav-Gautam cB-Abhinav-Gautam Awaiting requested review from cB-Abhinav-Gautam cB-Abhinav-Gautam is a code owner automatically assigned from Codebucket-Solutions/admins

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants