Skip to content

chore(deps): bump the backend-npm group across 1 directory with 11 updates - #13

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-npm-e6657f13b4
Open

chore(deps): bump the backend-npm group across 1 directory with 11 updates#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-npm-e6657f13b4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Updates the requirements on dotenv, express, express-rate-limit, helmet, mongoose, multer, redis, @octokit/rest, firebase-admin, node-pty and eslint to permit the latest version.
Updates dotenv from 16.6.1 to 17.4.2

Changelog

Sourced from dotenv's changelog.

17.4.2 (2026-04-12)

Changed

  • Improved skill files - tightened up details (#1009)

17.4.1 (2026-04-05)

Changed

  • Change text injecting to injected (#1005)

17.4.0 (2026-04-01)

Added

  • Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

  • Tighten up logs: ◇ injecting env (14) from .env (#1003)

17.3.1 (2026-02-12)

Changed

  • Fix as2 example command in README and update spanish README

17.3.0 (2026-02-12)

Added

  • Add a new README section on dotenv’s approach to the agentic future.

Changed

  • Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

17.2.4 (2026-02-05)

Changed

  • Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)
  • Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

17.2.3 (2025-09-29)

Changed

  • Fixed typescript error definition (#912)

... (truncated)

Commits

Updates express from 4.22.2 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

5.0.1 / 2024-10-08

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0

... (truncated)

Commits

Updates express-rate-limit from 7.5.1 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

v8.5.2

You can view the changelog here.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

v8.4.1

You can view the changelog here.

v8.4.0

You can view the changelog here.

v8.3.2

You can view the changelog here.

v8.3.1

You can view the changelog here.

v8.3.0

You can view the changelog here.

v8.2.1

You can view the changelog here.

v8.2.0

You can view the changelog here.

v8.1.0

You can view the changelog here.

v8.0.1

You can view the changelog here.

v8.0.0

You can view the changelog here.

Commits
  • 48db09e 8.7.0
  • dce5871 v8.7.0 changelog
  • 2f08044 Add inspect.software health badge (#673)
  • a29757c feat: add retryAfter option (#661)
  • 146e88b chore: rename license
  • 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
  • 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
  • 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
  • 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
  • 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates helmet from 7.2.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

  • Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
  • Content-Security-Policy: improved error handling for invalid directive names

Fixed

  • Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
  • Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
  • Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

  • Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
  • Improve error message when passing duplicate options

8.1.0 - 2025-03-17

Changed

  • Content-Security-Policy gives a better error when a directive value, like self, should be quoted. See #482

8.0.0 - 2024-09-28

Changed

  • Breaking: Strict-Transport-Security now has a max-age of 365 days, up from 180
  • Breaking: Content-Security-Policy middleware now throws an error if a directive should have quotes but does not, such as self instead of 'self'. See #454
  • Breaking: Content-Security-Policy's getDefaultDirectives now returns a deep copy. This only affects users who were mutating the result
  • Breaking: Strict-Transport-Security now throws an error when "includeSubDomains" option is misspelled. This was previously a warning

Removed

  • Breaking: Drop support for Node 16 and 17. Node 18+ is now required
Commits
  • 75f1a98 8.3.0
  • f03f70d Update changelog for 8.3.0 release
  • a307fce Fix capitalization in CSP package changelog
  • 5347b43 Format default CSP in README for readability
  • 9afc570 CSP: fix middleware-specific README missing link
  • 266c95c Minor speedups to project setups test
  • 7a4196c CSP: update package-specific changelog
  • 02716b4 CSP: improve performance when there are no dynamic directives
  • 3f511ed CSP: move utility functions to separate file
  • 80338af CSP: disabling defaults with no directives is now an error
  • Additional commits viewable in compare view

Updates mongoose from 8.24.4 to 9.10.0

Release notes

Sourced from mongoose's releases.

9.10.0 / 2026-09-10

  • feat: upgrade mongodb driver -> 7.6.0
  • feat(model): add Model.findAndCount() wrapper for limit+skip based pagination with countDocuments #16460 #16454
  • feat(schema): add Schema.prototype.queryHelper() to make it easier to define query helpers in TypeScript #16464 #16410
  • feat: support middleware skip option for cursors and custom hooks #16350 #15883 #8768 AbdelrahmanHafez
  • fix: apply defaults to undefined array elements #16542 #9232
  • types: support for type narrowing when using projection in find and findOne #16500 #15545
  • types: make Schema.prototype.static() return type with new static #16464

