Skip to content

Bump the backend group across 1 directory with 7 updates - #26

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-635ae70d79
Closed

Bump the backend group across 1 directory with 7 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-635ae70d79

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown

Bumps the backend group with 7 updates in the /backend directory:

Package From To
@sentry/node 10.68.0 10.69.0
express-rate-limit 8.5.2 8.6.1
google-auth-library 10.9.0 10.9.1
helmet 8.1.0 8.3.0
mysql2 3.16.3 3.23.2
validator 13.15.26 13.15.35
prettier 3.9.1 3.9.6

Updates @sentry/node from 10.68.0 to 10.69.0

Release notes

Sourced from @​sentry/node's releases.

10.69.0

Important Changes

  • feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#22786)

The Cloudflare SDK adds a new instrumentAgentWithSentry API for Cloudflare Agents. It works like instrumentDurableObjectWithSentry for Agent classes from the agents SDK and additionally creates spans for @callable RPC methods and automatically sets the conversationId based on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).

Other Changes

  • feat(v10/cloudflare): Add Spotlight integration for local dev event forwarding (#22796)
  • feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)
  • feat(v10/cloudflare): Filter framework-internal Durable Object storage spans (#22770)
  • feat(v10/cloudflare): Instrument Agents automatically (#22788)
  • feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)
  • fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)
  • fix(v10/cloudflare): Filter CREATE INDEX spans on cf_-prefixed tables (#22767)
  • fix(v10/cloudflare): Prevent AI provider skips (#22771)
  • fix(v10/core): Summarize SQLite upserts so Durable Object cf_ spans stay filtered (#22766)
  • fix(v10/effect): Set sentry.origin on logs from SentryEffectLogger (#22806)
  • fix(v10/gatsby): Add React 19 to peer dependency range (#22675)
  • fix(v10/node): Unpin @apm-js-collab/code-transformer-bundler-plugins (#22678)
  • fix(v10/server-utils): Do not inject dc into client bundle (#22765)
  • test(v10/cloudflare): Pin mcp as agent depends on it (#22769)

Bundle size 📦

Path Size
@​sentry/browser 27.11 KB
@​sentry/browser - with treeshaking flags 25.59 KB
@​sentry/browser (incl. Tracing) 45.51 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.25 KB
@​sentry/browser (incl. Tracing, Profiling) 50.15 KB
@​sentry/browser (incl. Tracing, Replay) 83.84 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.71 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.44 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.79 KB
@​sentry/browser (incl. Feedback) 43.88 KB
@​sentry/browser (incl. sendFeedback) 31.79 KB
@​sentry/browser (incl. FeedbackAsync) 36.8 KB
@​sentry/browser (incl. Metrics) 28.17 KB
@​sentry/browser (incl. Logs) 28.39 KB
@​sentry/browser (incl. Metrics & Logs) 29.07 KB
@​sentry/react 28.87 KB

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.69.0

Important Changes

  • feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#22786)

The Cloudflare SDK adds a new instrumentAgentWithSentry API for Cloudflare Agents. It works like instrumentDurableObjectWithSentry for Agent classes from the agents SDK and additionally creates spans for @callable RPC methods and automatically sets the conversationId based on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).

Other Changes

  • feat(v10/cloudflare): Add Spotlight integration for local dev event forwarding (#22796)
  • feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)
  • feat(v10/cloudflare): Filter framework-internal Durable Object storage spans (#22770)
  • feat(v10/cloudflare): Instrument Agents automatically (#22788)
  • feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)
  • fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)
  • fix(v10/cloudflare): Filter CREATE INDEX spans on cf_-prefixed tables (#22767)
  • fix(v10/cloudflare): Prevent AI provider skips (#22771)
  • fix(v10/core): Summarize SQLite upserts so Durable Object cf_ spans stay filtered (#22766)
  • fix(v10/effect): Set sentry.origin on logs from SentryEffectLogger (#22806)
  • fix(v10/gatsby): Add React 19 to peer dependency range (#22675)
  • fix(v10/node): Unpin @apm-js-collab/code-transformer-bundler-plugins (#22678)
  • fix(v10/server-utils): Do not inject dc into client bundle (#22765)
  • test(v10/cloudflare): Pin mcp as agent depends on it (#22769)
Commits
  • 417af5d release: 10.69.0
  • e7cf605 meta(changelog): Update changelog for 10.69.0 (#22807)
  • 7c5a00e fix(v10/effect): Set sentry.origin on logs from SentryEffectLogger (#22806)
  • df53214 feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)
  • e96e15e feat(v10/cloudflare): Add Spotlight integration for local dev event forwardin...
  • ea4a322 fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)
  • 6a84103 feat(v10/cloudflare): Instrument Agents automatically (#22788)
  • f0c3569 feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)
  • 0516355 feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#2...
  • d3a6e52 fix(v10/cloudflare): Filter CREATE INDEX spans on cf_-prefixed tables (#2...
  • Additional commits viewable in compare view

Updates express-rate-limit from 8.5.2 to 8.6.1

Release notes

Sourced from express-rate-limit's releases.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

Commits
  • c7fced5 8.6.1
  • b21110e chore: deprecate millisecond-based time constants (#662)
  • fad3d85 chore(deps-dev): bump the development-dependencies group with 4 updates (#660)
  • fffb3c4 8.6.0
  • f366b2d docs: debugging guide, time constants, & v8.6.0 changelog (#652)
  • 593ddd2 fix: make debug output easier to read (#653)
  • ef8c129 fix: Pin safe version of @​asyncapi/specs dev dep (#659)
  • 7b05e0d feat: add time constants to support more readable values for windowMs (#655)
  • 863e730 chore(deps-dev): bump the development-dependencies group with 3 updates (#657)
  • e0e711e fix: correct wording in usage documentation for express-rate-limit (#656)
  • Additional commits viewable in compare view

Updates google-auth-library from 10.9.0 to 10.9.1

Release notes

Sourced from google-auth-library's releases.

google-auth-library: v10.9.1

10.9.1 (2026-07-23)

Bug Fixes

  • auth: Add GOOGLE_APPLICATION_CREDENTIALS context to credential load errors (#8800) (829990f), refs #8799
  • auth: Honor CLOUDSDK_CONFIG when locating the ADC well-known file (#8798) (6e912cf), refs #8797
Changelog

Sourced from google-auth-library's changelog.

10.9.1 (2026-07-23)

Bug Fixes

  • auth: Add GOOGLE_APPLICATION_CREDENTIALS context to credential load errors (#8800) (829990f), refs #8799
  • auth: Honor CLOUDSDK_CONFIG when locating the ADC well-known file (#8798) (6e912cf), refs #8797
Commits
  • 6b9fd1a chore: release main (#8956)
  • 829990f fix(auth): add GOOGLE_APPLICATION_CREDENTIALS context to credential load erro...
  • 6e912cf fix(auth): honor CLOUDSDK_CONFIG when locating the ADC well-known file (#8798)
  • 5bd6b22 chore: revert "feat(auth): Regional access boundaries main merge (#8665)" (#8...
  • See full diff in compare view

Updates helmet from 8.1.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

  • Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
  • Content-Security-Policy: improved error handling for invalid directive names

Fixed

  • Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
  • Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
  • Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

  • Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
  • Improve error message when passing duplicate options
Commits
  • 75f1a98 8.3.0
  • f03f70d Update changelog for 8.3.0 release
  • a307fce Fix capitalization in CSP package changelog
  • 5347b43 Format default CSP in README for readability
  • 9afc570 CSP: fix middleware-specific README missing link
  • 266c95c Minor speedups to project setups test
  • 7a4196c CSP: update package-specific changelog
  • 02716b4 CSP: improve performance when there are no dynamic directives
  • 3f511ed CSP: move utility functions to separate file
  • 80338af CSP: disabling defaults with no directives is now an error
  • Additional commits viewable in compare view

Updates mysql2 from 3.16.3 to 3.23.2

Release notes

Sourced from mysql2's releases.

v3.23.2

3.23.2 (2026-07-27)

Bug Fixes

  • correct connectAttributes typo in ChangeUser packet (#4423) (f64ce07), closes #2140
  • don't leave a failed execute as the active command (#4425) (fbd64b6)

v3.23.1

3.23.1 (2026-07-19)

Bug Fixes

  • security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
  • parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

v3.23.0

3.23.0 (2026-07-13)

Features

  • return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
  • sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
  • support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

v3.22.6

3.22.6 (2026-07-07)

Bug Fixes

  • sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

v3.22.5

3.22.5 (2026-06-06)

Bug Fixes

  • keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#4327) (2af33a1)

v3.22.4

3.22.4 (2026-05-24)

Bug Fixes

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.23.2 (2026-07-27)

Bug Fixes

  • correct connectAttributes typo in ChangeUser packet (#4423) (f64ce07), closes #2140
  • don't leave a failed execute as the active command (#4425) (fbd64b6)

3.23.1 (2026-07-19)

Bug Fixes

  • security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
  • parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

3.23.0 (2026-07-13)

Features

  • return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
  • sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
  • support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

3.22.6 (2026-07-07)

Bug Fixes

  • sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

3.22.5 (2026-06-06)

Bug Fixes

  • keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#4327) (2af33a1)

3.22.4 (2026-05-26)

Bug Fixes

3.22.3 (2026-04-24)

Bug Fixes

... (truncated)

Commits
  • a987302 chore(master): release 3.23.2 (#4424)
  • 6c0cbc6 build(deps): bump postcss from 8.5.15 to 8.5.23 in /website (#4437)
  • 2aec892 build(deps): bump lucide-react from 1.26.0 to 1.27.0 in /website (#4436)
  • 4f7a589 build(deps): bump sass from 1.101.7 to 1.102.0 in /website (#4435)
  • 992adc5 build(deps): bump lucide-react from 1.25.0 to 1.26.0 in /website (#4431)
  • 26c956b build(deps): bump sass from 1.101.6 to 1.101.7 in /website (#4432)
  • e6a1cf7 build(deps): bump sass from 1.101.3 to 1.101.6 in /website (#4427)
  • 3f240ce build(deps): bump fast-uri from 3.1.2 to 3.1.4 in /website (#4422)
  • 28ad315 build(deps): bump immutable from 5.1.5 to 5.1.9 in /website (#4421)
  • 67821f8 build(deps): bump svgo from 3.3.3 to 3.3.4 in /website (#4420)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mysql2 since your current version.


Updates validator from 13.15.26 to 13.15.35

Release notes

Sourced from validator's releases.

13.15.35

Fixes, New Locales and Enhancements

New Contributors

Full Changelog: validatorjs/validator.js@13.15.26...13.15.35

Changelog

Sourced from validator's changelog.

13.15.35

Fixes, New Locales and Enhancements

Commits
  • 7a80797 maintenance: 2604 release (#2695)
  • 941db7f fix(isSlug): restrict allowed characters to valid slug charset (#2693)
  • 2758f70 chore: fix typo in comment (#2591)
  • fcfbff5 feat(isJson): allow any valid JSON value to pass (#2690)
  • f06caee refactor: replace if-then-else flow by a single return statement (#2592)
  • 9fa1e3a feat(isPostalCode): Add postal code for Monaco (#2682)
  • b1aea75 feat(isMobilePhone): add Djibouti (fr-DJ) mobile phone validation (#2676)
  • f715cdd fix(isPassportNumber): improve MX locale (#2643)
  • e8c6914 fix(isTaxID): add formatted CPF support and additional test cases for pt-BR l...
  • 90b0a9a fix(isTaxID): improve pt-BR locale by adding support for alphanumeric CNPJ ...
  • Additional commits viewable in compare view

Updates prettier from 3.9.1 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

  • Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

  1. Install the plugin:

    yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the backend group with 7 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.68.0` | `10.69.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.5.2` | `8.6.1` |
| [google-auth-library](https://github.com/googleapis/google-cloud-node/tree/HEAD/core/packages/google-auth-library-nodejs) | `10.9.0` | `10.9.1` |
| [helmet](https://github.com/helmetjs/helmet) | `8.1.0` | `8.3.0` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.16.3` | `3.23.2` |
| [validator](https://github.com/validatorjs/validator.js) | `13.15.26` | `13.15.35` |
| [prettier](https://github.com/prettier/prettier) | `3.9.1` | `3.9.6` |



Updates `@sentry/node` from 10.68.0 to 10.69.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.69.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.68.0...10.69.0)

Updates `express-rate-limit` from 8.5.2 to 8.6.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.5.2...v8.6.1)

Updates `google-auth-library` from 10.9.0 to 10.9.1
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/core/packages/google-auth-library-nodejs/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/google-auth-library-v10.9.1/core/packages/google-auth-library-nodejs)

Updates `helmet` from 8.1.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v8.1.0...v8.3.0)

Updates `mysql2` from 3.16.3 to 3.23.2
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.16.3...v3.23.2)

Updates `validator` from 13.15.26 to 13.15.35
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.15.26...13.15.35)

Updates `prettier` from 3.9.1 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.1...3.9.6)

---
updated-dependencies:
- dependency-name: "@sentry/node"
  dependency-version: 10.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: express-rate-limit
  dependency-version: 8.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: google-auth-library
  dependency-version: 10.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: mysql2
  dependency-version: 3.23.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: validator
  dependency-version: 13.15.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 3, 2026
@vercel

vercel Bot commented Aug 3, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
frameset Ready Ready Preview Aug 3, 2026 12:48pm

@codecov

codecov Bot commented Aug 3, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 1, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/backend/backend-635ae70d79 branch September 1, 2026 10:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants