Skip to content

chore(deps): bump the server-deps group across 1 directory with 6 updates - #48

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/server/server-deps-39d2e877c9
Open

chore(deps): bump the server-deps group across 1 directory with 6 updates#48
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/server/server-deps-39d2e877c9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the server-deps group with 6 updates in the /packages/server directory:

Package From To
dotenv 16.6.1 17.4.2
express 4.22.2 5.2.1
openai 4.104.0 7.8.0
@types/express 4.17.25 5.0.6
@types/node 20.19.43 26.4.0
typescript 5.9.3 7.0.2

Updates dotenv from 16.6.1 to 17.4.2

Changelog

Sourced from dotenv's changelog.

17.4.2 (2026-04-12)

Changed

  • Improved skill files - tightened up details (#1009)

17.4.1 (2026-04-05)

Changed

  • Change text injecting to injected (#1005)

17.4.0 (2026-04-01)

Added

  • Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

  • Tighten up logs: ◇ injecting env (14) from .env (#1003)

17.3.1 (2026-02-12)

Changed

  • Fix as2 example command in README and update spanish README

17.3.0 (2026-02-12)

Added

  • Add a new README section on dotenv’s approach to the agentic future.

Changed

  • Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

17.2.4 (2026-02-05)

Changed

  • Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)
  • Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

17.2.3 (2025-09-29)

Changed

  • Fixed typescript error definition (#912)

... (truncated)

Commits

Updates express from 4.22.2 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

5.0.1 / 2024-10-08

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0

... (truncated)

Commits

Updates openai from 4.104.0 to 7.8.0

Release notes

Sourced from openai's releases.

v7.8.0

7.8.0 (2026-08-27)

Features

  • api: add compute_units to Responses and Chat Completions usage (#2505) (f9b1313)
  • api: add default WebSocket User-Agent and audit log events (#2504) (9b2f089)

Bug Fixes

  • auth: clamp the workload-identity refresh buffer to the token lifetime (#2490) (76b73a9)
  • auth: secure first-class X.509 workload credentials (#2479) (1b36c19)
  • deps: harden dependency and release boundaries (#2484) (b21ff45)
  • events: settle WebSocket waiters when listeners throw (#2491) (b5a13a7)
  • restore native browser ESM imports (#2495) (c8cab1e)
  • uploads: detect multipart bodies from own properties only (#2492) (559ffc8)

v7.7.0

7.7.0 (2026-08-26)

Features

  • api: make function call output call IDs optional (#2488) (b932ae6)

Bug Fixes

  • streaming: honor cancellation while decoding SSE responses (#2487) (ababe12)

v7.6.0

7.6.0 (2026-08-26)

Features

  • api: Add obfuscation field to ChatCompletionChunk (#2423) (39afa3a)
  • api: Add project residency and usage quantity_unit fields (#2461) (26d8158)
  • api: support backend-mediated Realtime WebRTC calls (#2469) (0d12ca8)
  • auth: add pinned X.509 workload token exchange (#2470) (9dd8648)
  • auth: attest cross-module X.509 transport capabilities (#2471) (c6769fa)
  • auth: harden X.509 token lifecycle and tenant isolation (#2473) (6992683)
  • auth: integrate attested X.509 workload identity into clients (#2472) (ee5229b)
  • support named data-residency endpoints (#2393) (62d98dd)

Bug Fixes

... (truncated)

Changelog

Sourced from openai's changelog.

7.8.0 (2026-08-27)

Features

  • api: add compute_units to Responses and Chat Completions usage (#2505) (f9b1313)
  • api: add default WebSocket User-Agent and audit log events (#2504) (9b2f089)

Bug Fixes

  • auth: clamp the workload-identity refresh buffer to the token lifetime (#2490) (76b73a9)
  • auth: secure first-class X.509 workload credentials (#2479) (1b36c19)
  • deps: harden dependency and release boundaries (#2484) (b21ff45)
  • events: settle WebSocket waiters when listeners throw (#2491) (b5a13a7)
  • restore native browser ESM imports (#2495) (c8cab1e)
  • uploads: detect multipart bodies from own properties only (#2492) (559ffc8)

7.7.0 (2026-08-26)

Features

  • api: make function call output call IDs optional (#2488) (b932ae6)

Bug Fixes

  • streaming: honor cancellation while decoding SSE responses (#2487) (ababe12)

7.6.0 (2026-08-26)

Features

  • api: Add obfuscation field to ChatCompletionChunk (#2423) (39afa3a)
  • api: Add project residency and usage quantity_unit fields (#2461) (26d8158)
  • api: support backend-mediated Realtime WebRTC calls (#2469) (0d12ca8)
  • auth: add pinned X.509 workload token exchange (#2470) (9dd8648)
  • auth: attest cross-module X.509 transport capabilities (#2471) (c6769fa)
  • auth: harden X.509 token lifecycle and tenant isolation (#2473) (6992683)
  • auth: integrate attested X.509 workload identity into clients (#2472) (ee5229b)
  • support named data-residency endpoints (#2393) (62d98dd)

Bug Fixes

  • [responses] Avoid quadratic comparisons when accumulating long text (#2434) (95628ce)
  • assistants: reject run-step identity hijacking before tool callbacks (#2476) (63b1c75)
  • audio: preserve recording outcomes during cancellation and cleanup (#2482) (dafcac4)

... (truncated)

Commits
  • 31fae53 release: 7.8.0 (#2493)
  • f9b1313 feat(api): add compute_units to Responses and Chat Completions usage (#2505)
  • b21ff45 fix(deps): harden dependency and release boundaries (#2484)
  • a4a80eb test: exercise direct browser imports without credentials (#2501)
  • c8cab1e fix: restore native browser ESM imports (#2495)
  • d691a10 test: execute webpack browser bundle without live credentials (#2498)
  • 7ef99c4 test: verify packed browser bundles target ES2020 (#2496)
  • b86efac ci: require keyless ecosystem checks on release PRs (#2497)
  • 08f201c ci: gate npm publication on browser-compatible imports (#2500)
  • 44af438 test: cover webpack ESM and CommonJS package entrypoints (#2499)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for openai since your current version.


Updates @types/express from 4.17.25 to 5.0.6

Commits

Updates @types/node from 20.19.43 to 26.4.0

Commits

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

@dependabot @github

dependabot Bot commented on behalf of github Jul 25, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, server. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from Sandeeprdy1729 as a code owner July 25, 2026 12:22
@dependabot dependabot Bot changed the title chore(deps): bump the server-deps group across 1 directory with 6 updates build(deps): bump the server-deps group across 1 directory with 6 updates Aug 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/server/server-deps-39d2e877c9 branch from 87f5b9c to ed93062 Compare August 1, 2026 12:37
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/server/server-deps-39d2e877c9 branch from ed93062 to bb4aaae Compare August 13, 2026 17:57
@dependabot
chore(deps): bump the server-deps group across 1 directory with 6 upd…
4f8f7e2 
…ates

Bumps the server-deps group with 6 updates in the /packages/server directory:

| Package | From | To |
| --- | --- | --- |
| [dotenv](https://github.com/motdotla/dotenv) | `16.6.1` | `17.4.2` |
| [express](https://github.com/expressjs/express) | `4.22.2` | `5.2.1` |
| [openai](https://github.com/openai/openai-node) | `4.104.0` | `7.8.0` |
| [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express) | `4.17.25` | `5.0.6` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.19.43` | `26.4.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |



Updates `dotenv` from 16.6.1 to 17.4.2
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v16.6.1...v17.4.2)

Updates `express` from 4.22.2 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v4.22.2...v5.2.1)

Updates `openai` from 4.104.0 to 7.8.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v4.104.0...v7.8.0)

Updates `@types/express` from 4.17.25 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

Updates `@types/node` from 20.19.43 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v7.0.2)

---
updated-dependencies:
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: server-deps
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: server-deps
- dependency-name: dotenv
  dependency-version: 17.4.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: server-deps
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: server-deps
- dependency-name: openai
  dependency-version: 6.49.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: server-deps
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: server-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump the server-deps group across 1 directory with 6 updates chore(deps): bump the server-deps group across 1 directory with 6 updates Sep 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/server/server-deps-39d2e877c9 branch from bb4aaae to 4f8f7e2 Compare September 1, 2026 12:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Sandeeprdy1729 Sandeeprdy1729 Awaiting requested review from Sandeeprdy1729 Sandeeprdy1729 is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants