Bump the npm-dependencies group across 1 directory with 19 updates by dependabot[bot] · Pull Request #97 · fosrl/pangolin-node

dependabot · 2026-10-14T14:46:21Z

Bumps the npm-dependencies group with 19 updates in the / directory:

Package	From	To
@node-rs/argon2	`2.1.0`	`2.2.2`
axios	`1.19.0`	`1.20.0`
drizzle-orm	`0.45.2`	`0.45.4`
eslint	`10.8.1`	`10.12.0`
eslint-config-next	`16.3.1`	`16.4.0`
express	`5.2.1`	`5.3.0`
express-rate-limit	`8.6.2`	`8.7.1`
js-yaml	`5.2.3`	`5.4.3`
pg	`8.23.0`	`8.23.1`
@types/pg	`8.21.0`	`8.23.1`
react	`19.2.8`	`19.3.0`
ws	`8.21.3`	`8.22.0`
@types/ws	`8.18.1`	`8.18.2`
yargs	`18.1.0`	`18.2.0`
zod	`4.4.3`	`4.6.5`
@types/node	`26.2.0`	`26.6.5`
@types/pg	`8.21.0`	`8.23.1`
@types/ws	`8.18.1`	`8.18.2`
tsx	`4.23.12`	`4.23.15`
typescript	`6.0.3`	`7.0.2`
typescript-eslint	`8.67.0`	`8.71.1`

Updates @node-rs/argon2 from 2.1.0 to 2.2.2

Commits

b706e30 chore(release): publish
d907346 chore(deps): update dependency @napi-rs/cli to ^3.10.8
22926d9 chore(deps): update dependency oxfmt to ^0.72.0 (#1221)
fe73c75 feat!: redesign bcrypt API while preserving stored hash verification (#1207)
9814527 chore(deps): lock file maintenance (#1220)
c6632df chore(deps): update rust to v1.99.0 (#1219)
c1d8de4 chore(deps): lock file maintenance (#1215)
c118471 chore(deps): update dependency oxfmt to ^0.71.0 (#1218)
c14dee2 chore(deps): update yarn to v4.18.1 (#1217)
84d621a chore(deps): update dependency oxfmt to ^0.70.0 (#1216)
Additional commits viewable in compare view

Updates axios from 1.19.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

Changelog

Sourced from axios's changelog.

Changelog

Commits

84a9f3b chore(release): prepare release 1.20.0 (#11152)
e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
d19040b fix: harden runtime option handling (#11141)
e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
ba98559 docs: add ScrapingBee sponsor (#11137)
Additional commits viewable in compare view

Updates drizzle-orm from 0.45.2 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

Fixed postgres-js not using prepared queries on explicit .prepare(name)

0.45.3 New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
15454db +
54e436f exclude gel from pull
0fd1cc6 remove gel
d028db7 skip gel
93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
f9fc5bf Add drizzle-kit announcement manifest and schema doc
9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
Additional commits viewable in compare view

Updates eslint from 10.8.1 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

4618052 feat: handle astral letters in new-cap (#21357) (sary)

4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)

bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)

efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)

93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)

02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)

b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)

69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)

686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

67eb586 docs: Update README (GitHub Actions Bot)

5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)

8816c1d docs: Update README (GitHub Actions Bot)

3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

152067f chore: update ecosystem plugins (#21362) (ESLint Bot)

b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])

bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)

322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)

d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])

29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])

39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])

182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])

f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)

b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])

3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

v10.11.0

Features

d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)

397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)

d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)

b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)

26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)

6c789ff docs: Update README (GitHub Actions Bot)

5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

... (truncated)

Commits

a438ec3 10.12.0
32a73f1 Build: changelog update for 10.12.0
bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
152067f chore: update ecosystem plugins (#21362)
b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
67eb586 docs: Update README
bfaea12 perf: cache normalized config globals per languageOptions (#21364)
322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
d166567 chore: update dependency prettier to v3.9.9 (#21371)
Additional commits viewable in compare view

Updates eslint-config-next from 16.3.1 to 16.4.0

Release notes

Sourced from eslint-config-next's releases.