9.9.5 / 2026-09-04

  • fix(query): pass schema through when casting a nested $expr comparison #16496 rajanpanth
  • fix(projection): build the dotted path correctly in isPathSelectedInclusive #16495 rajanpanth
  • fix(document): replace {MODEL} in custom cast error messages from document validation #16480 #8300 AbinMadathil-Celigo
  • types(model): add missing properties to listSearchIndexes() return type #16486 lazerg

9.9.4 / 2026-08-25

  • fix(query): set strictQuery and strict on _mongooseOptions consistently #16451 #16447
  • fix(hydration): use the doc model for looking up a ref #16453 rawmind
  • fix(schema): drop the map values subpath when removing a map path #16457 rawmind
  • fix(schema): remove a map that lives under a nested path #16461 #16457 luantaraschi
  • fix(schema): do not repeat null in a toJSONSchema enum that already lists null #16456 luantaraschi
  • fix(schema): clone a document array element with its own constructor signature #16463 #16462 luantaraschi
  • fix(schema): keep the map value schematype a single object when cloning #16473 luantaraschi
  • fix(schema): clarify duplicate index warning to note index is not created #16476 vjymisal0
  • perf(model): index bulkSave write errors by document id #16474 yoominho91
  • docs: add Atlas Vector Search and Atlas Search documentation #16395
  • docs: fix dead MongoDB driver Collection link #16458 rajanpanth

9.9.3 / 2026-08-17

9.9.2 / 2026-08-10

  • fix(query): apply sanitizeFilter on countDocuments and cursor()
  • fix(document): support map wildcards in optimistic concurrency paths option #16436 #16383
  • fix(model): set document session in bulkSave() so transaction retries restore document state #16438 #16432 yogesh968
  • fix(connection): restore delete state across transaction retries #16435 #16433 snowyukitty
  • fix(schema): put enum on array elements and support the object enum form in toJSONSchema #16444 #16443 Jaybhade
  • perf(document): inline the type checks in $__hasOnlyPrimitiveValues() #14394 yogesh968
  • types(document): respect schema toObject and toJSON options #16431 #15594 samuelmbabhazi
  • types: import BSON from mongodb instead of bson #16434 #16434 orgads
  • docs(populate): document that skip needs sort to paginate reliably #16442 #7579

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.10.0 / 2026-09-10

  • feat: upgrade mongodb driver -> 7.6.0
  • feat(model): add Model.findAndCount() wrapper for limit+skip based pagination with countDocuments #16460 #16454
  • feat(schema): add Schema.prototype.queryHelper() to make it easier to define query helpers in TypeScript #16464 #16410
  • feat: support middleware skip option for cursors and custom hooks #16350 #15883 #8768 AbdelrahmanHafez
  • fix: apply defaults to undefined array elements #16542 #9232
  • types: support for type narrowing when using projection in find and findOne #16500 #15545
  • types: make Schema.prototype.static() return type with new static #16464

9.9.5 / 2026-09-04

  • fix(query): pass schema through when casting a nested $expr comparison #16496 rajanpanth
  • fix(projection): build the dotted path correctly in isPathSelectedInclusive #16495 rajanpanth
  • fix(document): replace {MODEL} in custom cast error messages from document validation #16480 #8300 AbinMadathil-Celigo
  • types(model): add missing properties to listSearchIndexes() return type #16486 lazerg

9.9.4 / 2026-08-25

  • fix(query): set strictQuery and strict on _mongooseOptions consistently #16451 #16447
  • fix(hydration): use the doc model for looking up a ref #16453 rawmind
  • fix(schema): drop the map values subpath when removing a map path #16457 rawmind
  • fix(schema): remove a map that lives under a nested path #16461 #16457 luantaraschi
  • fix(schema): do not repeat null in a toJSONSchema enum that already lists null #16456 luantaraschi
  • fix(schema): clone a document array element with its own constructor signature #16463 #16462 luantaraschi
  • fix(schema): keep the map value schematype a single object when cloning #16473 luantaraschi
  • fix(schema): clarify duplicate index warning to note index is not created #16476 vjymisal0
  • perf(model): index bulkSave write errors by document id #16474 yoominho91
  • docs: add Atlas Vector Search and Atlas Search documentation #16395
  • docs: fix dead MongoDB driver Collection link #16458 rajanpanth
Commits
  • 396a2a6 chore: add 9.10 changelog
  • 7b28d7a chore: release 9.10.0
  • bbc3fd1 Merge pull request #16455 from Automattic/9.10
  • f9cef50 Update error handling in findAndCount method
  • 0dd4091 Initialize options with an empty object if undefined
  • b10301d Merge pull request #16488 from Automattic/dependabot/npm_and_yarn/master/moch...
  • a23f167 Merge pull request #16500 from Automattic/vkarpov15/gh-15545
  • 97052b4 bump max instantiations to 420k for now
  • 8d74b51 perf: hydrated doc cleanup
  • d1aa32a refactor: remove ProjectedLeanDocument
  • Additional commits viewable in compare view

Updates multer from 1.4.5-lts.2 to 2.3.0

Release notes

Sourced from multer's releases.

v2.3.0

Important

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from multer's changelog.

2.3.0

2.2.0

2.1.1

2.1.0

2.0.2

2.0.1

2.0.0

Commits
  • 4e8edf5 2.3.0 (#1455)
  • 87a584e fix: reject invalid field names instead of crashing on append-field errors
  • ab6aeae fix: enforce file size limit with async fileFilter
  • eef7444 fix: destroy disk write stream on aborted uploads to prevent fd leak
  • 25ec9bb docs: refresh all README translations (#1462)
  • 73c1759 feat: add an opt-in fieldArrayIndexLimit (#1438)
  • ece6735 Update 'README-zh-cn.md' up to now (#1264)
  • 3278e1b docs: add Japanese translation to README (#1354)
  • 3c0bc5e test: accept files exactly at fileSize limit (#1382)
  • b6d84b0 docs: add Indonesian translation for README (#1431)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.


Updates redis from 4.7.1 to 6.2.1

Release notes

Sourced from redis's releases.

redis@6.2.1

What's Changed

@dependabot
chore(deps): bump the backend-npm group across 1 directory with 11 up…
343338f 
…dates

Updates the requirements on [dotenv](https://github.com/motdotla/dotenv), [express](https://github.com/expressjs/express), [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit), [helmet](https://github.com/helmetjs/helmet), [mongoose](https://github.com/Automattic/mongoose), [multer](https://github.com/expressjs/multer), [redis](https://github.com/redis/node-redis), [@octokit/rest](https://github.com/octokit/rest.js), [firebase-admin](https://github.com/firebase/firebase-admin-node), [node-pty](https://github.com/microsoft/node-pty) and [eslint](https://github.com/eslint/eslint) to permit the latest version.

Updates `dotenv` from 16.6.1 to 17.4.2
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v16.6.1...v17.4.2)

Updates `express` from 4.22.2 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v4.22.2...v5.2.1)

Updates `express-rate-limit` from 7.5.1 to 8.7.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.7.0)

Updates `helmet` from 7.2.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v7.2.0...v8.3.0)

Updates `mongoose` from 8.24.4 to 9.10.0
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@8.24.4...9.10.0)

Updates `multer` from 1.4.5-lts.2 to 2.3.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v1.4.5-lts.2...v2.3.0)

Updates `redis` from 4.7.1 to 6.2.1
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@4.7.1...redis@6.2.1)

Updates `@octokit/rest` from 20.1.2 to 22.0.1
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](octokit/rest.js@v20.1.2...v22.0.1)

Updates `firebase-admin` from 13.10.0 to 14.4.0
- [Release notes](https://github.com/firebase/firebase-admin-node/releases)
- [Changelog](https://github.com/firebase/firebase-admin-node/blob/main/CHANGELOG.md)
- [Commits](firebase/firebase-admin-node@v13.10.0...v14.4.0)

Updates `node-pty` to 1.1.0
- [Release notes](https://github.com/microsoft/node-pty/releases)
- [Commits](microsoft/node-pty@v1.1.0...v1.1.0)

Updates `eslint` from 8.57.1 to 10.10.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v8.57.1...v10.10.0)

---
updated-dependencies:
- dependency-name: dotenv
  dependency-version: 17.4.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: express-rate-limit
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: mongoose
  dependency-version: 9.10.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: multer
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: redis
  dependency-version: 6.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: "@octokit/rest"
  dependency-version: 22.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: firebase-admin
  dependency-version: 14.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: node-pty
  dependency-version: 1.1.0
  dependency-type: direct:production
  dependency-group: backend-npm
- dependency-name: eslint
  dependency-version: 10.10.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: backend-npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying codehub with  Cloudflare Pages  Cloudflare Pages

Latest commit: 343338f
Status: ✅  Deploy successful!
Preview URL: https://ca49181f.codehub-1fr.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-back-uuk9.codehub-1fr.pages.dev

View logs

@vercel

vercel Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
code-hub Ready Ready Preview Sep 14, 2026 4:40pm UTC

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants