build(deps): bump the dependencies group across 1 directory with 25 updates by dependabot[bot] · Pull Request #297 · SubStream-Protocol/SubStream-Protocol-Backend

dependabot · 2026-06-09T11:38:20Z

Bumps the dependencies group with 25 updates in the / directory:

Package	From	To
@nestjs/common	`11.1.20`	`11.1.26`
@nestjs/core	`11.1.20`	`11.1.26`
@nestjs/platform-express	`11.1.20`	`11.1.26`
@nestjs/testing	`11.1.20`	`11.1.26`
@nestjs/websockets	`11.1.20`	`11.1.26`
@sentry/node	`10.53.1`	`10.57.0`
@types/node	`25.7.0`	`25.9.2`
axios	`1.16.1`	`1.17.0`
bullmq	`5.76.8`	`5.78.0`
date-fns	`4.1.0`	`4.4.0`
express-rate-limit	`8.5.1`	`8.5.2`
graphql	`16.14.0`	`16.14.2`
helmet	`8.1.0`	`8.2.0`
ioredis	`5.10.1`	`5.11.1`
js-yaml	`4.1.1`	`4.2.0`
pg	`8.20.0`	`8.21.0`
puppeteer	`24.43.1`	`25.1.0`
rate-limiter-flexible	`11.1.0`	`11.2.0`
redis	`5.12.1`	`6.0.0`
stripe	`22.1.1`	`22.2.0`
@nestjs/cli	`11.0.21`	`11.0.23`
commander	`14.0.3`	`15.0.0`
concurrently	`9.2.1`	`10.0.3`
jest	`29.7.0`	`30.4.2`
@types/jest	`29.5.14`	`30.0.0`

Updates @nestjs/common from 11.1.20 to 11.1.26

Release notes

Sourced from @nestjs/common's releases.

v11.1.26

What's Changed

fix(core): post sse endpoint empty response #17098 by @kamilmysliwiec in nestjs/nest#17099

Full Changelog: nestjs/nest@v11.1.25...v11.1.26

v11.1.25

What's Changed

fix(microservices): reject pending Redis requests on close by @yudin-s in nestjs/nest#17024

fix(core): register SSE close listener before async setup by @fallintoplace in nestjs/nest#17018

fix(platform-fastify): remove pathname ending slash by @kamilmysliwiec in nestjs/nest#17094

New Contributors

@fallintoplace made their first contribution in nestjs/nest#17018

@DucMinhNe made their first contribution in nestjs/nest#17085

@iambeaukim made their first contribution in nestjs/nest#17091

Full Changelog: nestjs/nest@v11.1.24...v11.1.25

v11.1.24 (2026-05-25)

Bug fixes

core

#17009 fix(core): reset dependency-tree cache on metadata changes (@puneetdixit200)

Enhancements

core

#16997 feat(core): warn on late websocket adapter registration (@hbinhng)

Dependencies

platform-ws

#17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@dependabot[bot])

Committers: 2

Nguyễn Hải Bình (@hbinhng)

Puneet Dixit (@puneetdixit200)

v11.1.23 (2026-05-21)

Bug fixes

core

nestjs/nest#16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20

Committers: 1

Kamil Mysliwiec (@kamilmysliwiec)

v11.1.22 (2026-05-21)

Bug fixes

... (truncated)

Commits

9ff83d5 chore(release): publish v11.1.26 release
02f8041 chore(release): publish v11.1.25 release
1634915 test(common): Add unit tests for cli-colors utility
380bf5c Merge pull request #17058 from Se3do/test/extend-metadata
af4542b test(common): Add unit tests for assignCustomParameterMetadata
b67aea1 test(common): Add unit tests for extendArrayMetadata
e1e4014 test(common): Tighten throw assertions in validateModuleKeys spec
6b97771 test(common): Add unit tests for validateModuleKeys
5a57222 test(common): add unit test for Optional decorator
deed1b3 docs(common): add @see reference to Res alias JSDoc
Additional commits viewable in compare view

Updates @nestjs/core from 11.1.20 to 11.1.26

Release notes

Sourced from @nestjs/core's releases.

v11.1.26

What's Changed

fix(core): post sse endpoint empty response #17098 by @kamilmysliwiec in nestjs/nest#17099

Full Changelog: nestjs/nest@v11.1.25...v11.1.26

v11.1.25

What's Changed

fix(microservices): reject pending Redis requests on close by @yudin-s in nestjs/nest#17024

fix(core): register SSE close listener before async setup by @fallintoplace in nestjs/nest#17018

fix(platform-fastify): remove pathname ending slash by @kamilmysliwiec in nestjs/nest#17094

New Contributors

@fallintoplace made their first contribution in nestjs/nest#17018

@DucMinhNe made their first contribution in nestjs/nest#17085

@iambeaukim made their first contribution in nestjs/nest#17091

Full Changelog: nestjs/nest@v11.1.24...v11.1.25

v11.1.24 (2026-05-25)

Bug fixes

core

#17009 fix(core): reset dependency-tree cache on metadata changes (@puneetdixit200)

Enhancements

core

#16997 feat(core): warn on late websocket adapter registration (@hbinhng)

Dependencies

platform-ws

#17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@dependabot[bot])

Committers: 2

Nguyễn Hải Bình (@hbinhng)

Puneet Dixit (@puneetdixit200)

v11.1.23 (2026-05-21)

Bug fixes

core

nestjs/nest#16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20

Committers: 1

Kamil Mysliwiec (@kamilmysliwiec)

v11.1.22 (2026-05-21)

Bug fixes

... (truncated)

Commits

9ff83d5 chore(release): publish v11.1.26 release
0f398fd test: fix broken unit test
d152eec fix(core): post sse endpoint empty response #17098
02f8041 chore(release): publish v11.1.25 release
e2ad4e2 Update package.json
396cf81 refactor(core): avoid duplicating sse intercept call
55cd699 fix(core): preserve deferred SSE handlers
7b5ca83 fix(core): register SSE close listener before async setup
d8a0ab8 chore(release): publish v11.1.24 release
3ed595e fix(core): keep dependency parent registry internal
Additional commits viewable in compare view

Updates @nestjs/platform-express from 11.1.20 to 11.1.26

Release notes

Sourced from @nestjs/platform-express's releases.

v11.1.26

What's Changed

fix(core): post sse endpoint empty response #17098 by @kamilmysliwiec in nestjs/nest#17099

Full Changelog: nestjs/nest@v11.1.25...v11.1.26

v11.1.25

What's Changed

fix(microservices): reject pending Redis requests on close by @yudin-s in nestjs/nest#17024

fix(core): register SSE close listener before async setup by @fallintoplace in nestjs/nest#17018

fix(platform-fastify): remove pathname ending slash by @kamilmysliwiec in nestjs/nest#17094

New Contributors

@fallintoplace made their first contribution in nestjs/nest#17018

@DucMinhNe made their first contribution in nestjs/nest#17085

@iambeaukim made their first contribution in nestjs/nest#17091

Full Changelog: nestjs/nest@v11.1.24...v11.1.25

v11.1.24 (2026-05-25)

Bug fixes

core

#17009 fix(core): reset dependency-tree cache on metadata changes (@puneetdixit200)

Enhancements

core

#16997 feat(core): warn on late websocket adapter registration (@hbinhng)

Dependencies

platform-ws

#17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@dependabot[bot])

Committers: 2

Nguyễn Hải Bình (@hbinhng)

Puneet Dixit (@puneetdixit200)

v11.1.23 (2026-05-21)

Bug fixes

core

nestjs/nest#16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20

Committers: 1

Kamil Mysliwiec (@kamilmysliwiec)

v11.1.22 (2026-05-21)

Bug fixes

... (truncated)

Commits

9ff83d5 chore(release): publish v11.1.26 release
02f8041 chore(release): publish v11.1.25 release
d8a0ab8 chore(release): publish v11.1.24 release
2dccece chore: update readmes
b8be8c1 chore(release): publish v11.1.23 release
801c46f chore(release): publish v11.1.22 release
983dd52 chore(release): publish v11.1.21 release
a0b0139 chore: update readme
See full diff in compare view

Updates @nestjs/testing from 11.1.20 to 11.1.26

Release notes

Sourced from @nestjs/testing's releases.

v11.1.26

What's Changed

fix(core): post sse endpoint empty response #17098 by @kamilmysliwiec in nestjs/nest#17099

Full Changelog: nestjs/nest@v11.1.25...v11.1.26

v11.1.25

What's Changed

fix(microservices): reject pending Redis requests on close by @yudin-s in nestjs/nest#17024

fix(core): register SSE close listener before async setup by @fallintoplace in nestjs/nest#17018

fix(platform-fastify): remove pathname ending slash by @kamilmysliwiec in nestjs/nest#17094

New Contributors

@fallintoplace made their first contribution in nestjs/nest#17018

@DucMinhNe made their first contribution in nestjs/nest#17085

@iambeaukim made their first contribution in nestjs/nest#17091

Full Changelog: nestjs/nest@v11.1.24...v11.1.25

v11.1.24 (2026-05-25)

Bug fixes

core

#17009 fix(core): reset dependency-tree cache on metadata changes (@puneetdixit200)

Enhancements

core

#16997 feat(core): warn on late websocket adapter registration (@hbinhng)

Dependencies

platform-ws

#17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@dependabot[bot])

Committers: 2

Nguyễn Hải Bình (@hbinhng)

Puneet Dixit (@puneetdixit200)

v11.1.23 (2026-05-21)

Bug fixes

core

nestjs/nest#16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20

Committers: 1

Kamil Mysliwiec (@kamilmysliwiec)

v11.1.22 (2026-05-21)

Bug fixes

... (truncated)

Commits

9ff83d5 chore(release): publish v11.1.26 release
02f8041 chore(release): publish v11.1.25 release
d8a0ab8 chore(release): publish v11.1.24 release
2dccece chore: update readmes
b8be8c1 chore(release): publish v11.1.23 release
801c46f chore(release): publish v11.1.22 release
983dd52 chore(release): publish v11.1.21 release
a0b0139 chore: update readme
See full diff in compare view

Updates @nestjs/websockets from 11.1.20 to 11.1.26

Release notes

Sourced from @nestjs/websockets's releases.

v11.1.26

What's Changed

fix(core): post sse endpoint empty response #17098 by @kamilmysliwiec in nestjs/nest#17099

Full Changelog: nestjs/nest@v11.1.25...v11.1.26

v11.1.25

What's Changed

fix(microservices): reject pending Redis requests on close by @yudin-s in nestjs/nest#17024

fix(core): register SSE close listener before async setup by @fallintoplace in nestjs/nest#17018

fix(platform-fastify): remove pathname ending slash by @kamilmysliwiec in nestjs/nest#17094

New Contributors

@fallintoplace made their first contribution in nestjs/nest#17018

@DucMinhNe made their first contribution in nestjs/nest#17085

@iambeaukim made their first contribution in nestjs/nest#17091

Full Changelog: nestjs/nest@v11.1.24...v11.1.25

v11.1.24 (2026-05-25)

Bug fixes

core

#17009 fix(core): reset dependency-tree cache on metadata changes (@puneetdixit200)

Enhancements

core

#16997 feat(core): warn on late websocket adapter registration (@hbinhng)

Dependencies

platform-ws

#17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@dependabot[bot])

Committers: 2

Nguyễn Hải Bình (@hbinhng)

Puneet Dixit (@puneetdixit200)

v11.1.23 (2026-05-21)

Bug fixes

core

nestjs/nest#16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20

Committers: 1

Kamil Mysliwiec (@kamilmysliwiec)

v11.1.22 (2026-05-21)

Bug fixes

... (truncated)

Commits

9ff83d5 chore(release): publish v11.1.26 release
02f8041 chore(release): publish v11.1.25 release
d8a0ab8 chore(release): publish v11.1.24 release
2dccece chore: update readmes
b8be8c1 chore(release): publish v11.1.23 release
801c46f chore(release): publish v11.1.22 release
983dd52 chore(release): publish v11.1.21 release
a0b0139 chore: update readme
See full diff in compare view

Updates @sentry/node from 10.53.1 to 10.57.0

Release notes

Sourced from @sentry/node's releases.

10.57.0

Important Changes
feat(angular): Add support for Angular 22 (#21330)

@sentry/angular now officially supports Angular 22.
ref(core): Deprecate sendDefaultPii in favor of dataCollection (#21277)

sendDefaultPii is deprecated and will be removed in v11. The new dataCollection option lets you control each category of collected data. sendDefaultPii: true still works and maps to enabling all dataCollection categories. dataCollection.userInfo defaults to true when dataCollection is provided, meaning auto-populated user.* fields (e.g. IP address from a request) are collected by default. Data you set explicitly (like via Sentry.setUser()) is always sent regardless. When dataCollection is not set at all, the legacy sendDefaultPii behavior applies (userInfo: false by default) to preserve backward compatibility.

Note that an empty dataCollection: {} falls back to more permissive defaults than sendDefaultPii: false, so replicate the old behavior by opting out explicitly:
Sentry.init({
  dataCollection: {
    userInfo: false,
    genAI: { inputs: false, outputs: false },
    httpBodies: [],
    httpHeaders: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
    cookies: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
    queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
  },
});
Other Changes

feat: Use dataCollection.frameContextLines for ContextLines integration (#21323)

feat(cloudflare): Auto instrument D1 based on env (#21276)

feat(core): Change default of dataCollection.userInfo to true (#21348)

feat(core): Default dataCollection.httpBodies to all valid body types (#21352)

feat(hono): Filter noisy transactions (favicon etc) (#21365)

fix(cloudflare): Don't track negatively sampled spans (#21367)

fix(core): Use safeDateNow calls for new Date() reads (#21351)

fix(nextjs): Shim pinoIntegration on edge runtime (#21347)

fix(node): Prevent PostgresJs integration from emitting duplicate spans per query (#21364)

fix(node-core): Read __SENTRY_SERVER_MODULES__ lazily so Turbopack injection is honored (#21339)

fix(react): Detect React Router v6/v7 navigations in a layout effect to propagate the correct trace (#21326)

fix(react): Remove unused react.componentStack event context (#21183)

fix(replays): Record sentry._internal.replay_is_buffering for spans (#21297)

chore: Bump volta node version from 20.19.2 to 20.19.5 (#21359)

... (truncated)

Changelog

Sourced from @sentry/node's changelog.

10.57.0

Important Changes
feat(angular): Add support for Angular 22 (#21330)

@sentry/angular now officially supports Angular 22.
ref(core): Deprecate sendDefaultPii in favor of dataCollection (#21277)

sendDefaultPii is deprecated and will be removed in v11. The new dataCollection option lets you control each category of collected data. sendDefaultPii: true still works and maps to enabling all dataCollection categories. dataCollection.userInfo defaults to true when dataCollection is provided, meaning auto-populated user.* fields (e.g. IP address from a request) are collected by default. Data you set explicitly (like via Sentry.setUser()) is always sent regardless. When dataCollection is not set at all, the legacy sendDefaultPii behavior applies (userInfo: false by default) to preserve backward compatibility.

Note that an empty dataCollection: {} falls back to more permissive defaults than sendDefaultPii: false, so replicate the old behavior by opting out explicitly:
Sentry.init({
  dataCollection: {
    userInfo: false,
    genAI: { inputs: false, outputs: false },
    httpBodies: [],
    httpHeaders: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
    cookies: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
    queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
  },
});
Other Changes

feat: Use dataCollection.frameContextLines for ContextLines integration (#21323)

feat(cloudflare): Auto instrument D1 based on env (#21276)

feat(core): Change default of dataCollection.userInfo to true (#21348)

feat(core): Default dataCollection.httpBodies to all valid body types (#21352)

feat(hono): Filter noisy transactions (favicon etc) (#21365)

fix(cloudflare): Don't track negatively sampled spans (#21367)

fix(core): Use safeDateNow calls for new Date() reads (#21351)

fix(nextjs): Shim pinoIntegration on edge runtime (#21347)

fix(node): Prevent PostgresJs integration from emitting duplicate spans per query (#21364)

fix(node-core): Read __SENTRY_SERVER_MODULES__ lazily so Turbopack injection is honored (#21339)

fix(react): Detect React Router v6/v7 navigations in a layout effect to propagate the correct trace (#21326)

fix(react): Remove unused react.componentStack event context (#21183)

fix(replays): Record sentry._internal.replay_is_buffering for spans (#21297)

... (truncated)

Commits

950cf97 release: 10.57.0
55f9343 Merge pull request #21369 from getsentry/prepare-release/10.57.0
88d9d30 meta(changelog): Update changelog for 10.57.0
03ffd25 fix(cloudflare): Don't track negatively sampled spans (#21367)
7c19ead ref(node): Streamline sql-common (#21360)
95df562 feat(hono): Filter noisy transactions (favicon etc) (#21365)
92eb5d2 feat(deps): Bump hono from 4.12.18 to 4.12.21 (#21341)
c6f790b fix(node): Prevent PostgresJs integration from emitting duplicate spans per q...
d645349 ref(node): Streamline lru-memoizer instrumentation (#21350)
4293015 feat(deps): Bump @types/aws-lambda from 8.10.150 to 8.10.161 (#21105)
Additional commits viewable in compare view

Updates @types/node from 25.7.0 to 25.9.2

Commits

See full diff in compare view

Updates axios from 1.16.1 to 1.17.0

Release notes

Sourced from axios's releases.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)

Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)

Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)

Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)

Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)

Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)

CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)

Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)

Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)

Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@BasixKOR (#6792)

@carladams1299-lab (#10861)

@LaplaceYoung (#10812)

@JamieMagee (#10939)

@RonGamzu (#10905)

@sapirbaruch (#10891)

@nezukoagent (#10901)

@devareddy05 (#10929)

@Mohammad-Faiz-Cloud-Engineer (#10922)

@azandabot (#10931)

@niksy (#10896)

Full Changelog

Changelog

Sourced from axios's changelog.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)

Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)

Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)

Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)

Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)

Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)

CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)

Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)

Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)

Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@BasixKOR (#6792)

@carladams1299-lab (#10861)

@LaplaceYoung (#10812)

@JamieMagee (#10939)

@RonGamzu (#10905)

@sapirbaruch (#10891)

@nezukoagent (#10901)

@devareddy05 (#10929)

@Mohammad-Faiz-Cloud-Engineer (#10922)

@azandabot (#10931)

@niksy (#10896)

Full Changelog

Commits

4306df2 chore: add fun 88 sponsorship
931cc8f chore(release): prepare release 1.17.0 (#10983)
38ba1b3 fix(fetch): support basic auth from URL (#10896)
32e2515 fix: replace ternary side effect in script (#10931)
030e722 chore(deps): bump axios from 1.15.2 to 1.16.1 in /docs (#10960)
ec63164 chore: remove openspec (#10958)
3dec28f fix(http): preserve TLS options for proxy tunnels (#10957)
a2390a5 fix: correct isCancel type to narrow to CanceledError<T> (#10952)
fa01b92 chore(deps-dev): bump tmp from 0.2.5 to 0.2.7 in /docs (#10954)
2d2314a fix: AxiosHeaders toJSON()Description has been truncated

…pdates Bumps the dependencies group with 25 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `11.1.20` | `11.1.26` | | [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `11.1.20` | `11.1.26` | | [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express) | `11.1.20` | `11.1.26` | | [@nestjs/testing](https://github.com/nestjs/nest/tree/HEAD/packages/testing) | `11.1.20` | `11.1.26` | | [@nestjs/websockets](https://github.com/nestjs/nest/tree/HEAD/packages/websockets) | `11.1.20` | `11.1.26` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.53.1` | `10.57.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.7.0` | `25.9.2` | | [axios](https://github.com/axios/axios) | `1.16.1` | `1.17.0` | | [bullmq](https://github.com/taskforcesh/bullmq) | `5.76.8` | `5.78.0` | | [date-fns](https://github.com/date-fns/date-fns) | `4.1.0` | `4.4.0` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.5.1` | `8.5.2` | | [graphql](https://github.com/graphql/graphql-js) | `16.14.0` | `16.14.2` | | [helmet](https://github.com/helmetjs/helmet) | `8.1.0` | `8.2.0` | | [ioredis](https://github.com/luin/ioredis) | `5.10.1` | `5.11.1` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.20.0` | `8.21.0` | | [puppeteer](https://github.com/puppeteer/puppeteer) | `24.43.1` | `25.1.0` | | [rate-limiter-flexible](https://github.com/animir/node-rate-limiter-flexible) | `11.1.0` | `11.2.0` | | [redis](https://github.com/redis/node-redis) | `5.12.1` | `6.0.0` | | [stripe](https://github.com/stripe/stripe-node) | `22.1.1` | `22.2.0` | | [@nestjs/cli](https://github.com/nestjs/nest-cli) | `11.0.21` | `11.0.23` | | [commander](https://github.com/tj/commander.js) | `14.0.3` | `15.0.0` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.1` | `10.0.3` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `29.7.0` | `30.4.2` | | [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest) | `29.5.14` | `30.0.0` | Updates `@nestjs/common` from 11.1.20 to 11.1.26 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.26/packages/common) Updates `@nestjs/core` from 11.1.20 to 11.1.26 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.26/packages/core) Updates `@nestjs/platform-express` from 11.1.20 to 11.1.26 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.26/packages/platform-express) Updates `@nestjs/testing` from 11.1.20 to 11.1.26 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.26/packages/testing) Updates `@nestjs/websockets` from 11.1.20 to 11.1.26 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.26/packages/websockets) Updates `@sentry/node` from 10.53.1 to 10.57.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.53.1...10.57.0) Updates `@types/node` from 25.7.0 to 25.9.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `axios` from 1.16.1 to 1.17.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.16.1...v1.17.0) Updates `bullmq` from 5.76.8 to 5.78.0 - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](taskforcesh/bullmq@v5.76.8...v5.78.0) Updates `date-fns` from 4.1.0 to 4.4.0 - [Release notes](https://github.com/date-fns/date-fns/releases) - [Commits](date-fns/date-fns@v4.1.0...v4.4.0) Updates `express-rate-limit` from 8.5.1 to 8.5.2 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.5.1...v8.5.2) Updates `graphql` from 16.14.0 to 16.14.2 - [Release notes](https://github.com/graphql/graphql-js/releases) - [Commits](graphql/graphql-js@v16.14.0...v16.14.2) Updates `helmet` from 8.1.0 to 8.2.0 - [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md) - [Commits](helmetjs/helmet@v8.1.0...v8.2.0) Updates `ioredis` from 5.10.1 to 5.11.1 - [Release notes](https://github.com/luin/ioredis/releases) - [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md) - [Commits](redis/ioredis@v5.10.1...v5.11.1) Updates `js-yaml` from 4.1.1 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `pg` from 8.20.0 to 8.21.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.21.0/packages/pg) Updates `puppeteer` from 24.43.1 to 25.1.0 - [Release notes](https://github.com/puppeteer/puppeteer/releases) - [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md) - [Commits](puppeteer/puppeteer@puppeteer-v24.43.1...puppeteer-v25.1.0) Updates `rate-limiter-flexible` from 11.1.0 to 11.2.0 - [Release notes](https://github.com/animir/node-rate-limiter-flexible/releases) - [Commits](animir/node-rate-limiter-flexible@v11.1.0...v11.2.0) Updates `redis` from 5.12.1 to 6.0.0 - [Release notes](https://github.com/redis/node-redis/releases) - [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md) - [Commits](https://github.com/redis/node-redis/compare/redis@5.12.1...redis@6.0.0) Updates `stripe` from 22.1.1 to 22.2.0 - [Release notes](https://github.com/stripe/stripe-node/releases) - [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md) - [Commits](stripe/stripe-node@v22.1.1...v22.2.0) Updates `@nestjs/cli` from 11.0.21 to 11.0.23 - [Release notes](https://github.com/nestjs/nest-cli/releases) - [Commits](nestjs/nest-cli@11.0.21...11.0.23) Updates `commander` from 14.0.3 to 15.0.0 - [Release notes](https://github.com/tj/commander.js/releases) - [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md) - [Commits](tj/commander.js@v14.0.3...v15.0.0) Updates `concurrently` from 9.2.1 to 10.0.3 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](open-cli-tools/concurrently@v9.2.1...v10.0.3) Updates `jest` from 29.7.0 to 30.4.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.4.2/packages/jest) Updates `@types/jest` from 29.5.14 to 30.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest) --- updated-dependencies: - dependency-name: "@nestjs/common" dependency-version: 11.1.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@nestjs/core" dependency-version: 11.1.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@nestjs/platform-express" dependency-version: 11.1.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@nestjs/testing" dependency-version: 11.1.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@nestjs/websockets" dependency-version: 11.1.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@sentry/node" dependency-version: 10.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/node" dependency-version: 25.9.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: axios dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: bullmq dependency-version: 5.78.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: date-fns dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: express-rate-limit dependency-version: 8.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: graphql dependency-version: 16.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: helmet dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: ioredis dependency-version: 5.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: pg dependency-version: 8.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: puppeteer dependency-version: 25.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: rate-limiter-flexible dependency-version: 11.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: redis dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: stripe dependency-version: 22.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@nestjs/cli" dependency-version: 11.0.23 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: commander dependency-version: 15.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: concurrently dependency-version: 10.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: jest dependency-version: 30.4.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: "@types/jest" dependency-version: 30.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the dependencies group across 1 directory with 25 updates#297

