Skip to content

build(deps): bump the production-patch group across 1 directory with 9 updates#1556

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-patch-847cd67a9f
Open

build(deps): bump the production-patch group across 1 directory with 9 updates#1556
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-patch-847cd67a9f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-patch group with 9 updates in the / directory:

Package From To
@bufbuild/protobuf 2.12.0 2.12.1
fs-extra 11.3.5 11.3.6
winston-loki 6.1.4 6.1.5
@scalar/express-api-reference 0.10.4 0.10.11
graphql-tools 9.0.28 9.0.33
axios 1.18.0 1.18.1
nodemailer 9.0.1 9.0.3
bson 7.3.0 7.3.1
mongoose 9.7.1 9.7.4

Updates @bufbuild/protobuf from 2.12.0 to 2.12.1

Release notes

Sourced from @​bufbuild/protobuf's releases.

v2.12.1

What's Changed

New Contributors

Full Changelog: bufbuild/protobuf-es@v2.12.0...v2.12.1

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​bufbuild/protobuf since your current version.


Updates fs-extra from 11.3.5 to 11.3.6

Changelog

Sourced from fs-extra's changelog.

11.3.6 / 2026-06-29

  • Fix handling of symlinked destination ancestors in copy/move methods (#1071, #1073)
  • Docs typo fixed (#1074)
Commits

Updates winston-loki from 6.1.4 to 6.1.5

Release notes

Sourced from winston-loki's releases.

v6.1.5

Fixes issues with requests & a potential timestamp overflow

What's Changed

Full Changelog: JaniAnttonen/winston-loki@v6.1.4...v6.1.5

Commits
  • 81283ba Use Node 24 in publish workflow for npm trusted publishing
  • 05ba93b Merge pull request #191 from JaniAnttonen/development
  • abd8afa Merge pull request #190 from JaniAnttonen/fix/reject-non-2xx-responses
  • c899621 Revert lazy btoa require, keep it hoisted in the constructor
  • bb9d409 Reject non-2xx responses from Loki push endpoint
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for winston-loki since your current version.


Updates @scalar/express-api-reference from 0.10.4 to 0.10.11

Changelog

Sourced from @​scalar/express-api-reference's changelog.

0.10.11

Patch Changes

  • #9719: docs: update the Scalar platform overview block in the README

0.10.10

Patch Changes

  • #9710: Republish so the updated README (with the Scalar platform overview) reaches npm. Also renames the README generator metadata in package.json from readme to scalarReadme: npm treats a readme field as the readme text itself, so affected packages were published with a literal [object Object] readme on the registry instead of README.md.

0.10.9

0.10.8

0.10.7

0.10.6

0.10.5

Commits

Updates graphql-tools from 9.0.28 to 9.0.33

Changelog

Sourced from graphql-tools's changelog.

9.0.33

Patch Changes

  • Updated dependencies []:
    • @​graphql-tools/schema@​10.0.38

9.0.32

Patch Changes

  • Updated dependencies []:
    • @​graphql-tools/schema@​10.0.37

9.0.31

Patch Changes

  • Updated dependencies []:
    • @​graphql-tools/schema@​10.0.36

9.0.30

Patch Changes

  • Updated dependencies []:
    • @​graphql-tools/schema@​10.0.35

9.0.29

Patch Changes

  • Updated dependencies []:
    • @​graphql-tools/schema@​10.0.34
Commits
  • 11f0a21 chore(release): update monorepo packages versions (#8303)
  • 3c27f9a chore(release): update monorepo packages versions (#8284)
  • d246275 build(deps): bump the actions-deps group with 4 updates (#8293)
  • 16096f7 build(deps): bump the actions-deps group across 1 directory with 23 updates (...
  • 76b54da chore(release): update monorepo packages versions (#8264)
  • 062d229 chore(release): update monorepo packages versions (#8261)
  • c7f20ac chore(release): update monorepo packages versions (#8157)
  • 1fb1076 build(deps): bump the actions-deps group across 1 directory with 15 updates (...
  • f0caccf build(deps): bump the actions-deps group across 1 directory with 9 updates (#...
  • See full diff in compare view

Updates axios from 1.18.0 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

  • AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
  • Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
  • Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
  • AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

  • Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

  • Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

Commits
  • a209bfb chore(release): prepare release 1.18.1 (#11027)
  • fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
  • 40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
  • a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
  • cf1306a docs: add Deno to install instructions (#11023)
  • b32880a fix: incorrect use of error (#11021)
  • 1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
  • 30499d6 fix: various runtime crashes and type definition mismatches (#10959)
  • 20ce9c4 fix(http): defer env proxy handling to Node (#10942)
  • e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
  • Additional commits viewable in compare view

Updates nodemailer from 9.0.1 to 9.0.3

Release notes

Sourced from nodemailer's releases.

v9.0.3

9.0.3 (2026-06-30)

Bug Fixes

  • smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

v9.0.2

9.0.2 (2026-06-29)

Bug Fixes

  • addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
  • harden smtp-connection low-severity issues (22ddcea)
  • harden smtp-connection response parsing and socket lifecycle (68860b9)
  • prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)
  • reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)
Changelog

Sourced from nodemailer's changelog.

9.0.3 (2026-06-30)

Bug Fixes

  • smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

9.0.2 (2026-06-29)

Bug Fixes

  • addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
  • harden smtp-connection low-severity issues (22ddcea)
  • harden smtp-connection response parsing and socket lifecycle (68860b9)
  • prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)
  • reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)
Commits
  • 1f61eb4 chore(master): release 9.0.3 (#1836)
  • 07d8253 fix(smtp-connection): harden STARTTLS upgrade and secure socket handling (#1835)
  • 4801f3a chore(master): release 9.0.2 (#1832)
  • 9ba1064 fix(addressparser): keep operator chars inside an address-literal as text (#1...
  • 22ddcea fix: harden smtp-connection low-severity issues
  • af002eb chore: add Node.js 26 to the CI test matrix
  • 6347b47 fix: reject CRLF in HTTP proxy CONNECT destination to prevent request injection
  • 68860b9 fix: harden smtp-connection response parsing and socket lifecycle
  • 9517bc5 fix: prevent SES transport callback double-invocation and hang on sync errors...
  • See full diff in compare view

Updates bson from 7.3.0 to 7.3.1

Release notes

Sourced from bson's releases.

v7.3.1

7.3.1 (2026-06-23)

The MongoDB Node.js team is pleased to announce version 7.3.1 of the bson package!

Release Notes

ObjectId initialization now tolerates partial process polyfills

Adds optional chaining to Node.js startup snapshot API calls in ObjectId so that environments with a stubbed or partial process global no longer throw a TypeError at startup.

Bug Fixes

  • NODE-7630: make startup snapshot calls more defensive (#899) (99433cd)

Documentation

We invite you to try the bson library immediately, and report any issues to the NODE project.

Changelog

Sourced from bson's changelog.

7.3.1 (2026-06-23)

Bug Fixes

  • NODE-7630: make startup snapshot calls more defensive (#899) (99433cd)
Commits

Updates mongoose from 9.7.1 to 9.7.4

Release notes

Sourced from mongoose's releases.

9.7.4 / 2026-07-06

  • types(create): fix handling of nested objects typed as interfaces #16363 #16362
  • types: correct this parameter handling for methods with versionKey #16344 #16046
  • docs: add FAQ entry for querySrv ECONNREFUSED errors on Windows with mongodb+srv:// connections #16342 ajay naik

9.7.3 / 2026-06-26

  • types(model): correct Model.validate() return type to Promise #16340 #16338
  • types: use @​standard-schema/spec for StandardSchema types rather than inlining #16341 #16339

9.7.2 / 2026-06-22

  • fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
  • fix(document): avoid accessing special properties in Document.prototype.get()
  • fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
  • docs: update homepage sponsor layout
Changelog

Sourced from mongoose's changelog.

9.7.4 / 2026-07-06

  • types(create): fix handling of nested objects typed as interfaces #16363 #16362
  • types: correct this parameter handling for methods with versionKey #16344 #16046
  • docs: add FAQ entry for querySrv ECONNREFUSED errors on Windows with mongodb+srv:// connections #16342 ajay naik

9.7.3 / 2026-06-26

  • types(model): correct Model.validate() return type to Promise #16340 #16338
  • types: use @​standard-schema/spec for StandardSchema types rather than inlining #16341 #16339

