Skip to content

build(deps): bump the all-dependencies group across 1 directory with 19 updates - #849

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/all-dependencies-cc04166c4e
Closed

build(deps): bump the all-dependencies group across 1 directory with 19 updates#849
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/all-dependencies-cc04166c4e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the all-dependencies group with 18 updates in the /backend directory:

Package From To
@stellar/stellar-sdk 14.5.0 16.2.0
better-sqlite3 12.6.2 13.0.3
dotenv 17.3.1 17.4.2
express 4.22.1 5.2.1
express-rate-limit 7.5.1 8.6.2
ioredis 5.11.1 6.0.0
p-limit 4.0.0 7.3.1
pino 9.14.0 10.3.1
ws 8.21.1 8.21.2
zod 4.3.6 4.4.3
@types/better-sqlite3 7.6.13 9.6.0
@types/node 24.12.0 26.1.2
@types/pg 8.20.0 8.20.4
@types/supertest 6.0.3 7.2.1
@vitest/coverage-v8 1.6.1 4.1.10
typescript 5.9.3 7.0.2
typescript-eslint 8.65.0 8.66.0
vitest 1.6.1 4.1.10

Updates @stellar/stellar-sdk from 14.5.0 to 16.2.0

Release notes

Sourced from @​stellar/stellar-sdk's releases.

v16.2.0

v16.2.0

Added

  • rpc.Server.simulateTransaction accepts an optional useUpgradedAuth flag, and contract.AssembledTransaction accepts it as a method option (useUpgradedAuth) or per-call (tx.simulate({ useUpgradedAuth: true })). When set, RPC simulation records v2 address credentials (CAP-71) instead of the legacy v1 credentials. It only affects the recording auth modes and is silently ignored on hosts that cannot emit v2 credentials. The flag is deprecated from the start: it is transitional and becomes a no-op once the network returns v2 credentials by default (protocol 28) (#1562).
  • @stellar/stellar-sdk/base subpath export: import offline primitives like StrKey and Keypair without loading Horizon, RPC, or the SEP helpers and their networking dependencies (#1550).
  • authorizeEntry / authorizeInvocation signing callbacks now receive the 32-byte signing payload (hash(preimage.toXDR())) as a second argument alongside the preimage, so signers — including HSMs and remote signers that only accept a digest — never have to re-derive it. Existing single-argument callbacks are unaffected (#1532).
  • authorizeEntry / authorizeInvocation now support non-Ed25519 signers: the signing callback may return { signatureScVal: xdr.ScVal, address?: string }, and the given ScVal is written verbatim as the credentials' signature — no Ed25519 verification, no {public_key, signature} map, no scvVec wrapping. This lets smart-wallet / custom-account contracts (whose __check_auth expects its own signature structure) use the helper instead of hand-rolling preimage construction and credential assembly. The optional address routes the signature to a specific credential node, like forAddress (#1530).
  • contract.Signer: an interface pairing an address with the SEP-43 signTransaction and optional signAuthEntry methods, plus contract.KeypairSigner, a Keypair-backed implementation. The signTransaction and signAuthEntry options — on ClientOptions, MethodOptions, and AssembledTransaction's sign / signAndSend / signAuthEntries — now accept a Signer or a bare Keypair in addition to a callback. Adds the contract.SignTransactionLike and contract.SignAuthEntryLike types. When signAuthEntries gets a Signer or Keypair, its default target address is now the signer's own address rather than publicKey. Existing callbacks work unchanged; one type-only caveat: the option fields are no longer plain function types, so derive callback shapes from contract.SignTransaction / contract.SignAuthEntry instead of the option field (#1567).
  • contract.Spec now reads SEP-48 event declarations: events() and findEvent(name, occurrence?) list a contract's declared events, parseEvent(topics, data) decodes a fired event into { name, data }, with topic-carried params merged into data (returns undefined when nothing matches), and eventTopicFilter(name, topicValues?, occurrence?) builds a getEvents filter row, with "*" for any topic param left unset. Generated client bindings gain a typed <Name>Event interface per event, a ContractEvent union, a parseEvent() method, and per-event <name>EventFilter() methods. A contract may declare the same event name more than once (composed modules each emitting their own transfer); each declaration gets its own interface and filter method, and occurrence — a 0-based index in declaration order — selects among them. Generated names receive a numeric suffix when needed to avoid a collision, and stellar-sdk bindings warns about duplicate declarations and renames. Adds the contract.ParsedEvent type (#1556, #1565, #1572).

