Skip to content

chore(deps): bump the production-deps group across 1 directory with 28 updates - #16

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-deps-7a4fd6d94e
Open

chore(deps): bump the production-deps group across 1 directory with 28 updates#16
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-deps-7a4fd6d94e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown

Bumps the production-deps group with 28 updates in the / directory:

Package From To
@anthropic-ai/sdk 0.52.0 0.126.0
diff 5.2.0 9.0.0
compression 1.8.1 1.8.2
cors 2.8.5 2.8.6
dotenv 16.6.1 18.0.0
express 4.21.2 5.2.1
express-rate-limit 7.5.1 8.7.0
express-validator 7.2.1 7.3.2
helmet 7.2.0 8.3.0
joi 17.13.3 18.2.9
pg 8.16.3 8.23.0
redis 4.7.1 6.2.1
uuid 9.0.1 14.0.2
winston 3.17.0 3.19.0
winston-daily-rotate-file 4.7.1 5.0.0
@grpc/grpc-js 1.13.4 1.14.5
@grpc/proto-loader 0.7.15 0.8.1
ioredis 5.6.1 6.0.0
knex 3.1.0 3.3.0
reflect-metadata 0.1.14 0.2.2
@octokit/app 16.0.1 16.1.4
@octokit/auth-app 6.1.4 8.3.1
@octokit/rest 20.1.2 22.0.1
@octokit/webhooks 12.3.2 14.2.0
convict 6.2.4 6.2.5
dotenv-expand 10.0.0 1000.0.0
zod 3.25.76 4.6.5
axios 1.11.0 1.20.0

Updates @anthropic-ai/sdk from 0.52.0 to 0.126.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.126.0

0.126.0 (2026-09-15)

Full Changelog: sdk-v0.125.0...sdk-v0.126.0

Features

  • api: add auto mode tool permissions for Managed Agents (7829b43)
  • api: add compaction parameter and signed compaction blocks (beta) (05fd878)
  • api: add enum types for workspace data-residency geo fields (89c5920)
  • api: add thinking_mismatch_allowed entries to input_transformations (beta) (1f32871)
  • api: add url_sources to the web fetch tool (ee23dd2)
  • api: add workspace_id parameter to user profiles methods (f5b9fb7)

Bug Fixes

  • api: mark usage iteration model as nullable (bec3bec)
  • api: use one input transformation type for message and delta event (e016d25)
  • client: ignore invalid Retry-After values and validate maxRetries (7829b43)
  • client: retry connection errors in the async client and stop blocking in the coroutine retry loop (7829b43)
  • client: stop waiting for a retry as soon as the request is aborted (941aaea)
  • client: use the default backoff when Retry-After is out of range (1090c44)
  • internal: stop a declaration file using a type that needs TypeScript 5.7 (e32a956)

Performance Improvements

  • add "sideEffects": false so bundlers can drop unused modules (f804366)
  • mark classes as pure so bundlers can drop unused ones (f804366)

Chores

  • docs: clarify that session_thread_id on tool use events is informational (a07ecf3)
  • docs: correct the compaction beta's parameter descriptions (eb9abd2)
  • internal: move the sub-packages off ts-node and modernise their tsconfig (1d7cd91)
  • internal: move tsconfig off settings deprecated in TypeScript 6 (e0d58f6)
  • internal: pin the pnpm version with an integrity hash (f804366)
  • internal: root package drops ts-node; repo root becomes ESM (3f371a1)
  • internal: stop using ts-node for the publish script and the ecosystem test runner (2e589c8)
  • tests: stop the mock server without failing a passing test run (a364c12)

Documentation

  • api: clarify usage.iterations entry typing under server-side fallback (c5f0ef3)
  • api: compaction instructions replace the server's summarization prompt (941aaea)
  • api: fix typo in temperature deprecation message (4a8b49b)
  • stop documenting unions with their first variant's description (fa06caf)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.126.0 (2026-09-15)

Full Changelog: sdk-v0.125.0...sdk-v0.126.0

Features

  • api: add auto mode tool permissions for Managed Agents (7829b43)
  • api: add compaction parameter and signed compaction blocks (beta) (05fd878)
  • api: add enum types for workspace data-residency geo fields (89c5920)
  • api: add thinking_mismatch_allowed entries to input_transformations (beta) (1f32871)
  • api: add url_sources to the web fetch tool (ee23dd2)
  • api: add workspace_id parameter to user profiles methods (f5b9fb7)

Bug Fixes

  • api: mark usage iteration model as nullable (bec3bec)
  • api: use one input transformation type for message and delta event (e016d25)
  • client: ignore invalid Retry-After values and validate maxRetries (7829b43)
  • client: retry connection errors in the async client and stop blocking in the coroutine retry loop (7829b43)
  • client: stop waiting for a retry as soon as the request is aborted (941aaea)
  • client: use the default backoff when Retry-After is out of range (1090c44)
  • internal: stop a declaration file using a type that needs TypeScript 5.7 (e32a956)

Performance Improvements

  • add "sideEffects": false so bundlers can drop unused modules (f804366)
  • mark classes as pure so bundlers can drop unused ones (f804366)

Chores

  • docs: clarify that session_thread_id on tool use events is informational (a07ecf3)
  • docs: correct the compaction beta's parameter descriptions (eb9abd2)
  • internal: move the sub-packages off ts-node and modernise their tsconfig (1d7cd91)
  • internal: move tsconfig off settings deprecated in TypeScript 6 (e0d58f6)
  • internal: pin the pnpm version with an integrity hash (f804366)
  • internal: root package drops ts-node; repo root becomes ESM (3f371a1)
  • internal: stop using ts-node for the publish script and the ecosystem test runner (2e589c8)
  • tests: stop the mock server without failing a passing test run (a364c12)

Documentation

  • api: clarify usage.iterations entry typing under server-side fallback (c5f0ef3)
  • api: compaction instructions replace the server's summarization prompt (941aaea)
  • api: fix typo in temperature deprecation message (4a8b49b)
  • stop documenting unions with their first variant's description (fa06caf)

... (truncated)

Commits
  • d103182 Merge pull request #1200 from anthropics/release-please--branches--main--chan...
  • 39273d1 chore: release main
  • eb9abd2 chore(docs): correct the compaction beta's parameter descriptions
  • 05fd878 feat(api): add compaction parameter and signed compaction blocks (beta)
  • e0d58f6 chore(internal): move tsconfig off settings deprecated in TypeScript 6
  • e016d25 fix(api): use one input transformation type for message and delta event
  • 1d7cd91 chore(internal): move the sub-packages off ts-node and modernise their tsconfig
  • ee23dd2 feat(api): add url_sources to the web fetch tool
  • a364c12 chore(tests): stop the mock server without failing a passing test run
  • 1f32871 feat(api): add thinking_mismatch_allowed entries to input_transformations (beta)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.


Updates diff from 5.2.0 to 9.0.0

Changelog

Sourced from diff's changelog.

9.0.0

(All changes part of PR #672.)

  • ES5 support is dropped. parsePatch now uses TextDecoder and Uint8Array, which are not available in ES5, and TypeScript is now compiled with the "es6" target. From now on, I intend to freely use any features that are deemed "Widely available" by Baseline. Users who need ES5 support should stick to version 8.

  • C-style quoted strings in filename headers are now properly supported.

    When the name of either the old or new file in a patch contains "special characters", both GNU diff and Git quote the filename in the patch's headers and escape special characters using the same escape sequences that are used in string literals in C, including octal escapes for all non-ASCII characters. Previously, jsdiff had very little support for this; parsePatch would remove the quotes, and unescape any escaped backslashes, but would not unescape other escape sequences. formatPatch, meanwhile, did not quote or escape special characters at all.

    Now, parsePatch parses all the possible escape sequences that GNU diff (or Git) ever output, and formatPatch quotes and escapes filenames containing special characters in the same way GNU diff does.

  • formatPatch now omits file headers when oldFileName or newFileName in the provided patch object are undefined, regardless of the headerOptions parameter. (Previously, it would treat the absence of oldFileName or newFileName as indicating the filename was the word "undefined" and emit headers --- undefined / +++ undefined.)

  • formatPatch no longer outputs trailing tab characters at the end of ---/+++ headers.

    Previously, if formatPatch was passed a patch object to serialize that had empty strings for the oldHeader or newHeader property, it would include a trailing tab character after the filename in the --- and/or +++ file header. Now, this scenario is treated the same as when oldHeader/newHeader is undefined - i.e. the trailing tab is omitted.

  • formatPatch no longer mutates its input when serializing a patch containing a hunk where either the old or new content contained zero lines. (Such a hunk occurs only when the hunk has no context lines and represents a pure insertion or pure deletion, which for instance will occur whenever one of the two files being diffed is completely empty.) Previously formatPatch would provide the correct output but also mutate the oldLines or newLines property on the hunk, changing the meaning of the underlying patch.

  • Git-style patches are now supported by parsePatch, formatPatch, and reversePatch.

    Patches output by git diff can include some features that are unlike those output by GNU diff, and therefore not handled by an ordinary unified diff format parser. An ordinary diff simply describes the differences between the content of two files, but Git diffs can also indicate, via "extended headers", the creation or deletion of (potentially empty) files, indicate that a file was renamed, and contain information about file mode changes. Furthermore, when these changes appear in a diff in the absence of a content change (e.g. when an empty file is created, or a file is renamed without content changes), the patch will contain no associated ---/+++ file headers nor any hunks.

    jsdiff previously did not support parsing Git's extended headers, nor hunkless patches. Now parsePatch parses some of the extended headers, parses hunkless Git patches, and can determine filenames (e.g. from the extended headers) when parsing a patch that includes no --- or +++ file headers. The additional information conveyed by the extended headers we support is recorded on new fields on the result object returned by parsePatch. See isGit and subsequent properties in the docs in the README.md file.

    formatPatch now outputs extended headers based on these new Git-specific properties, and reversePatch respects them as far as possible (with one unavoidable caveat noted in the README.md file).

  • Unpaired file headers now cause parsePatch to throw.

    It remains acceptable to have a patch with no file headers whatsoever (e.g. one that begins with a @@ hunk header on the very first line), but a patch with only a --- header or only a +++ header is now considered an error.

  • parsePatch is now more tolerant of "trailing garbage"

    That is: after a patch, or between files/indexes in a patch, it is now acceptable to have arbitrary lines of "garbage" (so long as they unambiguously have no syntactic meaning - e.g. trailing garbage that leads with a +, -, or and thus is interpretable as part of a hunk still triggers a throw).

    This means we no longer reject patches output by tools that include extra data in "garbage" lines not understood by generic unified diff parsers. (For example, SVN patches can include "Property changes on:" lines that generic unified diff parsers should discard as garbage; jsdiff previously threw errors when encountering them.)

    This change brings jsdiff's behaviour more in line with GNU patch, which is highly permissive of "garbage".

  • The oldFileName and newFileName fields of StructuredPatch are now typed as string | undefined instead of string. This type change reflects the (pre-existing) reality that parsePatch can produce patches without filenames (e.g. when parsing a patch that simply contains hunks with no file headers).

8.0.4

  • #667 - fix another bug in diffWords when used with an Intl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space), diffWords would previously crash. Now this case is handled correctly.

8.0.3

  • #631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).
  • #635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.

... (truncated)

Commits

Updates compression from 1.8.1 to 1.8.2

Release notes

Sourced from compression's releases.

v1.8.2

Important

What's Changed

New Contributors

Full Changelog: expressjs/compression@v1.8.1...v1.8.2

Changelog

Sourced from compression's changelog.

1.8.2

Commits
  • 0f97074 1.8.2 (#287)
  • 151f63e fix: destroy compression stream on response close
  • 0a76495 fix: match Cache-Control no-transform directive case-insensitively (#286)
  • c17b6e5 docs: update outdated Brotli note and fix npm install docs URL (#276)
  • 112911a chore(ci): npm-publish via reusable workflows (#269)
  • 1bf5eb0 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#267)
  • d8fe64d build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#266)
  • b218ff5 build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (#265)
  • 8a1cf8e build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#268)
  • 4a19855 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#257)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compression since your current version.


Updates cors from 2.8.5 to 2.8.6

Release notes

Sourced from cors's releases.

v2.8.6

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from cors's changelog.

2.8.6 / 2026-01-22

  • Improve documentation (API, context, examples...)
  • Remove additional markdown files from tarball
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for cors since your current version.


Updates dotenv from 16.6.1 to 18.0.0

Changelog

Sourced from dotenv's changelog.