build(deps): bump the dependencies group across 1 directory with 25 updates#297
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-a279303bdc

dependabot Bot commented on behalf of github Jun 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 9, 2026

v11.1.26

What's Changed

v11.1.25

What's Changed

New Contributors

v11.1.24 (2026-05-25)

Bug fixes

Enhancements

Dependencies

Committers: 2

v11.1.23 (2026-05-21)

Bug fixes

Committers: 1

v11.1.22 (2026-05-21)

Bug fixes

v11.1.26

What's Changed

v11.1.25

What's Changed

New Contributors

v11.1.24 (2026-05-25)

Bug fixes

Enhancements

Dependencies

Committers: 2

v11.1.23 (2026-05-21)

Bug fixes

Committers: 1

v11.1.22 (2026-05-21)

Bug fixes

v11.1.26

What's Changed

v11.1.25

What's Changed

New Contributors

v11.1.24 (2026-05-25)

Bug fixes

Enhancements

Dependencies

Committers: 2

v11.1.23 (2026-05-21)

Bug fixes

Committers: 1

v11.1.22 (2026-05-21)

Bug fixes

v11.1.26

What's Changed

v11.1.25

What's Changed

New Contributors

v11.1.24 (2026-05-25)

Bug fixes

Enhancements

Dependencies

Committers: 2

v11.1.23 (2026-05-21)

Bug fixes

Committers: 1

v11.1.22 (2026-05-21)

Bug fixes

v11.1.26

What's Changed

v11.1.25

What's Changed

New Contributors

v11.1.24 (2026-05-25)

Bug fixes

Enhancements

Dependencies

Committers: 2

v11.1.23 (2026-05-21)

Bug fixes

Committers: 1

v11.1.22 (2026-05-21)

Bug fixes

10.57.0

Important Changes

Other Changes