Fixed

  • Spec.scValToNative now handles contract values typed as Val (scSpecTypeVal) by delegating to the generic scValToNative converter, mirroring the encoding-side support added in #1485. Decoding a response containing a Val-typed string, symbol, vec, or map — e.g. a struct with a Vec<Val> field — no longer throws ScSpecType scSpecTypeVal was not string or symbol; each value decodes to its natural native representation (Address → string, u32 → number, Symbol → string, vecs/maps recurse). (#1551)

Full Changelog: stellar/js-stellar-sdk@v16.1.0...v16.2.0

v16.1.0

v16.1.0

Added

  • inspectAuthEntry(entry): decodes a xdr.SorobanAuthorizationEntry into a typed summary — credential type, authorizing address, nonce, signatureExpirationLedger, and a signers list covering top-level credentials and CAP-71 delegates. Adds the AuthEntryInfo, AuthEntrySigner, AuthEntrySignature, and AuthEntryCredentialType types (#1529).
  • checkAuthEntryReadiness(entry, currentLedgerSeq): reports whether an auth entry is ready to submit — { ready, expired, unsignedBy } — as a pure decode with no network call (#1529).
  • Spec.nativeToScVal now supports contract parameters typed as Val (scSpecTypeVal), so raw JS values can be passed to Val-typed arguments without building xdr.ScVal objects by hand (#1485).
  • rpc.Server.queryContract<T>(contractId, method, args?, networkPassphrase?): a one-line read-only contract call that returns { result, isReadCall }, no transaction assembly or signing. Works for Wasm contracts and built-in Stellar Asset Contracts (SACs) (#1502).
  • rpc.Server.getContractMethods(contractId, networkPassphrase?): lists a contract's callable methods and their signatures. Adds the Api.ContractMethod and Api.ContractMethodInput types (#1502).
  • rpc.Server.getContractInstance(contractId): returns a contract's xdr.ScContractInstance (#1501).
  • contract.Client.from, fromWasm, and fromWasmHash are now generic (<T>) and return Client & T, giving typed contract methods without code generation. T defaults to unknown, so untyped calls are unchanged (#1502).
  • ClientOptions.server: pass an existing rpc.Server to contract.Client.from to reuse its transport instead of building a new one (#1502).
  • Keypair.signMessage(message) and Keypair.verifyMessage(message, signature): sign and verify arbitrary messages per SEP-53, matching the Python and Java SDKs and stellar-cli (#1513).
  • TransactionFailedError: raised by Horizon.Server.submitTransaction and submitAsyncTransaction when Horizon rejects a transaction with result codes. Extends BadResponseError and adds getResultCodes() and getTransactionResult() (#1526).

Changed

  • HorizonApi.TransactionFailedResultCodes gained the transaction result codes it was missing: tx_bad_sponsorship, tx_bad_min_seq_age_or_gap, tx_malformed, tx_soroban_invalid, and tx_frozen_key_accessed (#1526).
  • contract.Client.from now supports built-in Stellar Asset Contracts (SACs), building the client from the embedded SAC spec instead of downloading Wasm (#1501).
  • rpc.Server.getContractWasmByContractId now rejects a SAC with a structured { code: 400 } error pointing to contract.Client.from. The not-found rejection is now { code: 404, message: "Could not obtain contract instance from server" } (#1501).
  • The UMD (dist/) build now sets inlineDynamicImports so the single-file bundle stays whole despite the SAC spec's lazy import() (#1501).

Fixed

  • Horizon.Server.submitTransaction and submitAsyncTransaction now reject with SDK error types on HTTP failures, as documented: a TransactionFailedError for Horizon result codes, a BadResponseError otherwise. The wrapping branch used to be unreachable, so failures leaked through as raw HTTP-client errors. err.response.data and err.response.status are unchanged; the original error is now preserved as err.cause (#1526).
  • Federation.Server resolution methods (resolveAddress, resolveAccountId, resolveTransactionId, forDomain) had the same unreachable branch and now reject HTTP failures with BadResponseError (#1526).
  • contract.AssembledTransaction.needsNonInvokerSigningBy now treats an empty scvVec signature as unsigned, matching the existing scvVoid check. Such entries used to count as already signed and were left off the list (#1529).

... (truncated)

Changelog

Sourced from @​stellar/stellar-sdk's changelog.

v16.2.0

Added

  • rpc.Server.simulateTransaction accepts an optional useUpgradedAuth flag, and contract.AssembledTransaction accepts it as a method option (useUpgradedAuth) or per-call (tx.simulate({ useUpgradedAuth: true })). When set, RPC simulation records v2 address credentials (CAP-71) instead of the legacy v1 credentials. It only affects the recording auth modes and is silently ignored on hosts that cannot emit v2 credentials. The flag is deprecated from the start: it is transitional and becomes a no-op once the network returns v2 credentials by default (protocol 28) (#1562).
  • @stellar/stellar-sdk/base subpath export: import offline primitives like StrKey and Keypair without loading Horizon, RPC, or the SEP helpers and their networking dependencies (#1550).
  • authorizeEntry / authorizeInvocation signing callbacks now receive the 32-byte signing payload (hash(preimage.toXDR())) as a second argument alongside the preimage, so signers — including HSMs and remote signers that only accept a digest — never have to re-derive it. Existing single-argument callbacks are unaffected (#1532).
  • authorizeEntry / authorizeInvocation now support non-Ed25519 signers: the signing callback may return { signatureScVal: xdr.ScVal, address?: string }, and the given ScVal is written verbatim as the credentials' signature — no Ed25519 verification, no {public_key, signature} map, no scvVec wrapping. This lets smart-wallet / custom-account contracts (whose __check_auth expects its own signature structure) use the helper instead of hand-rolling preimage construction and credential assembly. The optional address routes the signature to a specific credential node, like forAddress (#1530).
  • contract.Signer: an interface pairing an address with the SEP-43 signTransaction and optional signAuthEntry methods, plus contract.KeypairSigner, a Keypair-backed implementation. The signTransaction and signAuthEntry options — on ClientOptions, MethodOptions, and AssembledTransaction's sign / signAndSend / signAuthEntries — now accept a Signer or a bare Keypair in addition to a callback. Adds the contract.SignTransactionLike and contract.SignAuthEntryLike types. When signAuthEntries gets a Signer or Keypair, its default target address is now the signer's own address rather than publicKey. Existing callbacks work unchanged; one type-only caveat: the option fields are no longer plain function types, so derive callback shapes from contract.SignTransaction / contract.SignAuthEntry instead of the option field (#1567, closes #1462 and #1063).
  • contract.Spec now reads SEP-48 event declarations: events() and findEvent(name, occurrence?) list a contract's declared events, parseEvent(topics, data) decodes a fired event into { name, data }, with topic-carried params merged into data (returns undefined when nothing matches), and eventTopicFilter(name, topicValues?, occurrence?) builds a getEvents filter row, with "*" for any topic param left unset. Generated client bindings gain a typed <Name>Event interface per event, a ContractEvent union, a parseEvent() method, and per-event <name>EventFilter() methods. A contract may declare the same event name more than once (composed modules each emitting their own transfer); each declaration gets its own interface and filter method, and occurrence — a 0-based index in declaration order — selects among them. Generated names receive a numeric suffix when needed to avoid a collision, and stellar-sdk bindings warns about duplicate declarations and renames. Adds the contract.ParsedEvent type (#1556, #1565, #1572).

Fixed

  • Spec.scValToNative now handles contract values typed as Val (scSpecTypeVal) by delegating to the generic scValToNative converter, mirroring the encoding-side support added in #1485. Decoding a response containing a Val-typed string, symbol, vec, or map — e.g. a struct with a Vec<Val> field — no longer throws ScSpecType scSpecTypeVal was not string or symbol; each value decodes to its natural native representation (Address → string, u32 → number, Symbol → string, vecs/maps recurse). (#1551)

v16.1.0

Added

  • inspectAuthEntry(entry): decodes a xdr.SorobanAuthorizationEntry into a typed summary — credential type, authorizing address, nonce, signatureExpirationLedger, and a signers list covering top-level credentials and CAP-71 delegates. Adds the AuthEntryInfo, AuthEntrySigner, AuthEntrySignature, and AuthEntryCredentialType types (#1529).
  • checkAuthEntryReadiness(entry, currentLedgerSeq): reports whether an auth entry is ready to submit — { ready, expired, unsignedBy } — as a pure decode with no network call (#1529).
  • Spec.nativeToScVal now supports contract parameters typed as Val (scSpecTypeVal), so raw JS values can be passed to Val-typed arguments without building xdr.ScVal objects by hand (#1485).
  • rpc.Server.queryContract<T>(contractId, method, args?, networkPassphrase?): a one-line read-only contract call that returns { result, isReadCall }, no transaction assembly or signing. Works for Wasm contracts and built-in Stellar Asset Contracts (SACs) (#1502).
  • rpc.Server.getContractMethods(contractId, networkPassphrase?): lists a contract's callable methods and their signatures. Adds the Api.ContractMethod and Api.ContractMethodInput types (#1502).
  • rpc.Server.getContractInstance(contractId): returns a contract's xdr.ScContractInstance (#1501).
  • contract.Client.from, fromWasm, and fromWasmHash are now generic (<T>) and return Client & T, giving typed contract methods without code generation. T defaults to unknown, so untyped calls are unchanged (#1502).
  • ClientOptions.server: pass an existing rpc.Server to contract.Client.from to reuse its transport instead of building a new one (#1502).
  • Keypair.signMessage(message) and Keypair.verifyMessage(message, signature): sign and verify arbitrary messages per SEP-53, matching the Python and Java SDKs and stellar-cli (#1513).
  • TransactionFailedError: raised by Horizon.Server.submitTransaction and submitAsyncTransaction when Horizon rejects a transaction with result codes. Extends BadResponseError and adds getResultCodes() and getTransactionResult() (#1526).

Changed

  • HorizonApi.TransactionFailedResultCodes gained the transaction result codes it was missing: tx_bad_sponsorship, tx_bad_min_seq_age_or_gap, tx_malformed, tx_soroban_invalid, and tx_frozen_key_accessed (#1526).
  • contract.Client.from now supports built-in Stellar Asset Contracts (SACs), building the client from the embedded SAC spec instead of downloading Wasm (#1501).
  • rpc.Server.getContractWasmByContractId now rejects a SAC with a structured { code: 400 } error pointing to contract.Client.from. The not-found rejection is now { code: 404, message: "Could not obtain contract instance from server" } (#1501).
  • The UMD (dist/) build now sets inlineDynamicImports so the single-file bundle stays whole despite the SAC spec's lazy import() (#1501).

Fixed

  • Horizon.Server.submitTransaction and submitAsyncTransaction now reject with SDK error types on HTTP failures, as documented: a TransactionFailedError for Horizon result codes, a BadResponseError otherwise. The wrapping branch used to be unreachable, so failures leaked through as raw HTTP-client errors. err.response.data and err.response.status are unchanged; the original error is now preserved as err.cause (#1526).
  • Federation.Server resolution methods (resolveAddress, resolveAccountId, resolveTransactionId, forDomain) had the same unreachable branch and now reject HTTP failures with BadResponseError (#1526).
  • contract.AssembledTransaction.needsNonInvokerSigningBy now treats an empty scvVec signature as unsigned, matching the existing scvVoid check. Such entries used to count as already signed and were left off the list (#1529).

... (truncated)

Commits
  • 0336c41 feat(contract): add occurrence param to Spec.findEvent (#1574)
  • 22b013a Support duplicate event names in generated bindings (#1572)
  • 513da91 release V16.2.0 (#1569)
  • b1a4814 Review fixes for event bindings and contract signers (#1570)
  • c93797c Add useUpgradedAuth simulation flag for CAP-71 v2 address credentials (#1568)
  • 52717e4 Accept a Signer or Keypair wherever signTransaction is accepted (#1567)
  • 5aaba3c Event bindings review fixes (#1565)
  • 1e1ba81 Bump astro from 6.4.8 to 7.1.0 (#1557)
  • aa00dd1 feat(bindings): generate typed event interfaces and filter helpers (#1556)
  • 9526bd3 Extend authorizeEntry signing callbacks: payload argument and custom signatur...
  • Additional commits viewable in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates axios from 1.13.5 to 1.18.0

Release notes

Sourced from axios's releases.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

  • Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

  • URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

  • Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

  • Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

  • Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

  • Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
  • Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
  • React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

  • Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

  • URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

  • Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

  • Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

  • Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

  • Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
  • Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
  • React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Commits
  • 2d06f96 chore(release): prepare release 1.18.0 (#11003)
  • 32fc489 fix: malformed http urls (#11000)
  • b40ce49 chore(deps-dev): bump the development_dependencies group with 10 updates (#10...
  • fe964f9 docs: mark proxy config as Node.js only (#10995)
  • 5f229d2 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...
  • fae9d4e docs: clarify package update PR policy (#10992)
  • 28ab2ce chore(deps-dev): bump the development_dependencies group with 2 updates (#10989)
  • a8e4f13 fix(core): keep default validateStatus when request passes undefined (#10899)
  • 614f455 docs: publish v1.17.0 release notes (#10988)
  • 6bb12c1 fix: custom auth headers not stripped on cross-origin redirects (#10892)
  • Additional commits viewable in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates better-sqlite3 from 12.6.2 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

v13.0.2

What's Changed

New Contributors

Full Changelog: WiseLibs/better-sqlite3@v13.0.1...v13.0.2

v13.0.1

Full Changelog: WiseLibs/better-sqlite3@v13.0.0...v13.0.1

Fixed a regression in parameter binding where it would be overly strict and reject plain objects from other realms (e.g., in jest tests).

v13.0.0

Version 13.0.0 marks a major milestone, as it's the first version of better-sqlite3 to run on the N-API. This means prebuilt binaries should theoretically work across different versions of Node.js and Electron, and perhaps even other runtimes like Bun. As a result, we've removed the deprecated prebuild-install dependency, and now prebuilt binaries are published directly with the better-sqlite3 code itself. If your platform/architecture doesn't have a prebuilt binary, it should compile during install as before.

What's Changed

New Contributors

Full Changelog: WiseLibs/better-sqlite3@v12.12.0...v13.0.0

v12.12.0

What's Changed

[!WARNING]

BREAKING: Starting with Electron v43, binary assets will require glibc 2.41 or higher on Linux hosts.

... (truncated)

Commits

Updates dotenv from 17.3.1 to 17.4.2

Changelog

Sourced from dotenv's changelog.

17.4.2 (2026-04-12)

Changed

  • Improved skill files - tightened up details (#1009)

17.4.1 (2026-04-05)

Changed

  • Change text injecting to injected (#1005)

17.4.0 (2026-04-01)

Added

  • Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

  • Tighten up logs: ◇ injecting env (14) from .env (#1003)
Commits

Updates express from 4.22.1 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

@dependabot
build(deps): bump the all-dependencies group across 1 directory with …
4b1a5eb 
…19 updates

Bumps the all-dependencies group with 18 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [@stellar/stellar-sdk](https://github.com/stellar/js-stellar-sdk) | `14.5.0` | `16.2.0` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.6.2` | `13.0.3` |
| [dotenv](https://github.com/motdotla/dotenv) | `17.3.1` | `17.4.2` |
| [express](https://github.com/expressjs/express) | `4.22.1` | `5.2.1` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `7.5.1` | `8.6.2` |
| [ioredis](https://github.com/redis/ioredis) | `5.11.1` | `6.0.0` |
| [p-limit](https://github.com/sindresorhus/p-limit) | `4.0.0` | `7.3.1` |
| [pino](https://github.com/pinojs/pino) | `9.14.0` | `10.3.1` |
| [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.2` |
| [zod](https://github.com/colinhacks/zod) | `4.3.6` | `4.4.3` |
| [@types/better-sqlite3](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/better-sqlite3) | `7.6.13` | `9.6.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.12.0` | `26.1.2` |
| [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.20.0` | `8.20.4` |
| [@types/supertest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/supertest) | `6.0.3` | `7.2.1` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `1.6.1` | `4.1.10` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.65.0` | `8.66.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `1.6.1` | `4.1.10` |



Updates `@stellar/stellar-sdk` from 14.5.0 to 16.2.0
- [Release notes](https://github.com/stellar/js-stellar-sdk/releases)
- [Changelog](https://github.com/stellar/js-stellar-sdk/blob/main/CHANGELOG.md)
- [Commits](stellar/js-stellar-sdk@v14.5.0...v16.2.0)

Updates `axios` from 1.13.5 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.18.0)

Updates `better-sqlite3` from 12.6.2 to 13.0.3
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v12.6.2...v13.0.3)

Updates `dotenv` from 17.3.1 to 17.4.2
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v17.3.1...v17.4.2)

Updates `express` from 4.22.1 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v4.22.1...v5.2.1)

Updates `express-rate-limit` from 7.5.1 to 8.6.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.6.2)

Updates `ioredis` from 5.11.1 to 6.0.0
- [Release notes](https://github.com/redis/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.11.1...v6.0.0)

Updates `p-limit` from 4.0.0 to 7.3.1
- [Release notes](https://github.com/sindresorhus/p-limit/releases)
- [Commits](sindresorhus/p-limit@v4.0.0...v7.3.1)

Updates `pino` from 9.14.0 to 10.3.1
- [Release notes](https://github.com/pinojs/pino/releases)
- [Commits](pinojs/pino@v9.14.0...v10.3.1)

Updates `ws` from 8.21.1 to 8.21.2
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.1...8.21.2)

Updates `zod` from 4.3.6 to 4.4.3
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.3.6...v4.4.3)

Updates `@types/better-sqlite3` from 7.6.13 to 9.6.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/better-sqlite3)

Updates `@types/node` from 24.12.0 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/pg` from 8.20.0 to 8.20.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg)

Updates `@types/supertest` from 6.0.3 to 7.2.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/supertest)

Updates `@vitest/coverage-v8` from 1.6.1 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `typescript-eslint` from 8.65.0 to 8.66.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/typescript-eslint)

Updates `vitest` from 1.6.1 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

---
updated-dependencies:
- dependency-name: "@stellar/stellar-sdk"
  dependency-version: 16.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: better-sqlite3
  dependency-version: 13.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: dotenv
  dependency-version: 17.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.6.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: ioredis
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: p-limit
  dependency-version: 7.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: pino
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: ws
  dependency-version: 8.21.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: zod
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@types/better-sqlite3"
  dependency-version: 9.6.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@types/pg"
  dependency-version: 8.20.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@types/supertest"
  dependency-version: 7.2.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.66.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@vercel

vercel Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
stellar-stream Error Error Aug 10, 2026 7:27am

@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 17, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/backend/all-dependencies-cc04166c4e branch August 17, 2026 07:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@ritik4ever ritik4ever

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ritik4ever