👆 Bump the minor-and-patch group in /sdk-node with 11 updates by dependabot[bot] · Pull Request #73 · tanisheesh/reqly

dependabot · 2026-11-09T00:37:15Z

Bumps the minor-and-patch group in /sdk-node with 11 updates:

Package	From	To
@anthropic-ai/sdk	`1.3.0`	`1.6.0`
@fastify/swagger	`9.9.2`	`9.9.3`
@koa/router	`15.7.0`	`15.7.1`
@nestjs/common	`12.3.2`	`12.3.3`
@nestjs/core	`12.3.2`	`12.3.3`
@nestjs/platform-express	`12.3.2`	`12.3.3`
@nestjs/platform-fastify	`12.3.2`	`12.3.3`
fastify	`5.12.7`	`5.12.8`
hono	`4.13.14`	`4.13.16`
koa	`3.2.1`	`3.3.0`
openai	`7.45.1`	`7.52.0`

Updates @anthropic-ai/sdk from 1.3.0 to 1.6.0

Release notes

Sourced from @anthropic-ai/sdk's releases.

sdk-v1.6.0

Features

api: add error code for ramp limit errors

api: add error codes for External Key validation failures

api: add support for signing organization members out everywhere

Bug Fixes

client: set the name of each error to its class name

client: set the name of WorkloadIdentityError

Chores

docs: describe the type and message of API errors

internal: generate the OpenTelemetry span attribute tables

internal: tell contributors when a runtime type check belongs

Documentation

add the rules the SDKs share to CLAUDE.md

client: describe the type, message, code and details of API errors

client: list each method's errors without their descriptions

sdk-v1.5.0

Features

api: add error details types and new error type values

api: add ids filter to list workspaces

client: add error classes for HTTP statuses and API error codes, and apiMessage, errorCode and details on APIError

Bug Fixes

api: capitalize CMEK in error details type names

api: move some error details types to the resource they describe

client: reject path parameters like ";x", ".;x" and "..;x"

tools: keep the memory tool from renaming or deleting the /memories directory

Performance Improvements

streaming: decode server-sent events once per chunk

Chores

... (truncated)

Changelog

Sourced from @anthropic-ai/sdk's changelog.

1.6.0 (2026-11-05)

Features

api: add error code for ramp limit errors

api: add error codes for External Key validation failures

api: add support for signing organization members out everywhere

Bug Fixes

client: set the name of each error to its class name

client: set the name of WorkloadIdentityError

Chores

docs: describe the type and message of API errors

internal: generate the OpenTelemetry span attribute tables

internal: tell contributors when a runtime type check belongs

Documentation

add the rules the SDKs share to CLAUDE.md

client: describe the type, message, code and details of API errors

client: list each method's errors without their descriptions

1.5.0 (2026-11-04)

Features

api: add error details types and new error type values

api: add ids filter to list workspaces

client: add error classes for HTTP statuses and API error codes, and apiMessage, errorCode and details on APIError

Bug Fixes

api: capitalize CMEK in error details type names

api: move some error details types to the resource they describe

client: reject path parameters like ";x", ".;x" and "..;x"

tools: keep the memory tool from renaming or deleting the /memories directory

Performance Improvements

streaming: decode server-sent events once per chunk

... (truncated)

Commits

590e949 release: 1.6.0
479ad16 Merge pull request #1027 from anthropics/synced/published
814b3aa codegen metadata
d643d17 codegen metadata
d680c85 feat(api): add support for signing organization members out everywhere
54d8b51 codegen metadata
531c403 feat(api): add error codes for External Key validation failures
e3df3ce ci: accept notes under the title of a changelog entry file
84025bf codegen metadata
dff525d codegen metadata
Additional commits viewable in compare view

Updates @fastify/swagger from 9.9.2 to 9.9.3

Release notes

Sourced from @fastify/swagger's releases.

v9.9.3

What's Changed

chore: bump fastify/workflows/.github/workflows/reusable-release.yml from b1a11bce713bc857e52b2231fec3c89071ad3135 to 731d0cca9a6a5b9586dad6b0326d49001ab9216f by @dependabot[bot] in fastify/fastify-swagger#963

fix: emit the schemas with an nested in the route schemas by @Tony133 in fastify/fastify-swagger#956