9.7.2 / 2026-06-22

  • fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
  • fix(document): avoid accessing special properties in Document.prototype.get()
  • fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
  • docs: update homepage sponsor layout
Commits
  • 62192d1 chore: release 9.7.4
  • 4d2b1c5 Merge pull request #16363 from Automattic/vkarpov15/gh-16362
  • 06ca603 Potential fix for pull request finding
  • 19ee447 types(create): fix handling of nested objects typed as interfaces
  • e653b37 Merge pull request #16353 from Automattic/dependabot/github_actions/master/ac...
  • 8f0e582 Merge pull request #16354 from Automattic/dependabot/github_actions/master/ac...
  • 78d19ed Merge pull request #16355 from Automattic/dependabot/npm_and_yarn/master/ark/...
  • c4296bb Merge pull request #16358 from Automattic/dependabot/npm_and_yarn/master/mark...
  • 56f1202 Merge pull request #16360 from Automattic/dependabot/npm_and_yarn/master/uuid...
  • 707ba75 Merge pull request #16361 from Automattic/dependabot/npm_and_yarn/master/esli...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the production-patch group across 1 directory with …
b0f8e57 
…9 updates

Bumps the production-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@bufbuild/protobuf](https://github.com/bufbuild/protobuf-es/tree/HEAD/packages/protobuf) | `2.12.0` | `2.12.1` |
| [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.3.5` | `11.3.6` |
| [winston-loki](https://github.com/JaniAnttonen/winston-loki) | `6.1.4` | `6.1.5` |
| [@scalar/express-api-reference](https://github.com/scalar/scalar/tree/HEAD/integrations/express) | `0.10.4` | `0.10.11` |
| [graphql-tools](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/graphql-tools) | `9.0.28` | `9.0.33` |
| [axios](https://github.com/axios/axios) | `1.18.0` | `1.18.1` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.1` | `9.0.3` |
| [bson](https://github.com/mongodb/js-bson) | `7.3.0` | `7.3.1` |
| [mongoose](https://github.com/Automattic/mongoose) | `9.7.1` | `9.7.4` |



Updates `@bufbuild/protobuf` from 2.12.0 to 2.12.1
- [Release notes](https://github.com/bufbuild/protobuf-es/releases)
- [Commits](https://github.com/bufbuild/protobuf-es/commits/v2.12.1/packages/protobuf)

Updates `fs-extra` from 11.3.5 to 11.3.6
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-fs-extra@11.3.5...11.3.6)

Updates `winston-loki` from 6.1.4 to 6.1.5
- [Release notes](https://github.com/JaniAnttonen/winston-loki/releases)
- [Commits](JaniAnttonen/winston-loki@v6.1.4...v6.1.5)

Updates `@scalar/express-api-reference` from 0.10.4 to 0.10.11
- [Release notes](https://github.com/scalar/scalar/releases)
- [Changelog](https://github.com/scalar/scalar/blob/main/integrations/express/CHANGELOG.md)
- [Commits](https://github.com/scalar/scalar/commits/HEAD/integrations/express)

Updates `graphql-tools` from 9.0.28 to 9.0.33
- [Release notes](https://github.com/ardatan/graphql-tools/releases)
- [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/graphql-tools/CHANGELOG.md)
- [Commits](https://github.com/ardatan/graphql-tools/commits/[email protected]/packages/graphql-tools)

Updates `axios` from 1.18.0 to 1.18.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.0...v1.18.1)

Updates `nodemailer` from 9.0.1 to 9.0.3
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.1...v9.0.3)

Updates `bson` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/mongodb/js-bson/releases)
- [Changelog](https://github.com/mongodb/js-bson/blob/main/HISTORY.md)
- [Commits](mongodb/js-bson@v7.3.0...v7.3.1)

Updates `mongoose` from 9.7.1 to 9.7.4
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@9.7.1...9.7.4)

---
updated-dependencies:
- dependency-name: "@bufbuild/protobuf"
  dependency-version: 2.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch
- dependency-name: fs-extra
  dependency-version: 11.3.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch
- dependency-name: winston-loki
  dependency-version: 6.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch
- dependency-name: "@scalar/express-api-reference"
  dependency-version: 0.10.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch
- dependency-name: graphql-tools
  dependency-version: 9.0.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch
- dependency-name: axios
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch
- dependency-name: nodemailer
  dependency-version: 9.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch
- dependency-name: bson
  dependency-version: 7.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch
- dependency-name: mongoose
  dependency-version: 9.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants