chore(deps): bump the backend-minor-patch group in /backend with 8 updates by dependabot[bot] · Pull Request #1005 · FinChippay/Finchippay-Solution

dependabot · 2026-09-14T09:47:28Z

Bumps the backend-minor-patch group in /backend with 8 updates:

Package	From	To
@opentelemetry/auto-instrumentations-node	`0.78.0`	`0.80.0`
@opentelemetry/sdk-node	`0.220.0`	`0.222.0`
@sentry/node	`10.69.0`	`10.74.0`
axios	`1.18.0`	`1.20.0`
morgan	`1.12.0`	`1.12.1`
pg	`8.22.0`	`8.23.0`
jest	`30.3.0`	`30.5.1`
nock	`14.0.15`	`14.0.17`

Updates @opentelemetry/auto-instrumentations-node from 0.78.0 to 0.80.0

Release notes

Sourced from @opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.80.0

0.80.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.76.0 to ^0.77.0

@opentelemetry/instrumentation-bunyan bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-connect bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-cucumber bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-dataloader bumped from ^0.38.0 to ^0.39.0

@opentelemetry/instrumentation-dns bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-express bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-fs bumped from ^0.40.0 to ^0.41.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-graphql bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-hapi bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.4.0 to ^0.5.0

@opentelemetry/instrumentation-ioredis bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.30.0 to ^0.31.0

@opentelemetry/instrumentation-knex bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-koa bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-memcached bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-mongodb bumped from ^0.74.0 to ^0.75.0

@opentelemetry/instrumentation-mongoose bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-mysql bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-net bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-openai bumped from ^0.19.0 to ^0.20.0

@opentelemetry/instrumentation-oracledb bumped from ^0.46.0 to ^0.47.0

@opentelemetry/instrumentation-pg bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-pino bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-redis bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-restify bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-router bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.34.0 to ^0.35.0

@opentelemetry/instrumentation-socket.io bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-tedious bumped from ^0.40.0 to ^0.41.0

... (truncated)

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.80.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.76.0 to ^0.77.0

@opentelemetry/instrumentation-bunyan bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-connect bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-cucumber bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-dataloader bumped from ^0.38.0 to ^0.39.0

@opentelemetry/instrumentation-dns bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-express bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-fs bumped from ^0.40.0 to ^0.41.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-graphql bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-hapi bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.4.0 to ^0.5.0

@opentelemetry/instrumentation-ioredis bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.30.0 to ^0.31.0

@opentelemetry/instrumentation-knex bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-koa bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-memcached bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-mongodb bumped from ^0.74.0 to ^0.75.0

@opentelemetry/instrumentation-mongoose bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-mysql bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-net bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-openai bumped from ^0.19.0 to ^0.20.0

@opentelemetry/instrumentation-oracledb bumped from ^0.46.0 to ^0.47.0

@opentelemetry/instrumentation-pg bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-pino bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-redis bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-restify bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-router bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.34.0 to ^0.35.0

@opentelemetry/instrumentation-socket.io bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-tedious bumped from ^0.40.0 to ^0.41.0

@opentelemetry/instrumentation-undici bumped from ^0.31.0 to ^0.32.0

... (truncated)

Commits

932fc96 chore: release main (#3638)
015582a feat(deps): update deps matching '@opentelemetry/*' (#3716)
27e172a chore: release main (#3596)
466d5de feat(deps): update deps matching '@opentelemetry/*' (#3629)
b7efd7b chore(*): migrate to sdk-trace (#3599)
3ae8a1b fix(auto-instrumentations-node): avoid duplicate diag logger warning in regis...
See full diff in compare view

Updates @opentelemetry/sdk-node from 0.220.0 to 0.222.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates @sentry/node from 10.69.0 to 10.74.0

Release notes

Sourced from @sentry/node's releases.

10.74.0

feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)

fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)

fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)

fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)

fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)

fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)

fix(v10/core): Resolve MCP capture policy per operation (#23796)

fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)

fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)

fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)

fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)

fix(v10/profiling-node): Bump @sentry/node-cpu-profiler to 2.4.4 (#24238)

fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)

fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)

fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)

test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @halillusion and @zkasuran. Thank you for your contributions!

Bundle size 📦

Path Size

@sentry/browser 27.12 KB

@sentry/browser - with treeshaking flags 25.59 KB

@sentry/browser (incl. Tracing) 45.53 KB

@sentry/browser (incl. Tracing + Span Streaming) 47.29 KB

@sentry/browser (incl. Tracing, Profiling) 50.18 KB

@sentry/browser (incl. Tracing, Replay) 83.87 KB

@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.74 KB

@sentry/browser (incl. Tracing, Replay with Canvas) 88.49 KB

@sentry/browser (incl. Tracing, Replay, Feedback) 100.82 KB

@sentry/browser (incl. Feedback) 43.89 KB

@sentry/browser (incl. sendFeedback) 31.8 KB

@sentry/browser (incl. FeedbackAsync) 36.82 KB

@sentry/browser (incl. Metrics) 28.19 KB

@sentry/browser (incl. Logs) 28.41 KB

@sentry/browser (incl. Metrics & Logs) 29.09 KB

@sentry/react 28.89 KB

@sentry/react (incl. Tracing) 47.74 KB

@sentry/vue 32.42 KB

@sentry/vue (incl. Tracing) 47.47 KB

@sentry/svelte 27.15 KB

... (truncated)

Changelog

Sourced from @sentry/node's changelog.

10.74.0

feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)

fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)

fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)

fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)

fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)

fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)

fix(v10/core): Resolve MCP capture policy per operation (#23796)

fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)

fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)

fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)

fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)

fix(v10/profiling-node): Bump @sentry/node-cpu-profiler to 2.4.4 (#24238)

fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)

fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)

fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)

test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @halillusion and @zkasuran. Thank you for your contributions!

10.73.0

Important Changes
feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.
// next.config.mjs
- import { withSentryConfig } from '@sentry/nextjs';
+ import { withSentryConfig } from '@sentry/nextjs/config';
Other Changes

feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)

fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)

test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

... (truncated)

Commits

ce5009a release: 10.74.0
4b24ddd meta(changelog): Update changelog for 10.74.0 (#24252)
371ed5d fix(v10/profiling-node): Bump @sentry/node-cpu-profiler to 2.4.4 (#24238)
9f38e48 fix(v10/browser): Set user_agent.original on all spans for consistent filte...
264f990 fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entr...
c89f6e6 fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundl...
de25dcb fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
b627037 feat(v10): Streamline isolation scope handling & reset in isolation scopes (#...
2ce0ea1 fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute f...
3e0eccc fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (...
Additional commits viewable in compare view

Updates axios from 1.18.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

... (truncated)

Commits

84a9f3b chore(release): prepare release 1.20.0 (#11152)
e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
d19040b fix: harden runtime option handling (#11141)
e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
ba98559 docs: add ScrapingBee sponsor (#11137)
Additional commits viewable in compare view

Updates morgan from 1.12.0 to 1.12.1

Release notes

Sourced from morgan's releases.

1.12.1

Important

Security fix for CVE-2026-87859 (GHSA-9f6g-j8ch-79g4)

What's Changed

docs: fix typos across documentation by @vaibhavmashal in expressjs/morgan#378

test: run CI on Windows and macOS by @kilisamemarisaaa in expressjs/morgan#379

build(deps): bump github/codeql-action/upload-sarif to 4.37.9 by @dependabot[bot] in expressjs/morgan#381

build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.37.9 by @dependabot[bot] in expressjs/morgan#382

build(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 by @dependabot[bot] in expressjs/morgan#383

build(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 by @dependabot[bot] in expressjs/morgan#384

1.12.1 by @UlisesGascon in expressjs/morgan#386

New Contributors

@vaibhavmashal made their first contribution in expressjs/morgan#378

@kilisamemarisaaa made their first contribution in expressjs/morgan#379

Full Changelog: expressjs/morgan@1.12.0...1.12.1

Changelog

Sourced from morgan's changelog.

1.12.1

Security fix for CVE-2026-87859(GHSA-9f6g-j8ch-79g4)

Commits

b1272e7 1.12.1 (#386)
4b695ed fix: escape double quotes in log fields
0f74eca build(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#384)
e399e3c build(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#383)
1e86b34 build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.37.9 (#382)
87c0afd build(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#381)
286b000 test: run CI on Windows and macOS (#379)
5a5902a docs: fix typos across documentation (#378)
See full diff in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

Add support for query pipelineing.

Commits

df274d1 Publish
eb19d0f Add opt-in query pipelining (#3652)
See full diff in compare view

Updates jest from 30.3.0 to 30.5.1

Release notes

Sourced from jest's releases.

v30.5.1

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)

[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)

[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)

[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)

[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

@HuzaifaChaudary made their first contribution in jestjs/jest#16413

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴

This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @timkindberg (#16053):
const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
fn.whenCalledWith('banana').mockReturnValue('yellow');
fn.whenCalledWith(expect.any(Number)).mockReturnValue('numeric');
fn('apple'); // 'red'
fn('banana'); // 'yellow'
fn(42); // 'numeric'
fn('grape'); // undefined
The returned object is a real Mock, so mockReturnValueOnce, mockResolvedValue, mockImplementation etc. all chain here too. Argument slots accept literals or any asymmetric matcher, with the same equality semantics as toHaveBeenCalledWith(). Calls that match nothing fall through to the base mock. See the Mock Functions docs for matching and precedence details.

Describe-level retries

jest.retryTimes() can now retry a whole describe block instead of a single test, contributed by @soltonigiri (#16322). Each attempt reruns the block's beforeAll/afterAll hooks, child tests and nested describes, which helps when tests in a block depend on shared state:
</tr></table> 

... (truncated)

Changelog

Sourced from jest's changelog.

30.5.1

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)

[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)

[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)

[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)

[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JE... Description has been truncated

Bumps the backend-minor-patch group in /backend with 8 updates: | Package | From | To | | --- | --- | --- | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.78.0` | `0.80.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.222.0` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.69.0` | `10.74.0` | | [axios](https://github.com/axios/axios) | `1.18.0` | `1.20.0` | | [morgan](https://github.com/expressjs/morgan) | `1.12.0` | `1.12.1` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.3.0` | `30.5.1` | | [nock](https://github.com/nock/nock) | `14.0.15` | `14.0.17` | Updates `@opentelemetry/auto-instrumentations-node` from 0.78.0 to 0.80.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.80.0/packages/auto-instrumentations-node) Updates `@opentelemetry/sdk-node` from 0.220.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.222.0) Updates `@sentry/node` from 10.69.0 to 10.74.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.74.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.69.0...10.74.0) Updates `axios` from 1.18.0 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.18.0...v1.20.0) Updates `morgan` from 1.12.0 to 1.12.1 - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.12.0...1.12.1) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) Updates `jest` from 30.3.0 to 30.5.1 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.1/packages/jest) Updates `nock` from 14.0.15 to 14.0.17 - [Release notes](https://github.com/nock/nock/releases) - [Changelog](https://github.com/nock/nock/blob/main/CHANGELOG.md) - [Commits](nock/nock@v14.0.15...v14.0.17) --- updated-dependencies: - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.80.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.222.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: "@sentry/node" dependency-version: 10.74.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: morgan dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-minor-patch - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: jest dependency-version: 30.5.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: backend-minor-patch - dependency-name: nock dependency-version: 14.0.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: backend-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-14T09:47:29Z

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-09-14T09:50:59Z

🤖 Greptile AI Code Review

Greptile will automatically review this PR (2 file(s) changed).

Review gates:

✅ CodeQL Security Scan
✅ Custom rules (.greptile/config.json)
✅ Architecture guidelines (.greptile/rules.md)

To manually trigger a re-review, comment @greptileai on this PR.
To skip review, add the skip-review label.

dependabot Bot added backend Express backend issues dependencies dependencies security Security-related issues labels Sep 14, 2026

github-actions Bot added the needs-review PR ready for Greptile AI code review label Sep 14, 2026

Navigation Menu

Uh oh!

chore(deps): bump the backend-minor-patch group in /backend with 8 updates - #1005

chore(deps): bump the backend-minor-patch group in /backend with 8 updates#1005
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-minor-patch-0389aa70c5

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Path	Size
`@sentry/browser`	27.12 KB
`@sentry/browser` - with treeshaking flags	25.59 KB
`@sentry/browser` (incl. Tracing)	45.53 KB
`@sentry/browser` (incl. Tracing + Span Streaming)	47.29 KB
`@sentry/browser` (incl. Tracing, Profiling)	50.18 KB
`@sentry/browser` (incl. Tracing, Replay)	83.87 KB
`@sentry/browser` (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
`@sentry/browser` (incl. Tracing, Replay with Canvas)	88.49 KB
`@sentry/browser` (incl. Tracing, Replay, Feedback)	100.82 KB
`@sentry/browser` (incl. Feedback)	43.89 KB
`@sentry/browser` (incl. sendFeedback)	31.8 KB
`@sentry/browser` (incl. FeedbackAsync)	36.82 KB
`@sentry/browser` (incl. Metrics)	28.19 KB
`@sentry/browser` (incl. Logs)	28.41 KB
`@sentry/browser` (incl. Metrics & Logs)	29.09 KB
`@sentry/react`	28.89 KB
`@sentry/react` (incl. Tracing)	47.74 KB
`@sentry/vue`	32.42 KB
`@sentry/vue` (incl. Tracing)	47.47 KB
`@sentry/svelte`	27.15 KB

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026

auto-instrumentations-node: v0.80.0

0.80.0 (2026-08-31)

Features

Dependencies

0.80.0 (2026-08-31)

Features

Dependencies

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

10.74.0

Bundle size 📦

10.74.0

10.73.0

Important Changes

Other Changes

v1.20.0 — August 19, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.19.0 - July 22, 2026

🔒 Security Fixes

Changelog

v1.19.0 — July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

1.12.1

Important

What's Changed

New Contributors

1.12.1

pg@8.23.0

v30.5.1

Fixes

Chore & Maintenance

New Contributors

v30.5.0

Highlights

whenCalledWith

Describe-level retries

30.5.1

Fixes

Chore & Maintenance

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Labels

Uh oh!

github-actions Bot commented Sep 14, 2026

🤖 Greptile AI Code Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`whenCalledWith`