Full Changelog: fastify/fastify-swagger@v9.9.2...v9.9.3

Commits

5a553c2 Bumped v9.9.3
2ef6f87 fix: emit the schemas with an nested in the route schemas (#956)
9847ca8 chore: bump fastify/workflows/.github/workflows/reusable-release.yml
See full diff in compare view

Updates @koa/router from 15.7.0 to 15.7.1

Release notes

Sourced from @koa/router's releases.

v15.7.1

What's Changed

chore(deps): bump fast-uri from 3.1.3 to 3.1.4 by @dependabot[bot] in koajs/router#240

chore(deps): bump js-yaml from 4.3.0 to 4.3.1 by @dependabot[bot] in koajs/router#242

fix: fixes security issue; GHSA-vm89-r456-25x6 (closed) by @yowainwright in koajs/router#254

fix: preserve matching middleware in exclusive mode by @yowainwright in koajs/router#256

fix: keep nested child prefixes when converting middleware boundaries by @official-burak in koajs/router#246

fix: preserve middleware when replacing router prefixes by @yowainwright in koajs/router#257

fix: address prefix middleware review feedback by @yowainwright in koajs/router#259

ci: publish to npm with trusted publishing (OIDC) by @jonathanong in koajs/router#258

chore: patch release by @yowainwright in koajs/router#262

New Contributors

@yowainwright made their first contribution in koajs/router#254

@official-burak made their first contribution in koajs/router#246

@jonathanong made their first contribution in koajs/router#258

Full Changelog: koajs/router@v15.7.0...v15.7.1

Commits

1ae7e0c chore: patch release (#262)
a0b6b05 ci: publish to npm with trusted publishing (OIDC) (#258)
4c49637 fix: address prefix middleware review feedback (#259)
69ea5f3 fix: preserve middleware when replacing router prefixes (#257)
40399ed fix: keep nested child prefixes when converting middleware boundaries (#246)
191dc9b fix: preserve matching middleware in exclusive mode (#256)
e5146eb fix: fixes security issue; GHSA-vm89-r456-25x6 (closed) (#254)
dc28519 chore: bump deps
a404b8c chore(deps): bump js-yaml from 4.3.0 to 4.3.1
cdc44da ci: add node.js v26 to the pipeline
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @koa/router since your current version.

Updates @nestjs/common from 12.3.2 to 12.3.3

Commits

59f3379 chore(release): publish v12.3.3 release
8d9dd9d fix(deps): update dependency tslib to v2.9.1 (#18346)
8fbfa21 fix(deps): update dependency file-type to v22.3.0 (#18334)
9adef69 fix(common): strip prototype keys from values with cycles (#18340)
8609d7b fix(microservices,websockets): load with an older common (#18304)
See full diff in compare view

Updates @nestjs/core from 12.3.2 to 12.3.3

Commits

59f3379 chore(release): publish v12.3.3 release
7a3d21a fix(core): watch the response for a disconnect when the socket cannot report ...
4d892ae fix(core): share one in-flight load between concurrent lazy loads (#18371)
08bff32 fix(core): drop a middleware route an all-methods route covers (#18357)
8d9dd9d fix(deps): update dependency tslib to v2.9.1 (#18346)
aa8e61f fix(core): read optional groups and mixed segments when comparing routes (#18...
aa4d20d fix(core): load with an older common (#18348)
060fae3 perf(core): skip redundant dependency tree resets during bootstrap (#18339)
65b4c15 test(core): wait for sse output instead of a fixed delay (#18332)
4aa87ad fix(core): read the sse disconnect from the response when the socket cannot r...
Additional commits viewable in compare view

Updates @nestjs/platform-express from 12.3.2 to 12.3.3

Commits

59f3379 chore(release): publish v12.3.3 release
8d9dd9d fix(deps): update dependency tslib to v2.9.1 (#18346)
See full diff in compare view

Updates @nestjs/platform-fastify from 12.3.2 to 12.3.3

Commits

59f3379 chore(release): publish v12.3.3 release
9a47306 fix(deps): update dependency @fastify/cors to v11.4.0 (#18376)
206a5cc fix(fastify): handle file streams the parser destroys with an error (#18377)
bea3d70 fix(deps): update dependency fastify to v5.12.8 (#18367)
8d9dd9d fix(deps): update dependency tslib to v2.9.1 (#18346)
See full diff in compare view

Updates fastify from 5.12.7 to 5.12.8

Release notes

Sourced from fastify's releases.

v5.12.8

⚠️ Security Release

Fix for GHSA-3qgw-9275-xf8w

What's Changed

[Backport 5.x] fix(types): restore this context in route shorthand hooks by @github-actions[bot] in fastify/fastify#7055

[Backport 5.x] fix(reply): send stream trailers after the stream actually finishes by @github-actions[bot] in fastify/fastify#7111

[Backport 5.x] test(server): assert the server is listening instead of a literal by @github-actions[bot] in fastify/fastify#7112

[Backport 5.x] feat: add routerOptions.compile to use find-my-way compiler mode by @Tony133 in fastify/fastify#7116

[Backport 5.x] fix: clamp error statusCode between 400 and 599 with 500 fallback by @github-actions[bot] in fastify/fastify#7122

[Backport 5.x] fix: contain synchronous throws from custom content type parsers by @github-actions[bot] in fastify/fastify#7123

[Backport 5.x] docs(serverless): clarify per-route observability on serverless platf… by @github-actions[bot] in fastify/fastify#7134

[Backport 5.x] feat(hooks): support disposables in onClose hook (#5669) by @github-actions[bot] in fastify/fastify#7136

[Backport 5.x] fix(types): allow socket path strings in addresses by @github-actions[bot] in fastify/fastify#7138

[Backport 5.x] fix(types): add logSerializers to RouteShorthandOptions by @github-actions[bot] in fastify/fastify#7145

[Backport 5.x] test: do not assert a HEAD response body through inject() by @github-actions[bot] in fastify/fastify#7149

[Backport 5.x] docs(request): reorganize Request reference by properties and methods by @Tony133 in fastify/fastify#7150

[Backport 5.x] docs(reply): reorganize Reply reference by properties and methods by @Tony133 in fastify/fastify#7151

[Backport 5.x] docs: remove plugins that do not support Fastify v5 by @Tony133 in fastify/fastify#7152

[Backport 5.x] perf(request): hoist port regex to module level by @github-actions[bot] in fastify/fastify#7153

[Backport 5.x] fix(decorators): evaluate instance getters once in getDecorator by @github-actions[bot] in fastify/fastify#7154

[Backport 5.x] docs: clarify that maxParamLength does not prevent ReDoS by @github-actions[bot] in fastify/fastify#7158

[Backport 5.x] docs: fix syntax errors in code examples by @github-actions[bot] in fastify/fastify#7160

Full Changelog: fastify/fastify@v5.12.7...v5.12.8

Commits

0c7413a Bumped v5.12.8
0ffe18f test: make handlerTimeout ended-but-not-finished test deterministic
8e7c2b7 test: restore 100% coverage for handlerTimeout abort paths
15fbadf [Backport 5.x] fix: abort streaming response when handlerTimeout fires after ...
18a7049 docs: fix syntax errors in code examples (#7159)
c410867 docs: clarify that maxParamLength does not prevent ReDoS (#7140)
0fa6bc2 [Backport 5.x] fix(decorators): evaluate instance getters once in getDecorato...
0873d55 perf(request): hoist port regex to module level (#7110)
25cd11e [Backport 5.x] docs: remove plugins that do not support Fastify v5 (#7152)
d60a57b [Backport 5.x] docs(reply): reorganize Reply reference by properties and meth...
Additional commits viewable in compare view

Updates hono from 4.13.14 to 4.13.16

Release notes

Sourced from hono's releases.

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in honojs/hono#5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

What's Changed

fix(auth): escape backslashes in the WWW-Authenticate realm by @yusukebe in honojs/hono#5590

docs(contributing): drop the note about linking a fork branch by @yusukebe in honojs/hono#5593

fix(context): allow c.header() after the response body is consumed by @yusukebe in honojs/hono#5587

Full Changelog: honojs/hono@v4.13.14...v4.13.15

Commits

c91b60a 4.13.16
e1dd588 fix(jwt): reject a signature segment outside the base64url alphabet and a hea...
bf16471 Merge commit from fork
d88fab3 Merge commit from fork
34f9043 Merge commit from fork
8a103aa Merge commit from fork
15bbd96 Merge commit from fork
3cb29de 4.13.15
17ad0e2 fix(context): allow c.header() after the response body is consumed (#5587)
ee88684 docs(contributing): drop the note about linking a fork branch (#5593)
Additional commits viewable in compare view

Updates koa from 3.2.1 to 3.3.0

Release notes

Sourced from koa's releases.

v3.3.0

What's Changed

chore: Tell dependabot to update GH Actions by @olleolleolle in koajs/koa#1963

build(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in koajs/koa#1966

build(deps): bump actions/setup-node from 4 to 6 by @dependabot[bot] in koajs/koa#1965

build(deps): bump codecov/codecov-action from 5 to 6 by @dependabot[bot] in koajs/koa#1964

build(deps-dev): bump flatted from 3.3.3 to 3.4.2 by @dependabot[bot] in koajs/koa#1945

build(deps-dev): bump c8 from 10.1.3 to 11.0.0 by @dependabot[bot] in koajs/koa#1931

build(deps-dev): bump supertest from 7.1.4 to 7.2.2 by @dependabot[bot] in koajs/koa#1924

build(deps): bump type-is from 2.0.1 to 2.1.0 by @dependabot[bot] in koajs/koa#1969

build(deps): bump minimatch from 3.1.2 to 3.1.5 by @dependabot[bot] in koajs/koa#1962

fix: response content-type value amount as one with testcase by @PoChenKuo in koajs/koa#1899

docs: fix app.currentContext example (read the getter, don't assign to it) by @DucMinhNe in koajs/koa#1978

build(deps): bump codecov/codecov-action from 6 to 7 by @dependabot[bot] in koajs/koa#1979

docs: improve JSDoc parameter descriptions for Application constructor by @kshitijanurag in koajs/koa#1941

feat: re-export http-errors utilities by @nuintun in koajs/koa#1991

ci: bump node versions to 22-26 by @jonathanong in koajs/koa#1972

patch: make ctx.assert errors instanceof HttpError by @yowainwright in koajs/koa#1998

fix: parse absolute-form request targets in request.URL by @xia-chao in koajs/koa#1999

docs: point request.hostname URL link at current Node.js docs by @JiuYue0820 in koajs/koa#1994

fix(response): keep the Blob content type instead of forcing octet-stream by @spokodev in koajs/koa#1987

fix: reject multiple values for singleton response headers by @shuaiyafei in koajs/koa#2012

fix: preserve booleans when assigning query parameters by @tianrking in koajs/koa#2013

fix: prevent prototype mutation when parsing query parameters by @yowainwright in koajs/koa#2024

fix: keep prototype-based HttpError instanceof checks by @jonathanong in koajs/koa#2025

chore: minor release bump by @yowainwright in koajs/koa#2031

fix: preserve HttpError subclass instance checks by @yowainwright in koajs/koa#2033

fix: lowercase X-Forwarded-Proto in request.protocol by @jipeng6036-del in koajs/koa#2029

fix: parse IPv6 hostname from request.host by @yowainwright in koajs/koa#2034

New Contributors

@PoChenKuo made their first contribution in koajs/koa#1899

@DucMinhNe made their first contribution in koajs/koa#1978

@kshitijanurag made their first contribution in koajs/koa#1941

@nuintun made their first contribution in koajs/koa#1991

@xia-chao made their first contribution in koajs/koa#1999

@JiuYue0820 made their first contribution in koajs/koa#1994

@spokodev made their first contribution in koajs/koa#1987

@shuaiyafei made their first contribution in koajs/koa#2012

@tianrking made their first contribution in koajs/koa#2013

@jipeng6036-del made their first contribution in koajs/koa#2029

Full Changelog: koajs/koa@v3.2.1...v3.3.0

Commits

b7ead6f fix: parse IPv6 hostname from request.host (#2034)
e812c8d fix: lowercase X-Forwarded-Proto in request.protocol (#2029)
f2ec5f1 fix: preserve HttpError subclass instance checks (#2033)
927e9eb chore: minor release bump (#2031)
b786e7b fix: keep prototype-based HttpError instanceof checks (#2025)
1e31d65 fix: prevent prototype mutation when parsing query parameters (#2024)
a82feec fix: preserve booleans when assigning query parameters (#2013)
2fecd02 fix: reject multiple values for singleton response headers (#2012)
824c1cf fix(response): keep the Blob content type instead of forcing octet-stream (#1...
c3c14b6 docs: point request.hostname URL link at current Node.js docs (#1994)
Additional commits viewable in compare view

Updates openai from 7.45.1 to 7.52.0

Release notes

Sourced from openai's releases.

v7.52.0

7.52.0 (2026-11-05)

Features

api: add a model option for Responses (#3116) (c05ed3e)

Bug Fixes

deps-dev: bump follow-redirects from 1.16.0 to 1.16.2 in /ecosystem-tests/cloudflare-worker (#3113) (2d5b81c)

v7.51.0

7.51.0 (2026-11-05)

Features

api: add Australia, India, and Japan residency options (#3112) (42c31dc)

api: add GPT-6 Rosalind to the model catalog (#3109) (9854bd6)

api: add image complexity and GIF and SVG output controls (#3114) (39b724a)

api: expand agent turn errors and image and audio options (#3110) (c3f42fa)

Bug Fixes

deps-dev: bump follow-redirects from 1.16.0 to 1.16.2 in /ecosystem-tests/ts-browser-webpack (#3102) (934421d)

v7.50.0

7.50.0 (2026-11-03)

Features

api: add 12-hour Responses caching and cache-write usage (#3106) (a286400)

api: add project service tier settings (#3105) (13abd41)

Bug Fixes

deps-dev: bump puppeteer from 25.14.0 to 25.16.0 in /ecosystem-tests/ts-browser-webpack (#3100) (65095d2)

Documentation

clarify generated-file ownership (#3107) (3eb0f23)

v7.49.0

7.49.0 (2026-11-03)

... (truncated)

Changelog

Sourced from openai's changelog.

7.52.0 (2026-11-05)

Features

api: add a model option for Responses (#3116) (c05ed3e)

Bug Fixes

deps-dev: bump follow-redirects from 1.16.0 to 1.16.2 in /ecosystem-tests/cloudflare-worker (#3113) (2d5b81c)

7.51.0 (2026-11-05)

Features

api: add Australia, India, and Japan residency options (#3112) (42c31dc)

api: add GPT-6 Rosalind to the model catalog (#3109) (9854bd6)

api: add image complexity and GIF and SVG output controls (#3114) (39b724a)

api: expand agent turn errors and image and audio options (#3110) (c3f42fa)

Bug Fixes

deps-dev: bump follow-redirects from 1.16.0 to 1.16.2 in /ecosystem-tests/ts-browser-webpack (#3102) (934421d)

7.50.0 (2026-11-03)

Features

api: add 12-hour Responses caching and cache-write usage (#3106) (a286400)

api: add project service tier settings (#3105) (13abd41)

Bug Fixes

deps-dev: bump puppeteer from 25.14.0 to 25.16.0 in /ecosystem-tests/ts-browser-webpack (#3100) (65095d2)

Documentation

clarify generated-file ownership (#3107) (3eb0f23)

7.49.0 (2026-11-03)

Features

... (truncated)

Commits

5b12ca8 release: 7.52.0 (#3115)
c05ed3e feat(api): add a model option for Responses (#3116)
2d5b81c fix(deps-dev): bump follow-redirects from 1.16.0 to 1.16.2 in /ecosystem-test...
7386950 release: 7.51.0 (#3111)
39b724a feat(api): add image complexity and GIF and SVG output controls (#3114)
42c31dc feat(api): add Australia, India, and Japan residency options (#3112)
934421d fix(deps-dev): bump follow-redirects from 1.16.0 to 1.16.2 in /ecosystem-test...
9854bd6 feat(api): add GPT-6 Rosalind to the model catalog (#3109)
c3f42fa feat(api): expand agent turn errors and image and audio options (#3110)
42563fe release: 7.50.0 (#3108)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group in /sdk-node with 11 updates: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `1.3.0` | `1.6.0` | | [@fastify/swagger](https://github.com/fastify/fastify-swagger) | `9.9.2` | `9.9.3` | | [@koa/router](https://github.com/koajs/router) | `15.7.0` | `15.7.1` | | [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `12.3.2` | `12.3.3` | | [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `12.3.2` | `12.3.3` | | [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express) | `12.3.2` | `12.3.3` | | [@nestjs/platform-fastify](https://github.com/nestjs/nest/tree/HEAD/packages/platform-fastify) | `12.3.2` | `12.3.3` | | [fastify](https://github.com/fastify/fastify) | `5.12.7` | `5.12.8` | | [hono](https://github.com/honojs/hono) | `4.13.14` | `4.13.16` | | [koa](https://github.com/koajs/koa) | `3.2.1` | `3.3.0` | | [openai](https://github.com/openai/openai-node) | `7.45.1` | `7.52.0` | Updates `@anthropic-ai/sdk` from 1.3.0 to 1.6.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v1.3.0...sdk-v1.6.0) Updates `@fastify/swagger` from 9.9.2 to 9.9.3 - [Release notes](https://github.com/fastify/fastify-swagger/releases) - [Commits](fastify/fastify-swagger@v9.9.2...v9.9.3) Updates `@koa/router` from 15.7.0 to 15.7.1 - [Release notes](https://github.com/koajs/router/releases) - [Commits](koajs/router@v15.7.0...v15.7.1) Updates `@nestjs/common` from 12.3.2 to 12.3.3 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v12.3.3/packages/common) Updates `@nestjs/core` from 12.3.2 to 12.3.3 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v12.3.3/packages/core) Updates `@nestjs/platform-express` from 12.3.2 to 12.3.3 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v12.3.3/packages/platform-express) Updates `@nestjs/platform-fastify` from 12.3.2 to 12.3.3 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v12.3.3/packages/platform-fastify) Updates `fastify` from 5.12.7 to 5.12.8 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.12.7...v5.12.8) Updates `hono` from 4.13.14 to 4.13.16 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.14...v4.13.16) Updates `koa` from 3.2.1 to 3.3.0 - [Release notes](https://github.com/koajs/koa/releases) - [Changelog](https://github.com/koajs/koa/blob/master/History.md) - [Commits](koajs/koa@v3.2.1...v3.3.0) Updates `openai` from 7.45.1 to 7.52.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v7.45.1...v7.52.0) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 1.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@fastify/swagger" dependency-version: 9.9.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@koa/router" dependency-version: 15.7.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@nestjs/common" dependency-version: 12.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@nestjs/core" dependency-version: 12.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@nestjs/platform-express" dependency-version: 12.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@nestjs/platform-fastify" dependency-version: 12.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: fastify dependency-version: 5.12.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: hono dependency-version: 4.13.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: koa dependency-version: 3.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: openai dependency-version: 7.52.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-11-09T00:37:18Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
reqly	Ready	Preview	Nov 9, 2026 12:38am UTC

github-actions · 2026-11-09T00:39:20Z

⚠️ CI failed on this update, so it wasn't auto-merged. It will be listed in the weekly maintenance report.

dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 9, 2026

dependabot Bot added the javascript Pull requests that update javascript code label Nov 9, 2026

vercel Bot deployed to Preview November 9, 2026 00:38

View deployment

github-actions Bot added the needs-review Dependency update that needs a manual look label Nov 9, 2026

Navigation Menu

Repository navigation

👆 Bump the minor-and-patch group in /sdk-node with 11 updates - #73

👆 Bump the minor-and-patch group in /sdk-node with 11 updates#73
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/sdk-node/minor-and-patch-42c0174b83

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

vercel Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

sdk-v1.6.0

Features

Bug Fixes

Chores

Documentation

sdk-v1.5.0

Features

Bug Fixes

Performance Improvements

Chores

1.6.0 (2026-11-05)

Features

Bug Fixes

Chores

Documentation

1.5.0 (2026-11-04)

Features

Bug Fixes

Performance Improvements

v9.9.3

What's Changed

v15.7.1

What's Changed

New Contributors

v5.12.8

⚠️ Security Release

What's Changed

v4.13.16

Security fixes

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

validator('form') skips validation for multipart/form-data requests with extra parameters

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

csrf() does not check requests sent by hyperlink auditing (text/ping)

What's Changed

v4.13.15

What's Changed

v3.3.0

What's Changed

New Contributors

v7.52.0

7.52.0 (2026-11-05)

Features

Bug Fixes

v7.51.0

7.51.0 (2026-11-05)

Features

Bug Fixes

v7.50.0

7.50.0 (2026-11-03)

Features

Bug Fixes

Documentation

v7.49.0

7.49.0 (2026-11-03)

7.52.0 (2026-11-05)

Features

Bug Fixes

7.51.0 (2026-11-05)

Features

Bug Fixes

7.50.0 (2026-11-03)

Features

Bug Fixes

Documentation

7.49.0 (2026-11-03)

Features

Uh oh!

vercel Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

`mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix

`validator('form')` skips validation for `multipart/form-data` requests with extra parameters

`css` helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

`csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

vercel Bot commented Nov 9, 2026 •

edited

Loading