18.0.0 (2026-09-17)

Added

  • NEW: Dotenv now has a CLI. (#1022)
$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv
  • NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)
$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

Changed

  • Injecting message sent to stderr rather than stdout and tips removed (#1037)

Removed

  • Remove tips (#1031)
  • Remove skill files (#1032)
  • Remove Spanish README (#1034)
  • Remove .env.vault support (#1033)
  • Remove preloading. Instead use cli dotenv run -- your-command (#1035)

17.4.2 (2026-04-12)

Changed

  • Improved skill files - tightened up details (#1009)

17.4.1 (2026-04-05)

Changed

  • Change text injecting to injected (#1005)

17.4.0 (2026-04-01)

Added

  • Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

... (truncated)

Commits

Updates express from 4.21.2 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

@dependabot
chore(deps): bump the production-deps group across 1 directory with 2…
0e25c5e 
…8 updates

Bumps the production-deps group with 28 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.52.0` | `0.126.0` |
| [diff](https://github.com/kpdecker/jsdiff) | `5.2.0` | `9.0.0` |
| [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` |
| [cors](https://github.com/expressjs/cors) | `2.8.5` | `2.8.6` |
| [dotenv](https://github.com/motdotla/dotenv) | `16.6.1` | `18.0.0` |
| [express](https://github.com/expressjs/express) | `4.21.2` | `5.2.1` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `7.5.1` | `8.7.0` |
| [express-validator](https://github.com/express-validator/express-validator) | `7.2.1` | `7.3.2` |
| [helmet](https://github.com/helmetjs/helmet) | `7.2.0` | `8.3.0` |
| [joi](https://github.com/hapijs/joi) | `17.13.3` | `18.2.9` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.16.3` | `8.23.0` |
| [redis](https://github.com/redis/node-redis) | `4.7.1` | `6.2.1` |
| [uuid](https://github.com/uuidjs/uuid) | `9.0.1` | `14.0.2` |
| [winston](https://github.com/winstonjs/winston) | `3.17.0` | `3.19.0` |
| [winston-daily-rotate-file](https://github.com/winstonjs/winston-daily-rotate-file) | `4.7.1` | `5.0.0` |
| [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.13.4` | `1.14.5` |
| [@grpc/proto-loader](https://github.com/grpc/grpc-node) | `0.7.15` | `0.8.1` |
| [ioredis](https://github.com/redis/ioredis) | `5.6.1` | `6.0.0` |
| [knex](https://github.com/knex/knex) | `3.1.0` | `3.3.0` |
| [reflect-metadata](https://github.com/rbuckton/reflect-metadata) | `0.1.14` | `0.2.2` |
| [@octokit/app](https://github.com/octokit/app.js) | `16.0.1` | `16.1.4` |
| [@octokit/auth-app](https://github.com/octokit/auth-app.js) | `6.1.4` | `8.3.1` |
| [@octokit/rest](https://github.com/octokit/rest.js) | `20.1.2` | `22.0.1` |
| [@octokit/webhooks](https://github.com/octokit/webhooks.js) | `12.3.2` | `14.2.0` |
| [convict](https://github.com/mozilla/node-convict) | `6.2.4` | `6.2.5` |
| [dotenv-expand](https://github.com/dotenvx/dotenv-expand) | `10.0.0` | `1000.0.0` |
| [zod](https://github.com/colinhacks/zod) | `3.25.76` | `4.6.5` |
| [axios](https://github.com/axios/axios) | `1.11.0` | `1.20.0` |



Updates `@anthropic-ai/sdk` from 0.52.0 to 0.126.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.52.0...sdk-v0.126.0)

Updates `diff` from 5.2.0 to 9.0.0
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v5.2.0...v9.0.0)

Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](expressjs/compression@v1.8.1...v1.8.2)

Updates `cors` from 2.8.5 to 2.8.6
- [Release notes](https://github.com/expressjs/cors/releases)
- [Changelog](https://github.com/expressjs/cors/blob/master/HISTORY.md)
- [Commits](expressjs/cors@v2.8.5...v2.8.6)

Updates `dotenv` from 16.6.1 to 18.0.0
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v16.6.1...v18.0.0)

Updates `express` from 4.21.2 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@4.21.2...v5.2.1)

Updates `express-rate-limit` from 7.5.1 to 8.7.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.7.0)

Updates `express-validator` from 7.2.1 to 7.3.2
- [Release notes](https://github.com/express-validator/express-validator/releases)
- [Commits](express-validator/express-validator@v7.2.1...v7.3.2)

Updates `helmet` from 7.2.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v7.2.0...v8.3.0)

Updates `joi` from 17.13.3 to 18.2.9
- [Commits](hapijs/joi@v17.13.3...v18.2.9)

Updates `pg` from 8.16.3 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `redis` from 4.7.1 to 6.2.1
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@4.7.1...redis@6.2.1)

Updates `uuid` from 9.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v9.0.1...v14.0.2)

Updates `winston` from 3.17.0 to 3.19.0
- [Release notes](https://github.com/winstonjs/winston/releases)
- [Changelog](https://github.com/winstonjs/winston/blob/master/CHANGELOG.md)
- [Commits](winstonjs/winston@v3.17.0...v3.19.0)

Updates `winston-daily-rotate-file` from 4.7.1 to 5.0.0
- [Release notes](https://github.com/winstonjs/winston-daily-rotate-file/releases)
- [Changelog](https://github.com/winstonjs/winston-daily-rotate-file/blob/master/CHANGELOG.md)
- [Commits](winstonjs/winston-daily-rotate-file@v4.7.1...v5.0.0)

Updates `@grpc/grpc-js` from 1.13.4 to 1.14.5
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.13.4...@grpc/grpc-js@1.14.5)

Updates `@grpc/proto-loader` from 0.7.15 to 0.8.1
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/proto-loader@0.7.15...@grpc/proto-loader@0.8.1)

Updates `ioredis` from 5.6.1 to 6.0.0
- [Release notes](https://github.com/redis/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.6.1...v6.0.0)

Updates `knex` from 3.1.0 to 3.3.0
- [Release notes](https://github.com/knex/knex/releases)
- [Changelog](https://github.com/knex/knex/blob/master/CHANGELOG.md)
- [Commits](knex/knex@3.1.0...3.3.0)

Updates `reflect-metadata` from 0.1.14 to 0.2.2
- [Release notes](https://github.com/rbuckton/reflect-metadata/releases)
- [Commits](https://github.com/rbuckton/reflect-metadata/commits)

Updates `@octokit/app` from 16.0.1 to 16.1.4
- [Release notes](https://github.com/octokit/app.js/releases)
- [Commits](octokit/app.js@v16.0.1...v16.1.4)

Updates `@octokit/auth-app` from 6.1.4 to 8.3.1
- [Release notes](https://github.com/octokit/auth-app.js/releases)
- [Commits](octokit/auth-app.js@v6.1.4...v8.3.1)

Updates `@octokit/rest` from 20.1.2 to 22.0.1
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](octokit/rest.js@v20.1.2...v22.0.1)

Updates `@octokit/webhooks` from 12.3.2 to 14.2.0
- [Release notes](https://github.com/octokit/webhooks.js/releases)
- [Commits](octokit/webhooks.js@v12.3.2...v14.2.0)

Updates `convict` from 6.2.4 to 6.2.5
- [Changelog](https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md)
- [Commits](mozilla/node-convict@v6.2.4...v6.2.5)

Updates `dotenv-expand` from 10.0.0 to 1000.0.0
- [Changelog](https://github.com/dotenvx/dotenv-expand/blob/master/CHANGELOG.md)
- [Commits](dotenvx/dotenv-expand@v10.0.0...v1000.0.0)

Updates `zod` from 3.25.76 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.25.76...v4.6.5)

Updates `axios` from 1.11.0 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.11.0...v1.20.0)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.126.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: diff
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: cors
  dependency-version: 2.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: dotenv
  dependency-version: 18.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: express-rate-limit
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: express-validator
  dependency-version: 7.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: joi
  dependency-version: 18.2.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: redis
  dependency-version: 6.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: winston
  dependency-version: 3.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: winston-daily-rotate-file
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: "@grpc/grpc-js"
  dependency-version: 1.14.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@grpc/proto-loader"
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: ioredis
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: knex
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: reflect-metadata
  dependency-version: 0.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@octokit/app"
  dependency-version: 16.1.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@octokit/auth-app"
  dependency-version: 8.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: "@octokit/rest"
  dependency-version: 22.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: "@octokit/webhooks"
  dependency-version: 14.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: convict
  dependency-version: 6.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: dotenv-expand
  dependency-version: 1000.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants