[dependabot]

Bumps the minor-and-patch group with 26 updates in the / directory:

Package	From	To
@aws-sdk/client-s3	3.1075.0	3.1141.0
@nestjs/throttler	6.5.0	6.7.1
drizzle-orm	0.45.2	0.45.3
helmet	8.2.0	8.3.0
multer	2.2.0	2.4.0
@types/multer	2.1.0	2.2.0
pg	8.22.0	8.23.0
@types/pg	8.20.0	8.23.1
@eslint/eslintrc	3.3.5	3.3.7
@types/multer	2.1.0	2.2.0
@types/pg	8.20.0	8.23.1
drizzle-kit	0.31.10	0.31.11
globals	17.7.0	17.12.0
jest	30.4.2	30.5.2
prettier	3.9.1	3.9.9
supertest	7.2.2	7.3.0
@types/supertest	7.2.0	7.2.1
ts-jest	29.4.11	29.4.14
typescript-eslint	8.62.0	8.70.1
next	16.2.9	16.3.6
react	19.2.7	19.3.0
@types/react	19.2.17	19.3.0
react-dom	19.2.7	19.3.0
@types/react-dom	19.2.3	19.3.0
@tailwindcss/postcss	4.3.1	4.3.3
@types/leaflet	1.9.21	1.9.22
@types/react	19.2.17	19.3.0
@types/react-dom	19.2.3	19.3.0
eslint-config-next	16.2.9	16.3.6
tailwindcss	4.3.1	4.3.3

Updates @aws-sdk/client-s3 from 3.1075.0 to 3.1141.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1141.0

3.1141.0(2026-09-25)

Chores

• codegen: smithy-aws-typescript-codegen 0.54.0 (#8314) (ad80ce3e)

New Features

• client-connect: Agent Privacy During Hold is a new privacy capability for Amazon Connect Voice that prevents agent audio from being captured in call recordings or Contact Lens conversational analytics during hold. When enabled, agents are automatically muted on entering hold and unmuted on resuming the contact (03527f9e)
• client-qconnect: Release shapes for the proactive agentic recommendations and the multi-knowledge base search features. Increases the maximum length of QuickResponseContent. (e008332b)
• client-bedrock-agent: Adds support for calling VPC configuration API's in Bedrock. These configurations allow the use of On Prem connectors in Bedrock Managed Knowledge bases (18524dc6)
• client-mediaconnect: This release adds support for RTMP push router outputs in AWS Elemental MediaConnect. (5bd8d80b)
• client-securityagent: This release adds the ListActorMessages operation, which returns the multi-factor authentication messages received at an actor's server-generated email address (10e53d50)
• client-arc-region-switch: Adds a service quota checker to Region switch to verify quota parity between your primary and standby Region, and automatically submit quota limit increases. Adds an optional EC2 Auto Scaling and ECS setting that waits for instances or tasks in the scaled-up Region to be healthy in target groups. (cca33e38)
• client-bedrock-agentcore-control: Amazon Bedrock AgentCore Payments now supports credential rotation for payment connectors, letting you rotate API and wallet secrets for Quick Create payment auths from the console. This release also adds Type and Creation type columns to the payment managers views. (adca591f)
• client-neptune-graph: Add GraphIdentifier filter for ListImportTasks (9b9aea9b)
• client-rekognition: This release adds support for Feedback and Metadata in the GetFaceLivenessSessionResults response. Feedback returns codes explaining why a Face Liveness check produced its result. Metadata includes the client SDK type. (0831c361)
• client-glue: add support for table level federation (a44458b7)
• client-wellarchitected: This change releases the Well-Architected Agent, a generative AI service that analyzes a customer's AWS environment and delivers personalized, prioritized recommendations across cost, security, performance, and resilience. (d0656586)

---

For list of updated packages, view updated-packages.md in assets-3.1141.0.zip

v3.1140.0

3.1140.0(2026-09-24)

Documentation Changes

• client-route53resolver: Documentation updates for Route 53 Resolver. Clarifies which Outpost Resolver operations apply to first-generation AWS Outposts and that Resolver is managed automatically on second-generation Outposts. Adds Local Network Interface subnet compatibility notes for Resolver endpoints. (b4432aba)
• client-iot: Fixed ListV2LoggingLevels and DeleteV2LoggingLevel documentation to include all supported target-types (4dcf76d5)

New Features

• clients: update client endpoints as of 2026-09-24 (29a8566c)
• client-eventbridgev2: Introducing Amazon EventBridge enhanced Custom event bus, a new shareable event bus for organizational-scale event-driven applications feature ordered delivery, deduplication, open event formats, and cross-account bus sharing. (69fbe6a2)
• client-datazone: Amazon DataZone now supports the TOOLING blueprint category on CreateEnvironmentBlueprint, UpdateEnvironmentBlueprint, GetEnvironmentBlueprint, and ListEnvironmentBlueprints, for custom tooling blueprints. CreateConnection now accepts roleArn in iamProperties. (591cd6f5)
• client-elasticache: Added tagging support for ElastiCache Global DataStore. (0fa9da59)
• client-marketplace-discovery: AWS Marketplace Discovery API now supports localized responses and SigV4a request signing. It returns new fulfillment details, including AMI architecture, EBS volume and security group information, SaaS quick-launch status, and SageMaker input and output MIME types. (510673e3)
• client-redshift-data: Updates to the ListDatabases and WorkgroupName validation (218c24e1)
• client-securityagent: Added support for Confluence export, enabling customers to publish security findings to Confluence pages. (81408527)
• client-cloudwatch: This release adds Create, Get, Update, and DeleteResourceMetricsConfiguration to enable detailed metric collection for an AWS resource, and adds UpdateOTelEnrichment plus include and exclude filters on StartOTelEnrichment so you can choose which metric namespaces CloudWatch enriches. (765cc1ce)
• client-eventbridge: Adds a ManagedBy field to the DescribeEventBus and ListEventBuses responses, identifying the AWS service that created an event bus on your behalf. (28a639b2)

Tests

• undici-http-handler: update bidi stream e2e test to nova-2-sonic model (#8313) (d9a37d9d)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1141.0 (2026-09-25)

Note: Version bump only for package @​aws-sdk/client-s3

3.1140.0 (2026-09-24)

Note: Version bump only for package @​aws-sdk/client-s3

3.1139.0 (2026-09-23)

Note: Version bump only for package @​aws-sdk/client-s3

3.1138.0 (2026-09-22)

Note: Version bump only for package @​aws-sdk/client-s3

3.1137.0 (2026-09-21)

Note: Version bump only for package @​aws-sdk/client-s3

3.1136.0 (2026-09-18)

Note: Version bump only for package @​aws-sdk/client-s3

3.1135.0 (2026-09-17)

... (truncated)

Commits

• 5bc8d9a Publish v3.1141.0
• 6050a38 Publish v3.1140.0
• 03d54a8 Publish v3.1139.0
• c68e50e Publish v3.1138.0
• 9a10476 chore(codegen): sync for MetricsRecorder support and core error/retry fixes (...
• 6b43247 Publish v3.1137.0
• d6b94db Publish v3.1136.0
• 2d5f18d Publish v3.1135.0
• 0d6310b Publish v3.1134.0
• 615a1ca Publish v3.1133.0
• Additional commits viewable in compare view

Updates @nestjs/throttler from 6.5.0 to 6.7.1

Release notes

Sourced from @​nestjs/throttler's releases.

v6.7.1

Patch Changes

• e8368b3: Set rate limit headers through res.setHeader() when the response has no res.header() method, so the guard no longer throws res.header is not a function on custom HTTP adapters. The logic lives in a new protected setResponseHeader() method that subclasses can override.
• a482ef9: Coerce numeric strings for limit, ttl and blockDuration to numbers, as returned for example by ConfigService.get<number>() for environment variables. Previously Date.now() + '60000' concatenated instead of adding, which silently corrupted every expiry and X-RateLimit-Reset. A value that is not numeric now fails with an error naming the option and the throttler.
• a9a28b9: Respect an explicit 0 for limit, ttl and blockDuration in @Throttle() and the module options instead of falling back to the default. blockDuration: 0 now means "no extra block": the in-memory storage rejects requests while the window is full and lets them through again as soon as the oldest hit expires, without recording the rejected ones.
• bf81677: Import shared interfaces from the public Nest package entry point for Nest 12 compatibility.
• caaabc9: Stop the in-memory storage from retaining request contexts. It used to schedule one setTimeout per counted hit, and each timer kept the request's AsyncLocalStorage stores (for example an ORM's per-request entity manager) in memory until the TTL expired. It now records when each hit expires and prunes expired hits on access. The idle-record sweep is also no longer tied to the context of the first request. With blockDuration: 0, Retry-After now reports when the oldest hit expires rather than when the window ends.
• 7703c10: Log a warning when no throttler is configured. The guard limits nothing in that case and previously said nothing at boot, so ThrottlerModule.forRoot() and ThrottlerModule.forRoot([]) looked like a working setup.

v6.7.0

Minor Changes

• 7004a97: Normalize IPv6 source addresses in the default tracker, and evict expired records from the in-memory storage.

  The built-in getTracker returned req.ip verbatim, so a client holding an IPv6 allocation could send every request from a different address within its own subnet and never share a counter, defeating the rate limit. Addresses are now masked to a /64 before being used as the tracker; the prefix length is configurable via the new ipv6SubnetPrefix module option. IPv4 addresses, IPv4-mapped addresses, the loopback, and custom getTracker implementations are unaffected.

  ThrottlerStorageService also never removed records, so a stream of requests from distinct trackers grew the internal map for the lifetime of the process. Idle records are now swept out once their window has fully elapsed. Limiting behaviour is unchanged: a record is only dropped after every pending hit has expired and any block has lapsed.

  Note that the tracker string for IPv6 clients changes shape (2001:db8:0:1::/64), so storage keys rotate once on upgrade.

v6.6.0

Minor Changes

• c342bad: Declare the supported Node versions in engines, matching the range the CI matrix tests
• c625e98: Update to allow for support for Nest version 12

Changelog

Sourced from @​nestjs/throttler's changelog.

6.7.1

Patch Changes

• e8368b3: Set rate limit headers through res.setHeader() when the response has no res.header() method, so the guard no longer throws res.header is not a function on custom HTTP adapters. The logic lives in a new protected setResponseHeader() method that subclasses can override.
• a482ef9: Coerce numeric strings for limit, ttl and blockDuration to numbers, as returned for example by ConfigService.get<number>() for environment variables. Previously Date.now() + '60000' concatenated instead of adding, which silently corrupted every expiry and X-RateLimit-Reset. A value that is not numeric now fails with an error naming the option and the throttler.
• a9a28b9: Respect an explicit 0 for limit, ttl and blockDuration in @Throttle() and the module options instead of falling back to the default. blockDuration: 0 now means "no extra block": the in-memory storage rejects requests while the window is full and lets them through again as soon as the oldest hit expires, without recording the rejected ones.
• bf81677: Import shared interfaces from the public Nest package entry point for Nest 12 compatibility.
• caaabc9: Stop the in-memory storage from retaining request contexts. It used to schedule one setTimeout per counted hit, and each timer kept the request's AsyncLocalStorage stores (for example an ORM's per-request entity manager) in memory until the TTL expired. It now records when each hit expires and prunes expired hits on access. The idle-record sweep is also no longer tied to the context of the first request. With blockDuration: 0, Retry-After now reports when the oldest hit expires rather than when the window ends.
• 7703c10: Log a warning when no throttler is configured. The guard limits nothing in that case and previously said nothing at boot, so ThrottlerModule.forRoot() and ThrottlerModule.forRoot([]) looked like a working setup.

6.7.0

Minor Changes

• 7004a97: Normalize IPv6 source addresses in the default tracker, and evict expired records from the in-memory storage.

  The built-in getTracker returned req.ip verbatim, so a client holding an IPv6 allocation could send every request from a different address within its own subnet and never share a counter, defeating the rate limit. Addresses are now masked to a /64 before being used as the tracker; the prefix length is configurable via the new ipv6SubnetPrefix module option. IPv4 addresses, IPv4-mapped addresses, the loopback, and custom getTracker implementations are unaffected.

  ThrottlerStorageService also never removed records, so a stream of requests from distinct trackers grew the internal map for the lifetime of the process. Idle records are now swept out once their window has fully elapsed. Limiting behaviour is unchanged: a record is only dropped after every pending hit has expired and any block has lapsed.

  Note that the tracker string for IPv6 clients changes shape (2001:db8:0:1::/64), so storage keys rotate once on upgrade.

6.6.0

Minor Changes

• c342bad: Declare the supported Node versions in engines, matching the range the CI matrix tests
• c625e98: Update to allow for support for Nest version 12

6.4.0

6.5.1

Patch Changes

• 603cb82: handles edge case where multiple clients making frequent requests interfere with each other

Commits

• 91f4912 Merge pull request #2706 from nestjs/changeset-release/master
• c5e8c90 chore: version packages
• 9ec3aa3 Merge pull request #2668 from nestjs/renovate/major-nest-monorepo
• 5d3b9ae Merge pull request #2712 from nestjs/fix/coerce-numeric-options
• 4335230 Merge pull request #2711 from nestjs/fix/timer-free-storage
• a482ef9 fix(guard): coerce numeric string options
• e082222 chore(deps): update nest monorepo to v12
• caaabc9 fix(storage): do not retain request contexts in timers
• 4ab8c63 Merge pull request #2697 from nestjs/renovate/node-24.x
• c36f011 Merge pull request #2703 from nestjs/renovate/nest-graphql-monorepo
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nestjs/throttler since your current version.

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3

New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

• 15454db +
• 54e436f exclude gel from pull
• 0fd1cc6 remove gel
• d028db7 skip gel
• 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
• b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
• f9fc5bf Add drizzle-kit announcement manifest and schema doc
• 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
• 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
• 6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
• Additional commits viewable in compare view

Updates helmet from 8.2.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

• Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
• Content-Security-Policy: improved error handling for invalid directive names

Fixed

• Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
• Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
• Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

Commits

• 75f1a98 8.3.0
• f03f70d Update changelog for 8.3.0 release
• a307fce Fix capitalization in CSP package changelog
• 5347b43 Format default CSP in README for readability
• 9afc570 CSP: fix middleware-specific README missing link
• 266c95c Minor speedups to project setups test
• 7a4196c CSP: update package-specific changelog
• 02716b4 CSP: improve performance when there are no dynamic directives
• 3f511ed CSP: move utility functions to separate file
• 80338af CSP: disabling defaults with no directives is now an error
• Additional commits viewable in compare view

Updates multer from 2.2.0 to 2.4.0

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)

What's Changed

• docs: remove README translations by @​UlisesGascon in expressjs/multer#1463
• ci: add macOS to the test matrix by @​kilisamemarisaaa in expressjs/multer#1464
• feat. improve wording for LIMIT_UNEXPECTED_FILE error code by @​flashbag in expressjs/multer#426
• feat: add filename to file errors by @​UjjwalKumar239 in expressjs/multer#1416
• refactor: remove concat-stream dependency by @​Phillip9587 in expressjs/multer#1356
• fix: reject non-integer fileSize limits by @​abhu85 in expressjs/multer#1395
• fix: allow exactly limits.parts parts by @​deepakganesh78 in expressjs/multer#1446
• fix: do not consume maxCount for files skipped by fileFilter by @​Sagargupta16 in expressjs/multer#1426
• fix: validate all limits at construction time by @​ShubhamOulkar in expressjs/multer#1335
• test: cover storage engine _removeFile invocation semantics by @​kilisamemarisaaa in expressjs/multer#1460
• feat: accept a function for limits by @​hossein-zare in expressjs/multer#1133
• fix: add flush option to disk storage to fsync files before completion by @​kilisamemarisaaa in expressjs/multer#1458
• feat: expose busboy defCharset, highWaterMark and fileHwm options by @​UlisesGascon in expressjs/multer#1465
• docs: describe the file stream contract for storage engines by @​UlisesGascon in expressjs/multer#1468

... (truncated)

Changelog

Sourced from multer's changelog.

2.4.0

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
• Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
• Accept a function for limits, called with the request, to set limits per request (#1133)
• Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
• Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
• Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
• Allow multer.diskStorage() to be called without options (#1471)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
• Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
• Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
• Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
• Files skipped by fileFilter no longer count towards maxCount (#1426)
• Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
• Remove the concat-stream dependency (#1356)
• Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
• Docs: add FormData upload examples (#896)
• Docs: remove the translated READMEs (#1463)
• Internal: run the test suite on macOS (#1464)

2.3.0

• Fix CVE-2026-77078 (GHSA-wc9g-mqfw-jrwm)
• Fix CVE-2026-77037 (GHSA-qfvm-cv95-jqjf)
• Fix CVE-2026-77063 (GHSA-qvfw-j98x-7q72)
• Fix CVE-2026-82333 (GHSA-535w-7cp7-47q4)
• Add MulterError codes INVALID_FIELD_NAME and STREAM_DESTROYED
• Add opt-in limits.fieldArrayIndexLimit to bound numeric array indexes in field names (#1438)
• Accept files whose size is exactly limits.fileSize (#1407)
• Preserve the caller's async context (AsyncLocalStorage) when calling next() (#1124)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in file.originalname (#1421)
• Do not crash when fileFilter invokes its callback more than once (#1427)
• Use a fallback message for MulterError codes without a mapping (#1448)
• Docs: clarify preservePath and parts, use crypto.randomBytes in the DiskStorage example (#1414, #1430, #1436)
• Docs: add Indonesian, Japanese and Tamil translations and refresh all translations from the current README (#1431, #1354, #1462)
• Internal: run the test suite on Windows (#1334)

Commits

• 35979e5 2.4.0 (#1469)
• b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
• e6bcd7d chore(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#1475)
• 00dec43 chore(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#1476)
• 8d5c3b7 feat: allow diskStorage without options (#1471)
• 02f6e82 fix: report the decoded filename on LIMIT_FILE_SIZE (#1478)
• bc3f72d fix: decode escaped field names, not just filenames (#1473)
• 2661325 docs: add JSDoc to the public API (#1467)
• 53337f9 fix: remove late-completing uploads aborted before the engine names them
• 7f2c9ab feat: add streamHandler option to feed busboy from pre-consumed bodies (#1466)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.

Updates @types/multer from 2.1.0 to 2.2.0

Commits

• See full diff in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

• Add support for query pipelineing.

Commits

• df274d1 Publish
• eb19d0f Add opt-in query pipelining (#3652)
• See full diff in compare view

Updates @types/pg from 8.20.0 to 8.23.1

Commits

• See full diff in compare view

Updates @eslint/eslintrc from 3.3.5 to 3.3.7

Release notes

Sourced from @​eslint/eslintrc's releases.

eslintrc: v3.3.7

3.3.7 (2026-09-01)

Bug Fixes

• Bump js-yaml to 4.3.1 (#239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#243) (bb0d97a)

eslintrc: v3.3.6

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

Changelog

Sourced from @​eslint/eslintrc's changelog.

3.3.7 (2026-09-01)

Bug Fixes

• Bump js-yaml to 4.3.1 (#239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#243) (bb0d97a)

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

Commits

• 7943fa6 chore: release 3.3.7 🚀 (#240)
• bb0d97a fix: update js-yaml to 4.3.2 to address security vulnerability (#243)
• 5b4abc9 docs: Update README sponsors
• f27e7c9 fix: Bump js-yaml to 4.3.1 (#239)
• b75e1d2 docs: Update README sponsors
• 302c133 docs: Update README sponsors
• e62e766 docs: Update README sponsors
• cf27f9f docs: Update README sponsors
• c7f4cdf docs: Update README sponsors
• 3319822 docs: Update README sponsors
• Additional commits viewable in compare view

Updates @types/multer from 2.1.0 to 2.2.0

Commits

• See full diff in compare view

Updates @types/pg from 8.20.0 to 8.23.1

Commits

• See full diff in compare view

Updates drizzle-kit from 0.31.10 to 0.31.11

Release notes

Sourced from drizzle-kit's releases.

drizzle-kit@0.31.11

• Warn about silent migration skips on drizzle-kit checks - thanks @​shaneikennedy

Commits

• 15454db +
• 54e436f exclude gel from pull
• 0fd1cc6 remove gel
• d028db7 skip gel
• 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
• b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
• f9fc5bf Add drizzle-kit announcement manifest and schema doc
• 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
• 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
• 6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
• Additional commits viewable in compare view

Updates globals from 17.7.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

• Update globals (2026-09-01) (#353) 50a2119
• Add __webpack_layer__ global (#351) 779a11a

---

sindresorhus/globals@v17.11.0...v17.12.0

v17.11.0

• Add react-native globals (#337) 61eafbf

---

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

• Add GM_cookie to Greasemonkey globals (#349) f468407

---

sindresorhus/globals@v17.9.0...v17.10.0

v17.9.0

• Update globals (2026-08-01) (#348) 5a958ed

---

sindresorhus/globals@v17.8.0...v17.9.0

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

Commits

• 98008c3 17.12.0
• 50a2119 Update globals (2026-09-01) (#353)
• 779a11a Add __webpack_layer__ global (#351)
• 8c59927 17.11.0
• 61eafbf Add react-native globals (#337)
• 7bed4af 17.10.0
• f468407 Add GM_cookie to Greasemonkey globals (#349)
• 8e7b935 17.9.0
• 5a958ed Update globals (2026-08-01) (#348)
• 36c7659 17.8.0
• Additional commits viewable in compare view

Updates jest from 30.4.2 to 30.5.2

Release notes

Sourced from jest's releases.

v30.5.2

Features

• [@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

• [jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)
• [jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)
• [@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

New Contributors

• @​winklemad made their first contribution in jestjs/jest#16345

Full Changelog: jestjs/jest@v30.5.1...v30.5.2

v30.5.1

Fixes

• [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
• [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
• [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
• [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
• [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

• [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

• @​HuzaifaChaudary made their first contribution in jestjs/jest#16413

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴

---

This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @​timkindberg (#16053):

const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
</tr></table> 

... (truncated)

Changelog

Sourced from jest's changelog.

30.5.2

Features

• [@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts ...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
response-grid	Ready	Preview	Oct 5, 2026 11:08am UTC