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

Show compiler plugin warning in more situations: #75682

fix(scripts): correct typo in rm.mjs error message: #87015

docs: improve clarity and punctuation in README: #86096

Fix debug build paths Pages Router support entries: #93529

bundle-analyzer: record historical snapshots on each analyze run: #93520

fix: detect proxy.ts correctly with compound pageExtensions: #93246

feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

docs: correction to dynamicParams migration: #96624

docs: proxy event argument: #96435

docs: remove experimental note from runtime prefetching: #96615

Preserve per-segment prefetching after dynamic navigation: #96583

Rename static generation stream option to waitForAllReady: #96564

Remove obsolete static generation plumbing: #96563

[turbopack] Drop dead writes to exports: #96381

[turbopack] Ignore writes to exports after a module.exports = {} writes: #96380

[turbopack] Add test for sideEffects with optimizePackageImports: #96549

[turbopack] Strip leading BOM before parsing CSS: #96678

Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550

docs: use relative doc links in instant-navigation error pages: #96672

Turbopack: terminate failed plugin worker threads: #96592

Fix HTML-limited bot matching in prerender bypass rules: #96584

[ci] Fix create_release_branch for new repo permissions: #96641

test: skip action module instance deploy test: #96629

docs: quote the dynamicParams build error in a blockquote: #96633

[react-sync] Open pull requests as the bot that authors the commits: #96682

[Bench] Fixes for pure Fizz bench: #96771

Derive foreground cache revalidation from the consumer: #96731

Fix race when navigating Back before hydration: #96252

docs: present each Skill as steps in the AI agents guide: #96751

Reuse completed cache entries for the rest of a request: #96727

Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735

Remove WorkStore execution mode: #96674

Remove cache revalidation execution mode reads: #96670

Separate App Route render and prerender pipelines: #96662

Remove App Page execution mode reads: #96660

test: fix missing await in css-chunking test: #96725

docs (Skills): stop assuming app/ at the root and port 3000: #96696

Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808

Use Tailwind Turbopack loader in create-next-app: #96606

docs: instant navigation quick start with an adoption prompt: #96663

Separate App Page render and prerender pipelines: #96659

Move App Router execution intent to entrypoints: #96640

... (truncated)

Commits

e273d5b v16.4.0
c3e76ad v16.4.0-canary.63
ccf8c15 v16.4.0-canary.62
27ee721 v16.4.0-canary.61
907721a eslint-config-next: support ESLint 10 (#99628)
cdf6866 v16.4.0-canary.60
ba80ee4 v16.4.0-canary.59
1bcedb4 v16.4.0-canary.58
3683479 v16.4.0-canary.57
a209429 v16.4.0-canary.56
Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

cf6722b 5.3.0 (#7468)
8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
9efc29e docs: fix pass-through typos (#7509)
2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
9169cbe docs: add missing apostrophe in example (#7483)
7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
98bd4cd deps: proxy-addr@^2.0.8 (#7474)
9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates express-rate-limit from 8.6.2 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

v8.7.0

You can view the changelog here.

Commits

c2e30b3 8.7.1
b40a390 v8.7.1 changelog
ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.3

Changelog

Sourced from js-yaml's changelog.

[5.4.3] - 2026-10-06

Fixed

Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

[5.4.2] - 2026-09-13

Fixed

forceQuotes no longer quotes non-string scalars, #798.

[5.4.1] - 2026-08-26

Changed

Hard-limit merge sequence size to 100.

Security

Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

[breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.

[breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.

Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

Accept a byte order mark at the start of each document in a stream, #791.

Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.

Preserve empty scalar items when converting block sequences to flow style.

Do not apply the 1024-character simple-key limit to flow mapping keys.

Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.

Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

... (truncated)

Commits

7832624 5.4.3 released
0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
30108cc Parse the first block mapping key once (#800)
494400b 5.4.2 released
6d8adb4 Fix forceQuotes quoting non-string scalars, #798
e5a3ba0 5.4.1 released
e54dea3 Hard-limit merge sequence size to 100
dfd3a29 Cleanup 6a8e05f, #797
6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
6b4ff5e 5.4.0 released
Additional commits viewable in compare view

Updates pg from 8.23.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

Commits

0980cef Publish
2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
9683053 fix(pg): do not treat Sync as connection ending (#3772)
4589038 fix: validate server certificate against host when connecting to an IP addres...
9808955 cleanup: Fix typo in comment
2b02f64 fix: avoid mutating query config (

Bumps the npm-dependencies group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@node-rs/argon2](https://github.com/napi-rs/node-rs) | `2.1.0` | `2.2.2` | | [axios](https://github.com/axios/axios) | `1.19.0` | `1.20.0` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.2` | `0.45.4` | | [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.12.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.1` | `16.4.0` | | [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.2` | `8.7.1` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.3` | `5.4.3` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.23.0` | `8.23.1` | | [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.21.0` | `8.23.1` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [yargs](https://github.com/yargs/yargs) | `18.1.0` | `18.2.0` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.5` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.5` | | [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.21.0` | `8.23.1` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.15` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.71.1` | Updates `@node-rs/argon2` from 2.1.0 to 2.2.2 - [Release notes](https://github.com/napi-rs/node-rs/releases) - [Commits](https://github.com/napi-rs/node-rs/compare/@node-rs/argon2@2.1.0...@node-rs/argon2@2.2.2) Updates `axios` from 1.19.0 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.19.0...v1.20.0) Updates `drizzle-orm` from 0.45.2 to 0.45.4 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.2...0.45.4) Updates `eslint` from 10.8.1 to 10.12.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.1...v10.12.0) Updates `eslint-config-next` from 16.3.1 to 16.4.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.0/packages/eslint-config-next) Updates `express` from 5.2.1 to 5.3.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v5.2.1...v5.3.0) Updates `express-rate-limit` from 8.6.2 to 8.7.1 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.6.2...v8.7.1) Updates `js-yaml` from 5.2.3 to 5.4.3 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.2.3...5.4.3) Updates `pg` from 8.23.0 to 8.23.1 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg) Updates `@types/pg` from 8.21.0 to 8.23.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `ws` from 8.21.3 to 8.22.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.3...8.22.0) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `yargs` from 18.1.0 to 18.2.0 - [Release notes](https://github.com/yargs/yargs/releases) - [Changelog](https://github.com/yargs/yargs/blob/main/CHANGELOG.md) - [Commits](yargs/yargs@v18.1.0...v18.2.0) Updates `zod` from 4.4.3 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.6.5) Updates `@types/node` from 26.2.0 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/pg` from 8.21.0 to 8.23.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `tsx` from 4.23.12 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.12...v4.23.15) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.3...v7.0.2) Updates `typescript-eslint` from 8.67.0 to 8.71.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.1/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@node-rs/argon2" dependency-version: 2.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: drizzle-orm dependency-version: 0.45.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: eslint dependency-version: 10.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: eslint-config-next dependency-version: 16.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: express dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: express-rate-limit dependency-version: 8.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: js-yaml dependency-version: 5.4.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: pg dependency-version: 8.23.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@types/pg" dependency-version: 8.23.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: ws dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: yargs dependency-version: 18.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@types/pg" dependency-version: 8.23.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: typescript-eslint dependency-version: 8.71.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026

oschwartz10612 approved these changes Oct 15, 2026

View reviewed changes

oschwartz10612 merged commit f139e5a into main Oct 15, 2026
0 of 2 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/npm-dependencies-c4f33e7d05 branch October 15, 2026 18:41

Navigation Menu

Repository navigation

Bump the npm-dependencies group across 1 directory with 19 updates - #97

Bump the npm-dependencies group across 1 directory with 19 updates#97
oschwartz10612 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-c4f33e7d05

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.20.0 — August 19, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

Changelog

0.45.4

0.45.3

New Netlify DB Driver

v10.12.0

Features

Bug Fixes

Documentation

Chores

v10.11.0

Features

Bug Fixes

Documentation

v16.4.0

Core Changes

Misc Changes

v5.3.0

Highlights

🐞 Bug fixes

🚀 Improvements

5.3.0

🐞 Bug fixes

🚀 Improvements

v8.7.1

v8.7.0

[5.4.3] - 2026-10-06

Fixed

[5.4.2] - 2026-09-13

Fixed

[5.4.1] - 2026-08-26

Changed

Security

[5.4.0] - 2026-08-25

Added

Changed

Fixed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading