Skip to content

chore(deps): bump the production-dependencies group with 12 updates - #74

Merged
priscaenoch merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-6d4b78f93c
Oct 22, 2026
Merged

chore(deps): bump the production-dependencies group with 12 updates#74
priscaenoch merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-6d4b78f93c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 12 updates:

Package From To
@aws-sdk/client-s3 3.1090.0 3.1149.0
@graphql-tools/schema 10.0.38 10.1.3
@opentelemetry/auto-instrumentations-node 0.78.0 0.81.0
@opentelemetry/exporter-trace-otlp-http 0.220.0 0.223.0
@opentelemetry/sdk-node 0.220.0 0.223.0
axios 1.18.1 1.20.0
express 4.22.2 4.22.3
graphql-yoga 5.21.2 5.24.4
morgan 1.11.0 1.12.1
multer 2.2.0 2.4.0
redis 6.1.0 6.3.0
ws 8.21.1 8.22.0

Updates @aws-sdk/client-s3 from 3.1090.0 to 3.1149.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1149.0

3.1149.0(2026-10-09)

Chores
  • codegen: sync for endpoint cache fix and pre-schema error fallback (#8341) (5773a751)
New Features
  • client-quicksight: Adds granular custom permissions for the Gong action connector (GongAction, CreateAndUpdateGongAction, ShareGongAction, UseGongAction) and for create, update, and share operations on 45 data source connectors, such as Amazon S3 and Snowflake, through the Custom Permissions APIs. (c5d26e39)
  • client-deadline: The new ListMemberships API enables users to discover their memberships across Deadline Cloud resources, enabling scoped users of Deadline resources to discover and interact with the resources they have been provided scoped access to. (0d7406c7)
  • client-marketplace-metering: AWS Marketplace Metering Service adds AgreementId to ResolveCustomer API response. (9653f5cc)
  • client-mediatailor: Add caching settings to http functions (7ac7530b)
  • client-securityagent: Adds a test scope field to specify whether a pentest targets a web application or a generative AI application. (1cc5ba6a)
Bug Fixes
  • lib-transfer-manager:
    • retry UploadPart on worker-thread upload path (#8345) (0e357d90)
    • avoid full-body copy for SharedArrayBuffer uploads (#8338) (5473caf9)

For list of updated packages, view updated-packages.md in assets-3.1149.0.zip

v3.1148.0

3.1148.0(2026-10-08)

Documentation Changes
  • client-sesv2: SESV2 DEED - Documentation Update (3d227df4)
New Features
  • client-pi: This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.1. The SDK will prioritize its most performant protocol. (1d99c7c8)
  • client-marketplace-agreement: This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.0. The SDK will prioritize its most performant protocol. (404943ce)
  • client-emr-serverless: This release adds support for system profile logs for lakeformation enabled Spark connect sessions . (f9ed2f83)
  • client-cost-explorer: Adds a product attribute dimension to GetCostAndUsage, GetCostAndUsageWithResources, and GetDimensionValues, letting customers group, filter, and discover Cost Explorer costs by structured attributes such as Amazon Bedrock model, provider, inference type, and feature. (7e0afd11)
  • client-guardduty: Added support for GuardDuty RDS Data Activity Monitoring (aa200020)
  • client-gamelift: Amazon GameLift Servers container fleets now support CPU bursting for game server container groups. The TotalVcpuLimit property of a game server container group definition is now optional. When you omit it, the group has no CPU cap and its containers can burst into unused CPU on the instance. (18121840)
  • client-datazone: Adds support for multi-file notebook import. StartNotebookImport now accepts an s3Files source location with an ordered list of Amazon S3 objects, creating one notebook cell per file, plus a type field to create either a DATA or SQL notebook. (37214f3f)
  • client-devops-agent: Adds release management associations with private network access to AWS DevOps Agent, and a releaseManagementAssociationId field on GitHub and GitLab associations. This helps release management agents (Release-readiness review and Release Testing) access customer resources that are behind a VPC. (55b389d1)
  • client-security-ir: Adds support for retrieving finding-lifecycle metrics for an AWS Security Incident Response membership. (f4f6dfe5)
  • client-cloudformation: CloudFormation introduces force rollback, a new opt-in capability that lets your stacks complete a rollback even when an individual resource cannot be reverted. Set ForceRollback on ContinueUpdateRollback and CloudFormation records each resource that fails as skipped, completing the rollback. (07e146a5)
  • client-opensearch: This release adds a new EncryptionMode option (DISK or NATIVE) to EncryptionAtRestOptions for the CreateDomain and UpdateDomainConfig operations, enabling selection of engine-native index-level encryption on supported Amazon OpenSearch Service domains. (393fb011)
  • client-lambda: AWS Lambda now supports OAuth 2.0 (OAUTHBEARER), IAM, and IAM with OAUTHBEARER authentication for self-managed Apache Kafka event source mappings, including optional OAuth scope, audience, logical cluster, and identity pool parameters. OAuth 2.0 is also available for Confluent Schema Registry. (c7696bfa)
  • client-securityhub: Release findings export APIs - StartExportJobV2, GetExportJobV2, ListExportJobsV2, and CancelExportJobV2. This supports exporting findings from AWS Security Hub to Amazon S3 bucket. (f53e8a2a)
  • client-medialive: AWS Elemental MediaLive Workflow Monitor now supports AWS Elemental Inference feeds as a target resource type for CloudWatch alarm templates. (e335e5dc)
  • client-eks: Configurations support for EKS ACK Capabilities, including EnableCrossNamespace and DisableServices configuration. (82f87e7c)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/client-s3

3.1148.0 (2026-10-08)

Note: Version bump only for package @​aws-sdk/client-s3

3.1147.0 (2026-10-06)

Note: Version bump only for package @​aws-sdk/client-s3

3.1146.0 (2026-10-02)

Note: Version bump only for package @​aws-sdk/client-s3

3.1145.0 (2026-10-01)

Note: Version bump only for package @​aws-sdk/client-s3

3.1144.0 (2026-09-30)

Features

  • client-s3: Amazon S3 adds a new optional S3 Inventory field, IntelligentTieringReferenceDate, reporting the reference date S3 Intelligent-Tiering uses to evaluate an object's tier-transition eligibility. The value is populated for objects in the Intelligent-Tiering storage class and left blank for others. (82bbbdc)

... (truncated)

Commits
  • a960c14 Publish v3.1149.0
  • 5773a75 chore(codegen): sync for endpoint cache fix and pre-schema error fallback (#8...
  • 1bc0425 Publish v3.1148.0
  • 663046d Publish v3.1147.0
  • 054298b Publish v3.1146.0
  • 0199117 Publish v3.1145.0
  • ce26281 Publish v3.1144.0
  • 82bbbdc feat(client-s3): Amazon S3 adds a new optional S3 Inventory field, Intelligen...
  • 81afad0 Publish v3.1143.0
  • c935fdd Publish v3.1142.0
  • Additional commits viewable in compare view

Updates @graphql-tools/schema from 10.0.38 to 10.1.3

Changelog

Sourced from @​graphql-tools/schema's changelog.

10.1.3

Patch Changes

  • Updated dependencies [19f5b33]:
    • @​graphql-tools/utils@​12.0.3
    • @​graphql-tools/merge@​9.2.6

10.1.2

Patch Changes

10.1.1

Patch Changes

10.1.0

Minor Changes

  • #8346 2273c21 Thanks @​ardatan! - This release adds GraphQL v17 support and aligns the existing executor implementation with the latest GraphQL v17 API changes. The following changes are included:

    • getAsyncHelpers is now available on GraphQLResolveInfo. Its track method is used whenever waitUntil is available, as in Yoga's Explicit Resource Management
    • getAbortSignal is now available on GraphQLResolveInfo, matching behavior that was already available in this executor implementation, as in Yoga's Execution Cancellation
    • GraphQLResolveInfo automatically aligns variableValues according to the GraphQL version for better compatibility. In GraphQL v17 and above, variableValues follows the wrapped shape ({ coerced, sources }) expected by GraphQL APIs. In GraphQL v16 and below, variableValues remains a flat map as in previous versions.
    • If your custom scalar resolvers define __serialize and __parseValue, they are automatically mapped to coerceOutputValue and coerceInputValue in GraphQL v17.
    • BREAKING: @graphql-tools/executor's getVariableValues now returns { variableValues } on success, where variableValues is a VariableValues object ({ coerced, sources }). On failure, it returns { errors }.
    • BREAKING: collectFields, shouldIncludeNode, getDeferValues, and collectSubFields now

... (truncated)

Commits

Updates @opentelemetry/auto-instrumentations-node from 0.78.0 to 0.81.0

Changelog

Sourced from @​opentelemetry/auto-instrumentations-node's changelog.

0.81.0 (2026-10-06)

Features

  • deps: update deps matching '@opentelemetry/*' (#3804) (36fcb9c)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​opentelemetry/instrumentation-amqplib bumped from ^0.69.0 to ^0.70.0
      • @​opentelemetry/instrumentation-aws-lambda bumped from ^0.74.0 to ^0.75.0
      • @​opentelemetry/instrumentation-aws-sdk bumped from ^0.77.0 to ^0.78.0
      • @​opentelemetry/instrumentation-bunyan bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-cassandra-driver bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-connect bumped from ^0.65.0 to ^0.66.0
      • @​opentelemetry/instrumentation-cucumber bumped from ^0.38.0 to ^0.39.0
      • @​opentelemetry/instrumentation-dataloader bumped from ^0.39.0 to ^0.40.0
      • @​opentelemetry/instrumentation-dns bumped from ^0.65.0 to ^0.66.0
      • @​opentelemetry/instrumentation-express bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-fs bumped from ^0.41.0 to ^0.42.0
      • @​opentelemetry/instrumentation-generic-pool bumped from ^0.65.0 to ^0.66.0
      • @​opentelemetry/instrumentation-graphql bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-hapi bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-host-metrics bumped from ^0.5.0 to ^0.6.0
      • @​opentelemetry/instrumentation-ioredis bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-kafkajs bumped from ^0.31.0 to ^0.32.0
      • @​opentelemetry/instrumentation-knex bumped from ^0.66.0 to ^0.67.0
      • @​opentelemetry/instrumentation-koa bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-lru-memoizer bumped from ^0.66.0 to ^0.67.0
      • @​opentelemetry/instrumentation-memcached bumped from ^0.65.0 to ^0.66.0
      • @​opentelemetry/instrumentation-mongodb bumped from ^0.75.0 to ^0.76.0
      • @​opentelemetry/instrumentation-mongoose bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-mysql bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-mysql2 bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-nestjs-core bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-net bumped from ^0.66.0 to ^0.67.0
      • @​opentelemetry/instrumentation-openai bumped from ^0.20.0 to ^0.21.0
      • @​opentelemetry/instrumentation-oracledb bumped from ^0.47.0 to ^0.48.0
      • @​opentelemetry/instrumentation-pg bumped from ^0.74.0 to ^0.75.0
      • @​opentelemetry/instrumentation-pino bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-redis bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-restify bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-router bumped from ^0.66.0 to ^0.67.0
      • @​opentelemetry/instrumentation-runtime-node bumped from ^0.35.0 to ^0.36.0
      • @​opentelemetry/instrumentation-socket.io bumped from ^0.69.0 to ^0.70.0
      • @​opentelemetry/instrumentation-tedious bumped from ^0.41.0 to ^0.42.0
      • @​opentelemetry/instrumentation-undici bumped from ^0.32.0 to ^0.33.0

... (truncated)

Commits

Updates @opentelemetry/exporter-trace-otlp-http from 0.220.0 to 0.223.0

Release notes

Sourced from @​opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

  • chore(web-common)!: clean up and deprecate network span utils #7114
    • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
    • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

  • refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.

experimental/v0.222.0

0.222.0

💥 Breaking Changes

  • fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @​trentm
  • fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @​trentm
  • fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @​trentm
  • fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @​trentm

    • This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)

      Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"

🚀 Features

🐛 Bug Fixes

  • fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @​dyladan
  • fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @​JacksonWeber

📚 Documentation

🏠 Internal

  • refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @​david-luna

... (truncated)

Commits
  • 92b844e chore: prepare next v2.x release (#7151)
  • a859aff fix(web-common): export getElementXPath utility (#7124)
  • 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
  • d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
  • 5bd476e chore: move context manager to sdk-trace (#7086)
  • 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
  • 788922c ci: support maintenance branch releases (#7036)
  • 0b72a81 chore: prepare next release (#7044)
  • a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
  • f41805e chore: prepare next release (#7042)
  • Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.220.0 to 0.223.0

Release notes

Sourced from @​opentelemetry/sdk-node's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

  • chore(web-common)!: clean up and deprecate network span utils #7114
    • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
    • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

  • refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.

experimental/v0.222.0

0.222.0

💥 Breaking Changes

  • fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @​trentm
  • fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @​trentm
  • fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @​trentm
  • fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @​trentm

    • This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)

      Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"

🚀 Features

🐛 Bug Fixes

  • fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @​dyladan
  • fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @​JacksonWeber

📚 Documentation

🏠 Internal

  • refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @​david-luna

... (truncated)

Commits
  • 92b844e chore: prepare next v2.x release (#7151)
  • a859aff fix(web-common): export getElementXPath utility (#7124)
  • 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
  • d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
  • 5bd476e chore: move context manager to sdk-trace (#7086)
  • 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
  • 788922c ci: support maintenance branch releases (#7036)
  • 0b72a81 chore: prepare next release (#7044)
  • a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
  • f41805e chore: prepare next release (#7042)
  • Additional commits viewable in compare view

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

  • Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
  • Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
  • Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
  • CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • 84a9f3b chore(release): prepare release 1.20.0 (#11152)
  • e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
  • d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
  • 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
  • d19040b fix: harden runtime option handling (#11141)
  • e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
  • d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
  • 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
  • 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
  • ba98559 docs: add ScrapingBee sponsor (#11137)
  • Additional commits viewable in compare view

Updates express from 4.22.2 to 4.22.3

Changelog

Sourced from express's changelog.

4.22.3

  • Allow conditional revalidation for QUERY requests
    • req.fresh now includes QUERY in the freshness check, so QUERY responses can return 304 when a validator matches
  • deps: qs@~6.16.0
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates graphql-yoga from 5.21.2 to 5.24.4

Changelog

Sourced from graphql-yoga's changelog.

5.24.4

Patch Changes

5.24.3

Patch Changes

5.24.2

Patch Changes

  • #4589 c08efde Thanks @​egoodwinx! - Remove the built-in subscriptions driver option and its graphql-ws / subscriptions-transport-ws wiring (previously implemented via @nestjs/graphql's GqlSubscriptionService).

    Fix open handle leak in multipart tests.

    @nestjs/graphql v14 (required for NestJS 12 support) dropped server-side support for subscriptions-transport-ws, and the driver-level graphql-ws integration held a socket open after shutdown. Rather than keep a partial, driver-managed subscriptions setup, YogaDriver and YogaFederationDriver no longer accept a subscriptions option. Wire up subscriptions yourself using GraphQL Yoga's own subscription support (e.g. the graphql-ws package, or @graphql-yoga/plugin-graphql-sse) the same way you would for a standalone graphql-yoga server.

5.24.1

Patch Changes

... (truncated)

Details...

Description has been truncated

@dependabot
chore(deps): bump the production-dependencies group with 12 updates
31e98a3 
Bumps the production-dependencies group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1090.0` | `3.1149.0` |
| [@graphql-tools/schema](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/schema) | `10.0.38` | `10.1.3` |
| [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.78.0` | `0.81.0` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.223.0` |
| [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.223.0` |
| [axios](https://github.com/axios/axios) | `1.18.1` | `1.20.0` |
| [express](https://github.com/expressjs/express) | `4.22.2` | `4.22.3` |
| [graphql-yoga](https://github.com/graphql-hive/graphql-yoga/tree/HEAD/packages/graphql-yoga) | `5.21.2` | `5.24.4` |
| [morgan](https://github.com/expressjs/morgan) | `1.11.0` | `1.12.1` |
| [multer](https://github.com/expressjs/multer) | `2.2.0` | `2.4.0` |
| [redis](https://github.com/redis/node-redis) | `6.1.0` | `6.3.0` |
| [ws](https://github.com/websockets/ws) | `8.21.1` | `8.22.0` |


Updates `@aws-sdk/client-s3` from 3.1090.0 to 3.1149.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1149.0/clients/client-s3)

Updates `@graphql-tools/schema` from 10.0.38 to 10.1.3
- [Release notes](https://github.com/ardatan/graphql-tools/releases)
- [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/schema/CHANGELOG.md)
- [Commits](https://github.com/ardatan/graphql-tools/commits/@graphql-tools/schema@10.1.3/packages/schema)

Updates `@opentelemetry/auto-instrumentations-node` from 0.78.0 to 0.81.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.81.0/packages/auto-instrumentations-node)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.220.0 to 0.223.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.223.0)

Updates `@opentelemetry/sdk-node` from 0.220.0 to 0.223.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.223.0)

Updates `axios` from 1.18.1 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.1...v1.20.0)

Updates `express` from 4.22.2 to 4.22.3
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.3/History.md)
- [Commits](expressjs/express@v4.22.2...v4.22.3)

Updates `graphql-yoga` from 5.21.2 to 5.24.4
- [Release notes](https://github.com/graphql-hive/graphql-yoga/releases)
- [Changelog](https://github.com/graphql-hive/graphql-yoga/blob/main/packages/graphql-yoga/CHANGELOG.md)
- [Commits](https://github.com/graphql-hive/graphql-yoga/commits/graphql-yoga@5.24.4/packages/graphql-yoga)

Updates `morgan` from 1.11.0 to 1.12.1
- [Release notes](https://github.com/expressjs/morgan/releases)
- [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md)
- [Commits](expressjs/morgan@1.11.0...1.12.1)

Updates `multer` from 2.2.0 to 2.4.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.2.0...v2.4.0)

Updates `redis` from 6.1.0 to 6.3.0
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@6.1.0...redis@6.3.0)

Updates `ws` from 8.21.1 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.1...8.22.0)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1149.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@graphql-tools/schema"
  dependency-version: 10.1.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/auto-instrumentations-node"
  dependency-version: 0.81.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.223.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.223.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: express
  dependency-version: 4.22.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: graphql-yoga
  dependency-version: 5.24.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: morgan
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: multer
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: redis
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 13, 2026
@priscaenoch
priscaenoch merged commit 8837474 into main Oct 22, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-6d4b78f93c branch October 22, 2026 11:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@priscaenoch