Bump the backend group across 1 directory with 9 updates

[dependabot]

Bumps the backend group with 9 updates in the /backend directory:

Package	From	To
@sentry/node	10.68.0	10.72.0
express-rate-limit	8.5.2	8.7.0
google-auth-library	10.9.0	10.9.1
helmet	8.1.0	8.3.0
mysql2	3.16.3	3.24.2
nodemailer	9.0.3	9.0.6
validator	13.15.26	13.15.35
jest	30.4.2	30.5.0
prettier	3.9.1	3.9.6

Updates @sentry/node from 10.68.0 to 10.72.0

Release notes

Sourced from @​sentry/node's releases.

10.72.0

Important Changes

• AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

  Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

• feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

  The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

• fix(v10/astro): support astro v7 route patterns properly (#23657)
• fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
• fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
• fix(v10/node): Only end the process session when it is still ok (#23731)
• fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
• fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
• fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
• fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
• fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
• fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

• chore(v10): Add external contributor to CHANGELOG.md (#23626)
• docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#23641)
• test(v10/e2e): Fix scripts for nuxt dev server (#23658)
• test(v10/e2e): Look up events via the organization trace endpoint (#23680)
• test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

Bundle size 📦

Path	Size
@​sentry/browser	27.1 KB
@​sentry/browser - with treeshaking flags	25.58 KB
@​sentry/browser (incl. Tracing)	45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.28 KB
@​sentry/browser (incl. Tracing, Profiling)	50.17 KB
@​sentry/browser (incl. Tracing, Replay)	83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.83 KB

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.72.0

Important Changes

• AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

  Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

• feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

  The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

• fix(v10/astro): support astro v7 route patterns properly (#23657)
• fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
• fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
• fix(v10/node): Only end the process session when it is still ok (#23731)
• fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
• fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
• fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
• fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
• fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
• fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

• chore(v10): Add external contributor to CHANGELOG.md (#23626)
• docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#23641)
• test(v10/e2e): Fix scripts for nuxt dev server (#23658)
• test(v10/e2e): Look up events via the organization trace endpoint (#23680)
• test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

10.71.0

Important Changes

• feat(v10/core)!: Enable logs by default (#23311)

The enableLogs client option now defaults to true, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call the Sentry.logger.* APIs or add a log-forwarding integration (such as consoleLoggingIntegration, pinoIntegration, or the winston transport), and you can set enableLogs: false to opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.

Other Changes

• feat(v10/core): Deprecate scope.clear() method (#23231)
• fix(v10/core): Bound child span tracking on long-lived spans (#23406)

... (truncated)

Commits

• 0d23628 release: 10.72.0
• ac2094d meta(changelog): Update changelog for 10.72.0 (#23743)
• f325434 feat(v10/cloudflare): Derive rpcTracePropagationBindings from the wrangler co...
• 7917b0d feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737)
• b61e912 fix(v10/node): Only end the process session when it is still ok (#23731)
• 4316785 test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)
• e09fdf8 fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
• 817056d test(v10/e2e): Look up events via the organization trace endpoint (#23680)
• 83c644d fix(v10/server-utils): Stop shipping orchestrion bundler plugins as productio...
• 04a52dd fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
• Additional commits viewable in compare view

Updates express-rate-limit from 8.5.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

Commits

• 48db09e 8.7.0
• dce5871 v8.7.0 changelog
• 2f08044 Add inspect.software health badge (#673)
• a29757c feat: add retryAfter option (#661)
• 146e88b chore: rename license
• 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
• 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
• 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
• 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
• 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
• Additional commits viewable in compare view

Updates google-auth-library from 10.9.0 to 10.9.1

Changelog

Sourced from google-auth-library's changelog.

10.9.1 (2026-07-23)

Bug Fixes

• auth: Add GOOGLE_APPLICATION_CREDENTIALS context to credential load errors (#8800) (829990f), refs #8799
• auth: Honor CLOUDSDK_CONFIG when locating the ADC well-known file (#8798) (6e912cf), refs #8797

Commits

• 6b9fd1a chore: release main (#8956)
• 829990f fix(auth): add GOOGLE_APPLICATION_CREDENTIALS context to credential load erro...
• 6e912cf fix(auth): honor CLOUDSDK_CONFIG when locating the ADC well-known file (#8798)
• 5bd6b22 chore: revert "feat(auth): Regional access boundaries main merge (#8665)" (#8...
• See full diff in compare view

Updates helmet from 8.1.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

• Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
• Content-Security-Policy: improved error handling for invalid directive names

Fixed

• Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
• Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
• Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

• Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
• Improve error message when passing duplicate options

Commits

• 75f1a98 8.3.0
• f03f70d Update changelog for 8.3.0 release
• a307fce Fix capitalization in CSP package changelog
• 5347b43 Format default CSP in README for readability
• 9afc570 CSP: fix middleware-specific README missing link
• 266c95c Minor speedups to project setups test
• 7a4196c CSP: update package-specific changelog
• 02716b4 CSP: improve performance when there are no dynamic directives
• 3f511ed CSP: move utility functions to separate file
• 80338af CSP: disabling defaults with no directives is now an error
• Additional commits viewable in compare view

Updates mysql2 from 3.16.3 to 3.24.2

Release notes

Sourced from mysql2's releases.

v3.24.2

3.24.2 (2026-08-24)

Bug Fixes

• correct length-coded number size for the 3-byte range (#4500) (de56272)
• promise: honour trace: false on every promise-API method (#4502) (1dcd8ef), closes #4501

v3.24.1

3.24.1 (2026-08-24)

Performance Improvements

• single-pass utf8 string encoding for outgoing packets (#4495) (183e947)

v3.24.0

3.24.0 (2026-08-23)

Features

• typed parameters, and adopt integer types the server reports (#4488) (8ec20f1)

Bug Fixes

• zero dates come back as "undefined 00:00:00" with dateStrings (#4491) (5bf7bda)

Performance Improvements

• remove per-query and per-row allocation hotspots (#4486) (c86fe5a)
• serialize COM_STMT_EXECUTE in a single exact-size pass (#4494) (f3a60bc)

v3.23.4

3.23.4 (2026-08-19)

Bug Fixes

• keep leading zeros in TIME fractional seconds (#4481) (3cccf4a)
• typings: align callback Pool and PoolConnection types with runtime (#4478) (8b1f829)

v3.23.3

3.23.3 (2026-08-10)

Bug Fixes

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.24.2 (2026-08-24)

Bug Fixes

• correct length-coded number size for the 3-byte range (#4500) (de56272)
• promise: honour trace: false on every promise-API method (#4502) (1dcd8ef), closes #4501

3.24.1 (2026-08-24)

Performance Improvements

• single-pass utf8 string encoding for outgoing packets (#4495) (183e947)

3.24.0 (2026-08-23)

Features

• typed parameters, and adopt integer types the server reports (#4488) (8ec20f1)

Bug Fixes

• zero dates come back as "undefined 00:00:00" with dateStrings (#4491) (5bf7bda)

Performance Improvements

• remove per-query and per-row allocation hotspots (#4486) (c86fe5a)
• serialize COM_STMT_EXECUTE in a single exact-size pass (#4494) (f3a60bc)

3.23.4 (2026-08-19)

Bug Fixes

• keep leading zeros in TIME fractional seconds (#4481) (3cccf4a)
• typings: align callback Pool and PoolConnection types with runtime (#4478) (8b1f829)

3.23.3 (2026-08-10)

Bug Fixes

• honor query-level namedPlaceholders as false (#4460) (20f732b)
• keep connectTimeout active until the handshake completes (#4458) (508a731)
• pool: give each pooled connection its own config copy (#4473) (361d232)
• pool: propagate query dispatch errors instead of throwing (#4459) (7ce6943)

... (truncated)

Commits

• 649e129 chore(master): release 3.24.2 (#4504)
• 87579e1 test: cover length-coded parameter sizes at the 0xFD boundary (#4503)
• 1dcd8ef fix(promise): honour trace: false on every promise-API method (#4502)
• de56272 fix: correct length-coded number size for the 3-byte range (#4500)
• ca10232 chore(master): release 3.24.1 (#4496)
• 183e947 perf: single-pass utf8 string encoding for outgoing packets (#4495)
• fabc3bc chore(master): release 3.24.0 (#4492)
• f3a60bc perf: serialize COM_STMT_EXECUTE in a single exact-size pass (#4494)
• 493f9ec ci: pin EXPLAIN to FORMAT=TRADITIONAL for MySQL 9.5+ (#4493)
• c86fe5a perf: remove per-query and per-row allocation hotspots (#4486)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mysql2 since your current version.

Updates nodemailer from 9.0.3 to 9.0.6

Release notes

Sourced from nodemailer's releases.

v9.0.6

9.0.6 (2026-08-27)

Bug Fixes

• addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
• harden copies of user supplied keys and URL fetching (2f667f4)

v9.0.5

9.0.5 (2026-08-07)

Bug Fixes

• ci: retrigger the workflows dropped during the Actions outage (85d16c1)
• mailer: escape specials in List-* header comments (#1842) (75913bb)
• mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
• mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
• mime: encode DEL in header parameters and List-* comments (cf69430)
• mime: keep control chars out of the remaining header positions (5ed9d26)
• mime: normalize an address parsed out of a string as well (63685f7)
• mime: normalize an address so header and envelope agree (a9343b4)
• mime: stop a header key callback and the dkim tags from injecting (b7d772e)

v9.0.4

9.0.4 (2026-08-04)

Bug Fixes

• mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
• mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
• mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
• mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
• mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)

Changelog

Sourced from nodemailer's changelog.

9.0.6 (2026-08-27)

Bug Fixes

• addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
• harden copies of user supplied keys and URL fetching (2f667f4)

9.0.5 (2026-08-07)

Bug Fixes

• ci: retrigger the workflows dropped during the Actions outage (85d16c1)
• mailer: escape specials in List-* header comments (#1842) (75913bb)
• mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
• mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
• mime: encode DEL in header parameters and List-* comments (cf69430)
• mime: keep control chars out of the remaining header positions (5ed9d26)
• mime: normalize an address parsed out of a string as well (63685f7)
• mime: normalize an address so header and envelope agree (a9343b4)
• mime: stop a header key callback and the dkim tags from injecting (b7d772e)

9.0.4 (2026-08-04)

Bug Fixes

• mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
• mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
• mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
• mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
• mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)

Commits

• 4e467a8 chore(master): release 9.0.6 (#1844)
• e989a22 fix(addressparser): recover the addr-spec from an angle-addr holding whitespace
• 7237b91 chore(deps): update dev dependencies
• 34bc3d8 docs: reframe the EmailEngine README mentions
• 2f667f4 fix: harden copies of user supplied keys and URL fetching
• 742cff9 chore(master): release 9.0.5 (#1843)
• 524f0af chore: apply prettier to the punycode decode loop
• 63685f7 fix(mime): normalize an address parsed out of a string as well
• d899213 test: cover the custom envelope path of every transport
• c4daee0 chore(ci): trigger the workflows now that the Actions outage is over
• Additional commits viewable in compare view

Updates validator from 13.15.26 to 13.15.35

Release notes

Sourced from validator's releases.

13.15.35

Fixes, New Locales and Enhancements

• #2663 isISO31661Alpha2/isISO31661Alpha3: add support for Kosovo (XK / XXK) @​johanpoirier-d4
• #2661 isHexColor: ignore non-object options @​yuna0831
• isTaxID
  • #2644 improve pt-BR locale by adding support for alphanumeric CNPJ format @​easedu
  • #2675 improve pt-BR locale by adding support for formatted CPF values @​easedu
• #2643 isPassportNumber: improve MX locale @​jesroffrouk
• #2676 isMobilePhone: add fr-DJ locale @​Kartikeya-guthub
• #2682 isPostalCode: add MC locale @​moogblob
• #2690 isJSON: allow any valid JSON value to pass @​relu91
• #2693 isSlug: restrict allowed characters to valid slug charset @​Shrawak
• Doc fixes and others:
  • #2658 @​Manaskarthik28
  • #2592 @​noritaka1166
  • #2591 @​noritaka1166

New Contributors

• @​Manaskarthik28 made their first contribution in validatorjs/validator.js#2658
• @​johanpoirier-d4 made their first contribution in validatorjs/validator.js#2663
• @​yuna0831 made their first contribution in validatorjs/validator.js#2661
• @​easedu made their first contribution in validatorjs/validator.js#2644
• @​jesroffrouk made their first contribution in validatorjs/validator.js#2643
• @​Kartikeya-guthub made their first contribution in validatorjs/validator.js#2676
• @​moogblob made their first contribution in validatorjs/validator.js#2682
• @​noritaka1166 made their first contribution in validatorjs/validator.js#2592
• @​relu91 made their first contribution in validatorjs/validator.js#2690
• @​Shrawak made their first contribution in validatorjs/validator.js#2693

Full Changelog: validatorjs/validator.js@13.15.26...13.15.35

Changelog

Sourced from validator's changelog.

13.15.35

Fixes, New Locales and Enhancements

• #2663 isISO31661Alpha2/isISO31661Alpha3: add support for Kosovo (XK / XXK) @​johanpoirier-d4
• #2661 isHexColor: ignore non-object options @​yuna0831
• isTaxID
  • #2644 improve pt-BR locale by adding support for alphanumeric CNPJ format @​easedu
  • #2675 improve pt-BR locale by adding support for formatted CPF values @​easedu
• #2643 isPassportNumber: improve MX locale @​jesroffrouk
• #2676 isMobilePhone: add fr-DJ locale @​Kartikeya-guthub
• #2682 isPostalCode: add MC locale @​moogblob
• #2690 isJSON: allow any valid JSON value to pass @​relu91
• #2693 isSlug: restrict allowed characters to valid slug charset @​Shrawak
• Doc fixes and others:
  • #2658 @​Manaskarthik28
  • #2592 @​noritaka1166
  • #2591 @​noritaka1166

Commits

• 7a80797 maintenance: 2604 release (#2695)
• 941db7f fix(isSlug): restrict allowed characters to valid slug charset (#2693)
• 2758f70 chore: fix typo in comment (#2591)
• fcfbff5 feat(isJson): allow any valid JSON value to pass (#2690)
• f06caee refactor: replace if-then-else flow by a single return statement (#2592)
• 9fa1e3a feat(isPostalCode): Add postal code for Monaco (#2682)
• b1aea75 feat(isMobilePhone): add Djibouti (fr-DJ) mobile phone validation (#2676)
• f715cdd fix(isPassportNumber): improve MX locale (#2643)
• e8c6914 fix(isTaxID): add formatted CPF support and additional test cases for pt-BR l...
• 90b0a9a fix(isTaxID): improve pt-BR locale by adding support for alphanumeric CNPJ ...
• Additional commits viewable in compare view

Updates jest from 30.4.2 to 30.5.0

Release notes

Sourced from jest's releases.

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴

---

This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @​timkindberg (#16053):

const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
fn.whenCalledWith('banana').mockReturnValue('yellow');
fn.whenCalledWith(expect.any(Number)).mockReturnValue('numeric');
fn('apple'); // 'red'
fn('banana'); // 'yellow'
fn(42); // 'numeric'
fn('grape'); // undefined

The returned object is a real Mock, so mockReturnValueOnce, mockResolvedValue, mockImplementation etc. all chain here too. Argument slots accept literals or any asymmetric matcher, with the same equality semantics as toHaveBeenCalledWith(). Calls that match nothing fall through to the base mock. See the Mock Functions docs for matching and precedence details.

Describe-level retries

jest.retryTimes() can now retry a whole describe block instead of a single test, contributed by @​soltonigiri (#16322). Each attempt reruns the block's beforeAll/afterAll hooks, child tests and nested describes, which helps when tests in a block depend on shared state:

describe('workflow', () => {
  jest.retryTimes(3, {entireDescribe: true});
test('first step', () => {});
test('second step', () => {}); // a failure retries the entire block
});

New file watcher

The non-watchman path of jest-haste-map is rewritten. @parcel/watcher replaces the homegrown NodeWatcher and FSEventsWatcher (#16188), and fdir replaces the hand-rolled directory recursion in the crawler (#16187). A batch of fixes also makes watching and indexing survive locked files on Windows, watchman failures, and duplicate manual mocks (#16295, #16358, #16355, #16360).

If you can, please run your suite with --no-watchman (in and out of watch mode) to exercise the new crawler and watchers, and report anything odd 👍

Long-requested dependency updates

• babel-plugin-istanbul is updated to v8 (#16049)
• glob is updated to v13 (#16397)

... (truncated)

Changelog

Sourced from jest's changelog.

30.5.0

Features

• [@jest/expect-utils, jest-mock] Add mockFn.whenCalledWith(...args) for configuring return values per argument list, with first-class asymmetric-matcher support (#16053)
• [@jest/expect-utils] Export AsymmetricMatcher and FunctionParameters types (previously private to expect) (#16053)
• [jest-circus, jest-core, jest-jasmine2, jest-test-result, jest-types] --collectTests now expands test.each/describe.each cases and reports per-status counts (skipped/todo via the new wouldRun flag for selected tests) plus a summary line that match a real run, including under --testNamePattern and .only/fdescribe focus on both the circus and jasmine2 runners (

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frameset	Ready	Preview	Sep 1, 2026 10:15am UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!