Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 27 updates - #209

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-87262c0e2c
Open

build(deps): bump the minor-and-patch group across 1 directory with 27 updates#209
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-87262c0e2c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 27 updates in the / directory:

Package From To
@aws-sdk/client-dynamodb 3.1141.0 3.1161.0
@azure/app-configuration 1.12.1 1.13.1
@azure/keyvault-secrets 4.11.2 4.12.0
@clickhouse/client 1.23.1 1.24.1
@modelcontextprotocol/sdk 1.30.0 1.32.2
axios 1.20.0 1.21.0
express 5.2.1 5.3.0
knex 3.2.10 3.3.0
lru-cache 11.5.2 11.5.3
mongodb 7.5.0 7.8.0
mysql2 3.23.2 3.24.6
node-sqlite3-wasm 0.8.60 0.8.61
oci-common 2.139.0 2.144.0
oci-objectstorage 2.139.0 2.144.0
oci-secrets 2.139.0 2.144.0
pg 8.23.0 8.23.1
pg-query-stream 4.17.0 4.17.1
redis 6.2.0 6.3.1
sql-formatter 15.8.2 15.9.0
yaml 2.9.0 2.9.1
@testcontainers/redis 12.1.0 12.2.1
@types/ssh2 1.15.5 1.15.6
@types/vscode 1.90.0 1.144.0
@typescript-eslint/eslint-plugin 8.66.0 8.72.1
@typescript-eslint/parser 8.66.0 8.72.1
eslint 10.8.1 10.14.0
prettier 3.9.6 3.9.10

Updates @aws-sdk/client-dynamodb from 3.1141.0 to 3.1161.0

Release notes

Sourced from @​aws-sdk/client-dynamodb's releases.

v3.1161.0

3.1161.0(2026-10-30)

Chores
New Features
  • clients: update client endpoints as of 2026-10-30 (757e0255)
  • client-timestream-influxdb: Add DeploymentConfiguration field to CreateDbCluster and UpdateDbCluster APIs to support creation of heterogenous InfluxDB v3 Enterprise clusters. (493e1ac8)
  • client-customer-profiles: Adds support for template ingestion controls in the GetProfileObjectTypeTemplate API response. (214bd946)
  • client-lambda: Adds ConsumptionMode to SelfManagedKafkaEventSourceConfig, letting Lambda event source mappings consume self-managed Apache Kafka topics as a queue. Set ConsumptionMode to Queue when creating an event source mapping. (b7dde404)
  • client-cloudwatch-logs: Adds support for account-level retention policies in Amazon CloudWatch Logs. Customers can now use PutAccountPolicy with the new RETENTION POLICY type to set default log retention across all log groups in an account. Includes dry-run mode to preview the impact of policy changes before applying them. (7b968f16)
  • client-sagemaker: Create endpoints with AcceleratorPartitionLayouts on ProductionVariant and deploy inference components with AcceleratorPartitionType in ComputeResourceRequirements to divide accelerators into hardware-isolated NVIDIA MIG partitions, running multiple models per GPU. P4d, P5, G7, G7e. (ec1b1811)
  • client-omics: Adds the outputUriPrefixMode parameter to StartRun and GetRun. You can now write run outputs directly under outputUri, without the prefixes the service adds by default. When you opt in, outputs overwrite existing objects at the same keys. (f51a1ddd)
  • client-docdb: Amazon DocumentDB now returns ServerlessV2PlatformVersion in DBCluster API responses and adds the DescribeServerlessV2PlatformVersions API to discover available platform versions and their capabilities. (d6c69cd9)
  • client-connect: Amazon Connect adds tag-based access control for Contact Lens rules. ListRealtimeContactAnalysisSegmentsV2 adds a ListFilter to return only category segments whose rules match given tags. PreEvaluationFilter now supports contact evaluation resources for OnContactEvaluationSubmit rules. (186beac8)
  • client-amp: Managed Prometheus collectors now support Amazon MSK consumer-group metrics for Amazon Managed Service for Prometheus and CloudWatch. (5f5dc778)
  • client-bedrock-agent-runtime: Adds the CodeExecution step and codeExecution action to AgenticRetrieveStream trace events, showing when the agent runs code and which documents it reads. (f8e4c279)
Bug Fixes
  • clock-skew: exclude server processing time from skew correction (#8391) (2dd70868)

For list of updated packages, view updated-packages.md in assets-3.1161.0.zip

v3.1160.0

3.1160.0(2026-10-29)

New Features
  • client-cleanrooms: Adds support for the PySpark 2.0 analysis template format and for choosing the file format (CSV or Parquet) of protected job results written to Amazon S3, including in a membership's default job result configuration. (8cb4c7eb)
  • client-bedrock-agentcore-control: Adds Session Endpoint Feature on AgentCore Runtime (07ecbbc3)
  • client-wafv2: AWS WAF customers using Targeted Bot Control, ATP, or ACFP managed rule groups can now enable automatic Challenge JavaScript SDK injection. When enabled, Amazon CloudFront injects the script tag into HTML responses on your behalf, removing the need for manual integration. (d4065359)
  • client-bedrock-agentcore: Adds AgentCore Runtime session endpoint support, including sessionEndpointUrl on the InvokeAgentRuntime response (dac2f977)
  • client-lightsail: This release adds support for instance health status checks and system status checks. (5bf15ec1)
  • client-imagebuilder: This release adds support for on-demand AMI scanning with Amazon Inspector. (a1a1c3ea)
  • checksums: add xxHash and SHA-512 checksum algorithms (#8383) (3aa504f3)
  • codegen: add Smithy RPCv2 JSON protocol (#8386) (ee519d02)

For list of updated packages, view updated-packages.md in assets-3.1160.0.zip

v3.1159.0

... (truncated)

Changelog

Sourced from @​aws-sdk/client-dynamodb's changelog.

3.1161.0 (2026-10-30)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1160.0 (2026-10-29)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1159.0 (2026-10-28)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1158.0 (2026-10-27)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1157.0 (2026-10-26)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1156.0 (2026-10-22)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1155.0 (2026-10-21)

... (truncated)

Commits
  • 258c144 Publish v3.1161.0
  • f393101 chore(codegen): sync to new smithy handler changes (#8390)
  • 40bf3f7 Publish v3.1160.0
  • c1fb86e Publish v3.1159.0
  • 2d08e1c Publish v3.1158.0
  • e5988ec Publish v3.1157.0
  • f9d9119 chore(codegen): sync for service default socket timeout and RPC v2 JSON (#8378)
  • 163a566 Publish v3.1156.0
  • 7c2f089 Publish v3.1155.0
  • 5f53137 chore(codegen): sync for JSON string serializer buffer fix and retryMode docs...
  • Additional commits viewable in compare view

Updates @azure/app-configuration from 1.12.1 to 1.13.1

Changelog

Sourced from @​azure/app-configuration's changelog.

1.13.1 (2026-10-27)

Bugs Fixed

  • Fixed deleteConfigurationSetting ignoring the caller's onResponse callback. Previously ignored callbacks now execute with the existing runtime timing and arguments, making their side effects and exceptions observable.
  • Fixed getConfigurationSetting ignoring the caller's onResponse callback, including for conditional reads returning 304. Previously ignored callbacks now execute with the existing runtime timing and arguments, making their side effects and exceptions observable. Callback exceptions are propagated rather than treated as conditional-read 304 responses.

1.13.0 (2026-09-23)

Bugs Fixed

  • Fixed a bug that placed the App Configuration SDK identifier before custom User-Agent prefixes. #39594
  • Fixed custom request headers not being sent after the TypeSpec migration in 1.12.0. #39596
  • Fixed a bug that incorrectly truncated configuration setting keys containing reserved URL characters such as ?. #39670

Other Changes

  • Improved Microsoft Entra authentication in sovereign clouds when using a TokenCredential. When audience is not set, the client now infers it from the App Configuration endpoint. An explicitly configured audience continues to override the inferred value. #39775
Commits
  • 25a2f42 updated 1.13.1 release date in changelog (#40527)
  • f0a6948 Fix Get/Delete onResponse forwarding and bump to 1.13.1 (#40488)
  • 3790fcb Remove unused nock dependency from App Configuration (#40228)
  • f8d83ef [App Configuration] version bump 1.13.0 (#40055)
  • cb54354 [App Configuration] Fix custom request headers (#39596)
  • d8871d7 [App Configuration] Audience auto detect (#39775)
  • 96a244f [ESLint] Restore no-useless-assignment recommended rule to error (#39784)
  • cfd1083 [App Config] Fix encoding for configuration setting keys (#39670)
  • eb8e042 [ESLint] Restore preserve-caught-error recommended rule to error (#39580)
  • 487b6df [App Configuration] Fix user agent prefix ordering (#39594)
  • Additional commits viewable in compare view

Updates @azure/keyvault-secrets from 4.11.2 to 4.12.0

Changelog

Sourced from @​azure/keyvault-secrets's changelog.

4.12.0 (2026-10-27)

Features Added

  • Added support for service API version 2026-04-01, which is now the default, and for explicitly selecting it via serviceVersion. #40486

Other Changes

  • Regenerated the internal client from the stable 2026-04-01 specification. #40486
Commits

Updates @clickhouse/client from 1.23.1 to 1.24.1

Release notes

Sourced from @​clickhouse/client's releases.

client-1.24.1

Bug fixes

  • Fixed a socket hang up error on a request that took over a socket released by an earlier request, when another request queued for that socket was aborted in between. The orphaned idle-socket timer from the earlier release destroyed the socket idle_socket_ttl later, mid-request (Node.js only) (#1040). (#1041)

#1040: ClickHouse/clickhouse-js#1040 #1041: ClickHouse/clickhouse-js#1041

client-1.24.0

New features

  • OpenTelemetry: richer, more actionable spans (requested by Langfuse, #948). (#950)
    • The X-ClickHouse-Summary counters are now attached to the clickhouse.query span as well (previously only on command / exec / insert), so the request-level metrics are visible on the outer client span.
    • Every key present in the summary header is now recorded as clickhouse.summary.<key> (the set is no longer a hardcoded subset). This surfaces total_rows_to_read (already typed but never recorded) and memory_usage (peak query memory, in bytes; sent by newer servers), and picks up future server-side additions (e.g. real_time_microseconds) automatically.
    • db.response.returned_rows is now recorded for non-streaming result consumption too (json() on JSON / JSONObjectEachRow / the other single-document JSON formats), not just row-streaming paths.
    • Added a span_attributes field to the per-request query params (query / command / exec / insert / ping). Use it to enrich the operation span with application-level context — e.g. mirroring the tags you also send via the log_comment setting (route, tenant, surface, etc.). Caller-provided attributes never override the client's own db.* / server.* / clickhouse.* attributes.
    • Added a dangerously_log_query_text client option (default false). When enabled, the raw SQL statement is attached to spans as the OpenTelemetry db.query.text attribute and included in the error-level logs emitted for a failed request. The query text may contain sensitive literals, which is why it is off by default; bound query_params values and credentials are never logged or traced regardless of this setting.

#948: ClickHouse/clickhouse-js#948 #950: ClickHouse/clickhouse-js#950

Bug fixes

  • Fixed Array(Date) / Array(Date32) query-parameter binding (and other temporal element types nested in arrays, tuples, and maps). A JS Date inside a container was serialized as a bare Unix timestamp (e.g. [1683244800]), which the server's Array(Date) element parser rejects (CANNOT_PARSE_INPUT_ASSERTION_FAILED). Container-nested Date values are now emitted as a quoted UTC date string (e.g. ['2023-05-05']), the one encoding every temporal element type accepts. Note: a Date used inside Array(DateTime) / Array(DateTime64) is now bound at day precision (the time-of-day is dropped), since date-only is the only form Array(Date) accepts; scalar Date / DateTime binding is unchanged. (#947)
  • Export the QueryParamsWithFormat, ClickHouseSummary, WithClickHouseSummary, ResultJSONType, RowJSONType and PingParams types from @clickhouse/client. They are used in the signatures of the public API (query, ping, the result types), but could not be imported from the package root (#997). (#1024)

#947: ClickHouse/clickhouse-js#947 #997: ClickHouse/clickhouse-js#997 #1024: ClickHouse/clickhouse-js#1024

client-web-1.24.0

New features

  • OpenTelemetry: richer, more actionable spans (requested by Langfuse, #948). (#950)
    • The X-ClickHouse-Summary header is now parsed on the Web client and attached to the operation spans (query / command / exec / insert), including the outer clickhouse.query span. Previously the Web client did not parse the summary header at all.
    • Every key present in the summary header is recorded as clickhouse.summary.<key> (the set is not hardcoded). This surfaces total_rows_to_read and memory_usage (peak query memory, in bytes; sent by newer servers), and picks up future server-side additions (e.g. real_time_microseconds) automatically.
    • db.response.returned_rows is now recorded for non-streaming result consumption too (json() on JSON / JSONObjectEachRow / the other single-document JSON formats), not just row-streaming paths.
    • Added a span_attributes field to the per-request query params (query / command / exec / insert / ping). Use it to enrich the operation span with application-level context — e.g. mirroring the tags you also send via the log_comment setting (route, tenant, surface, etc.). Caller-provided attributes never override the client's own db.* / server.* / clickhouse.* attributes.
    • Added a dangerously_log_query_text client option (default false). When enabled, the raw SQL statement is attached to spans as the OpenTelemetry db.query.text attribute. The query text may contain sensitive literals, which is why it is off by default; bound query_params values and credentials are never traced regardless of this setting.

#948: ClickHouse/clickhouse-js#948 #950: ClickHouse/clickhouse-js#950

Bug fixes

  • Fixed Array(Date) / Array(Date32) query-parameter binding (and other temporal element types nested in arrays, tuples, and maps). A JS Date inside a container was serialized as a bare Unix timestamp (e.g. [1683244800]), which the server's Array(Date) element parser rejects (CANNOT_PARSE_INPUT_ASSERTION_FAILED). Container-nested Date values are now emitted as a quoted UTC date string (e.g. ['2023-05-05']), the one encoding every temporal element type accepts. Note: a Date used inside Array(DateTime) / Array(DateTime64) is now bound at day precision (the time-of-day is dropped), since date-only is the only form Array(Date) accepts; scalar Date / DateTime binding is unchanged. (#947)
  • Export the QueryParamsWithFormat, ClickHouseSummary, WithClickHouseSummary, ResultJSONType, RowJSONType and PingParams types from @clickhouse/client-web. They are used in the signatures of the public API (query, ping, the result types), but could not be imported from the package root (#997). (#1024)

... (truncated)

Commits
  • 6a265d2 Merge pull request #1044 from ClickHouse/main
  • 6750ed4 fix: unblock the 1.24.1 release PR CI (#1045)
  • 938b720 chore: bump @​clickhouse/client version to 1.24.1 (#1043)
  • c2d69e7 fix(client-node): stop an aborted waiting request from destroying a socket in...
  • cbaf09b chore(deps): bump sharp from 0.34.5 to 0.35.5 in /demo/logs (#1039)
  • caf5859 chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /examples/node (#1...
  • 5350609 chore(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21 in /examples/node...
  • f3d5c8f chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /skills/clickhouse...
  • c32237e ci: roll ClickHouse version matrix to 26.9, 26.8, 26.7, 26.3 (#1003)
  • 7c01e77 chore(deps-dev): bump the dev-dependencies group across 1 directory with 15 u...
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

... (truncated)

Commits
  • 3b73021 chore: bump version to 1.32.2 (#3089)
  • fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
  • 6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • Additional commits viewable in compare view

Updates axios from 1.20.0 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected d...

    Description has been truncated

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 2…
f6a3c73 
…7 updates

Bumps the minor-and-patch group with 27 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1141.0` | `3.1161.0` |
| [@azure/app-configuration](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/appconfiguration/app-configuration) | `1.12.1` | `1.13.1` |
| [@azure/keyvault-secrets](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/keyvault/keyvault-secrets) | `4.11.2` | `4.12.0` |
| [@clickhouse/client](https://github.com/ClickHouse/clickhouse-js) | `1.23.1` | `1.24.1` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.32.2` |
| [axios](https://github.com/axios/axios) | `1.20.0` | `1.21.0` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [knex](https://github.com/knex/knex) | `3.2.10` | `3.3.0` |
| [lru-cache](https://github.com/isaacs/node-lru-cache) | `11.5.2` | `11.5.3` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.5.0` | `7.8.0` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.2` | `3.24.6` |
| [node-sqlite3-wasm](https://github.com/tndrle/node-sqlite3-wasm) | `0.8.60` | `0.8.61` |
| [oci-common](https://github.com/oracle/oci-typescript-sdk) | `2.139.0` | `2.144.0` |
| [oci-objectstorage](https://github.com/oracle/oci-typescript-sdk) | `2.139.0` | `2.144.0` |
| [oci-secrets](https://github.com/oracle/oci-typescript-sdk) | `2.139.0` | `2.144.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.23.0` | `8.23.1` |
| [pg-query-stream](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg-query-stream) | `4.17.0` | `4.17.1` |
| [redis](https://github.com/redis/node-redis) | `6.2.0` | `6.3.1` |
| [sql-formatter](https://github.com/sql-formatter-org/sql-formatter) | `15.8.2` | `15.9.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |
| [@testcontainers/redis](https://github.com/testcontainers/testcontainers-node) | `12.1.0` | `12.2.1` |
| [@types/ssh2](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ssh2) | `1.15.5` | `1.15.6` |
| [@types/vscode](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/vscode) | `1.90.0` | `1.144.0` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.66.0` | `8.72.1` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.66.0` | `8.72.1` |
| [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.14.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.10` |



Updates `@aws-sdk/client-dynamodb` from 3.1141.0 to 3.1161.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1161.0/clients/client-dynamodb)

Updates `@azure/app-configuration` from 1.12.1 to 1.13.1
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/appconfiguration/app-configuration/CHANGELOG.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/app-configuration_1.13.1/sdk/appconfiguration/app-configuration)

Updates `@azure/keyvault-secrets` from 4.11.2 to 4.12.0
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/keyvault/keyvault-secrets/CHANGELOG.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/keyvault-secrets_4.12.0/sdk/keyvault/keyvault-secrets)

Updates `@clickhouse/client` from 1.23.1 to 1.24.1
- [Release notes](https://github.com/ClickHouse/clickhouse-js/releases)
- [Changelog](https://github.com/ClickHouse/clickhouse-js/blob/main/CHANGELOG.md)
- [Commits](ClickHouse/clickhouse-js@client-1.23.1...client-1.24.1)

Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.32.2
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.32.2)

Updates `axios` from 1.20.0 to 1.21.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.20.0...v1.21.0)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `knex` from 3.2.10 to 3.3.0
- [Release notes](https://github.com/knex/knex/releases)
- [Changelog](https://github.com/knex/knex/blob/master/CHANGELOG.md)
- [Commits](knex/knex@3.2.10...3.3.0)

Updates `lru-cache` from 11.5.2 to 11.5.3
- [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-lru-cache@v11.5.2...v11.5.3)

Updates `mongodb` from 7.5.0 to 7.8.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.5.0...v7.8.0)

Updates `mysql2` from 3.23.2 to 3.24.6
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.23.2...v3.24.6)

Updates `node-sqlite3-wasm` from 0.8.60 to 0.8.61
- [Release notes](https://github.com/tndrle/node-sqlite3-wasm/releases)
- [Commits](tndrle/node-sqlite3-wasm@v0.8.60...v0.8.61)

Updates `oci-common` from 2.139.0 to 2.144.0
- [Release notes](https://github.com/oracle/oci-typescript-sdk/releases)
- [Changelog](https://github.com/oracle/oci-typescript-sdk/blob/master/CHANGELOG.md)
- [Commits](oracle/oci-typescript-sdk@v2.139.0...v2.144.0)

Updates `oci-objectstorage` from 2.139.0 to 2.144.0
- [Release notes](https://github.com/oracle/oci-typescript-sdk/releases)
- [Changelog](https://github.com/oracle/oci-typescript-sdk/blob/master/CHANGELOG.md)
- [Commits](oracle/oci-typescript-sdk@v2.139.0...v2.144.0)

Updates `oci-secrets` from 2.139.0 to 2.144.0
- [Release notes](https://github.com/oracle/oci-typescript-sdk/releases)
- [Changelog](https://github.com/oracle/oci-typescript-sdk/blob/master/CHANGELOG.md)
- [Commits](oracle/oci-typescript-sdk@v2.139.0...v2.144.0)

Updates `pg` from 8.23.0 to 8.23.1
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg)

Updates `pg-query-stream` from 4.17.0 to 4.17.1
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg-query-stream@4.17.1/packages/pg-query-stream)

Updates `redis` from 6.2.0 to 6.3.1
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@6.2.0...redis@6.3.1)

Updates `sql-formatter` from 15.8.2 to 15.9.0
- [Release notes](https://github.com/sql-formatter-org/sql-formatter/releases)
- [Commits](sql-formatter-org/sql-formatter@v15.8.2...v15.9.0)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

Updates `@testcontainers/redis` from 12.1.0 to 12.2.1
- [Release notes](https://github.com/testcontainers/testcontainers-node/releases)
- [Commits](testcontainers/testcontainers-node@v12.1.0...v12.2.1)

Updates `@types/ssh2` from 1.15.5 to 1.15.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ssh2)

Updates `@types/vscode` from 1.90.0 to 1.144.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/vscode)

Updates `@typescript-eslint/eslint-plugin` from 8.66.0 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.66.0 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/parser)

Updates `eslint` from 10.8.1 to 10.14.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.1...v10.14.0)

Updates `prettier` from 3.9.6 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.6...3.9.10)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1161.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@azure/app-configuration"
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@azure/keyvault-secrets"
  dependency-version: 4.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@clickhouse/client"
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: axios
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: knex
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: lru-cache
  dependency-version: 11.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: mongodb
  dependency-version: 7.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mysql2
  dependency-version: 3.24.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: node-sqlite3-wasm
  dependency-version: 0.8.61
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: oci-common
  dependency-version: 2.144.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: oci-objectstorage
  dependency-version: 2.144.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: oci-secrets
  dependency-version: 2.144.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pg
  dependency-version: 8.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pg-query-stream
  dependency-version: 4.17.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: redis
  dependency-version: 6.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sql-formatter
  dependency-version: 15.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@testcontainers/redis"
  dependency-version: 12.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/ssh2"
  dependency-version: 1.15.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/vscode"
  dependency-version: 1.144.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint
  dependency-version: 10.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies javascript Pull requests that update javascript code labels Nov 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants