chore(deps): bump the production-dependencies group across 1 directory with 12 updates by dependabot[bot] · Pull Request #510 · boringstack-xyz/boringstack

dependabot · 2026-10-19T07:10:35Z

Bumps the production-dependencies group with 12 updates in the /apps/api directory:

Package	From	To
@anthropic-ai/sdk	`0.131.0`	`0.133.0`
@opentelemetry/auto-instrumentations-node	`0.80.0`	`0.81.0`
@opentelemetry/exporter-trace-otlp-http	`0.222.0`	`0.223.0`
@opentelemetry/resources	`2.11.0`	`2.12.0`
@opentelemetry/sdk-node	`0.222.0`	`0.223.0`
@sentry/bun	`11.2.0`	`11.6.0`
dotenv	`18.0.5`	`18.0.7`
drizzle-orm	`0.45.3`	`0.45.4`
nodemailer	`10.0.13`	`10.1.0`
openai	`7.27.0`	`7.32.0`
pino	`10.3.1`	`10.4.0`
resend	`6.32.0`	`6.32.1`

Updates @anthropic-ai/sdk from 0.131.0 to 0.133.0

Release notes

Sourced from @anthropic-ai/sdk's releases.

sdk-v0.133.0

Features

api: add types for the Chat and Cowork unified analytics metrics

api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

internal: remove the next branch rule from CLAUDE.md

sdk-v0.132.1

Bug Fixes

client: throw before sending a request with an empty path parameter

Chores

ci: check that pull requests update the changelog

ci: publish every package from the publish workflow

docs: note that listing Claude Console spend limits is in early access

Documentation

split CLAUDE.md into shared, TypeScript, and repository rules

sdk: v0.132.0

0.132.0 (2026-10-07)

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)

api: add disabled to thinking types in model capabilities (2b75b49)

api: add display_name to RBAC roles and deprecate name (7735ac3)

api: add include_default parameter to list workspaces (c4019df)

api: add lifecycle stage fields and filter to /v1/models (fe8a762)

api: add line to model objects (018aed4)

api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)

api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

api: send the beta header by default when listing spend limits (8f58ca4)

client: throw when a JSONL stream is iterated twice (a34266c)

tools: keep a local edit made after a memory upload whose response was lost (#893) (2b75b49)

... (truncated)

Changelog

Sourced from @anthropic-ai/sdk's changelog.

0.133.0 (2026-10-09)

Features

api: add types for the Chat and Cowork unified analytics metrics

api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

internal: remove the next branch rule from CLAUDE.md

0.132.1 (2026-10-08)

Bug Fixes

client: throw before sending a request with an empty path parameter

Chores

ci: check that pull requests update the changelog

ci: publish every package from the publish workflow

docs: note that listing Claude Console spend limits is in early access

Documentation

split CLAUDE.md into shared, TypeScript, and repository rules

0.132.0 (2026-10-07)

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)

api: add disabled to thinking types in model capabilities (2b75b49)

api: add display_name to RBAC roles and deprecate name (7735ac3)

api: add include_default parameter to list workspaces (c4019df)

api: add lifecycle stage fields and filter to /v1/models (fe8a762)

api: add line to model objects (018aed4)

api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)

api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

api: send the beta header by default when listing spend limits (8f58ca4)

client: throw when a JSONL stream is iterated twice (a34266c)

... (truncated)

Commits

2979ed5 release: . 0.133.0
8486d9b Merge pull request #908 from anthropics/synced/published
e0995e4 feat(api): add workflows, multiagent configuration and thread status filterin...
31eb3be codegen metadata
5127b32 codegen metadata
f702a46 codegen metadata
d64e976 codegen metadata
9f75465 codegen metadata
6ec2ea1 chore(internal): remove the next branch rule from CLAUDE.md
373c33d codegen metadata
Additional commits viewable in compare view

Updates @opentelemetry/auto-instrumentations-node from 0.80.0 to 0.81.0

Release notes

Sourced from @opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.81.0

0.81.0 (2026-10-06)

Features

deps: update deps matching '@opentelemetry/*' (#3804) (36fcb9c)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.74.0 to ^0.75.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.77.0 to ^0.78.0

@opentelemetry/instrumentation-bunyan bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-connect bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-cucumber bumped from ^0.38.0 to ^0.39.0

@opentelemetry/instrumentation-dataloader bumped from ^0.39.0 to ^0.40.0

@opentelemetry/instrumentation-dns bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-express bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-fs bumped from ^0.41.0 to ^0.42.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-graphql bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-hapi bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.5.0 to ^0.6.0

@opentelemetry/instrumentation-ioredis bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.31.0 to ^0.32.0

@opentelemetry/instrumentation-knex bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-koa bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-memcached bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-mongodb bumped from ^0.75.0 to ^0.76.0

@opentelemetry/instrumentation-mongoose bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-mysql bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-net bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-openai bumped from ^0.20.0 to ^0.21.0

@opentelemetry/instrumentation-oracledb bumped from ^0.47.0 to ^0.48.0

@opentelemetry/instrumentation-pg bumped from ^0.74.0 to ^0.75.0

@opentelemetry/instrumentation-pino bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-redis bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-restify bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-router bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.35.0 to ^0.36.0

@opentelemetry/instrumentation-socket.io bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-tedious bumped from ^0.41.0 to ^0.42.0

... (truncated)

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.81.0 (2026-10-06)

Features

deps: update deps matching '@opentelemetry/*' (#3804) (36fcb9c)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.74.0 to ^0.75.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.77.0 to ^0.78.0

@opentelemetry/instrumentation-bunyan bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-connect bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-cucumber bumped from ^0.38.0 to ^0.39.0

@opentelemetry/instrumentation-dataloader bumped from ^0.39.0 to ^0.40.0

@opentelemetry/instrumentation-dns bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-express bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-fs bumped from ^0.41.0 to ^0.42.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-graphql bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-hapi bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.5.0 to ^0.6.0

@opentelemetry/instrumentation-ioredis bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.31.0 to ^0.32.0

@opentelemetry/instrumentation-knex bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-koa bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-memcached bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-mongodb bumped from ^0.75.0 to ^0.76.0

@opentelemetry/instrumentation-mongoose bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-mysql bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-net bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-openai bumped from ^0.20.0 to ^0.21.0

@opentelemetry/instrumentation-oracledb bumped from ^0.47.0 to ^0.48.0

@opentelemetry/instrumentation-pg bumped from ^0.74.0 to ^0.75.0

@opentelemetry/instrumentation-pino bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-redis bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-restify bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-router bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.35.0 to ^0.36.0

@opentelemetry/instrumentation-socket.io bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-tedious bumped from ^0.41.0 to ^0.42.0

@opentelemetry/instrumentation-undici bumped from ^0.32.0 to ^0.33.0

... (truncated)

Commits

cc263ac chore: release main (#3719)
36fcb9c feat(deps): update deps matching '@opentelemetry/*' (#3804)
2729b78 chore: revert "chore!: raise minimum supported Node.js to 22.15.0, dropping 1...
36dffd2 chore!: raise minimum supported Node.js to 22.15.0, dropping 18 and 20 suppor...
See full diff in compare view

Updates @opentelemetry/exporter-trace-otlp-http from 0.222.0 to 0.223.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

chore(web-common)!: clean up and deprecate network span utils #7114

These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.

Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.

Commits

92b844e chore: prepare next v2.x release (#7151)
a859aff fix(web-common): export getElementXPath utility (#7124)
2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
5bd476e chore: move context manager to sdk-trace (#7086)
554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
788922c ci: support maintenance branch releases (#7036)
See full diff in compare view

Updates @opentelemetry/resources from 2.11.0 to 2.12.0

Release notes

Sourced from @opentelemetry/resources's releases.

v2.12.0

2.12.0

🚀 Features

chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #7086

🏠 Internal

feat(ci): support releasing from maintenance branches #6767 @pichlermarc

The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.

Changelog

Sourced from @opentelemetry/resources's changelog.

2.12.0

🏠 Internal

chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #7086

feat(ci): support releasing from maintenance branches #6767 @pichlermarc

The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.

Commits

92b844e chore: prepare next v2.x release (#7151)
a859aff fix(web-common): export getElementXPath utility (#7124)
2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
5bd476e chore: move context manager to sdk-trace (#7086)
554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
788922c ci: support maintenance branch releases (#7036)
See full diff in compare view

Updates @opentelemetry/sdk-node from 0.222.0 to 0.223.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

chore(web-common)!: clean up and deprecate network span utils #7114

These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.

Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.

Commits

92b844e chore: prepare next v2.x release (#7151)
a859aff fix(web-common): export getElementXPath utility (#7124)
2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
5bd476e chore: move context manager to sdk-trace (#7086)
554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
788922c ci: support maintenance branch releases (#7036)
See full diff in compare view

Updates @sentry/bun from 11.2.0 to 11.6.0

Release notes

Sourced from @sentry/bun's releases.

11.6.0

Important Changes
feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.
import * as Sentry from '@sentry/nextjs/cloudflare';
import handler from './.open-next/worker.js';
export default Sentry.withSentry(
env => ({
dsn: env.SENTRY_DSN,
tracesSampleRate: 1.0,
}),
handler,
);
feat(server-utils): Add instrumentation for pi-durable (#24993)

The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).
Other Changes

feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)

feat(remix): Propagate the server trace to Remix 3 page loads (#25145)

feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)

feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)

fix(browser): Check for clock drift on page lifecycle events (#25091)

fix(core): Exclude attachments from internal exception events (#25160)

fix(effect): Convert Effect span times to the Sentry clock (#24972)

fix(effect): Detect HTTP spans named after the request method (#25159)

fix(node): Register Vercel keep-alive listeners once (#25146)

fix(replay): Place CLS and INP web vitals at the right time (#24990)

fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)

fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)

chore: Add external contributor to CHANGELOG.md (#25136)

chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)

chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)

feat(cloudflare): Wrap vinext Worker entries with @sentry/nextjs/cloudflare (#25000)

... (truncated)

Changelog

Sourced from @sentry/bun's changelog.

11.6.0

Important Changes
feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.
import * as Sentry from '@sentry/nextjs/cloudflare';
import handler from './.open-next/worker.js';
export default Sentry.withSentry(
env => ({
dsn: env.SENTRY_DSN,
tracesSampleRate: 1.0,
}),
handler,
);
feat(server-utils): Add instrumentation for pi-durable (#24993)

The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).
Other Changes

feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)

feat(remix): Propagate the server trace to Remix 3 page loads (#25145)

feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)

feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)

fix(browser): Check for clock drift on page lifecycle events (#25091)

fix(core): Exclude attachments from internal exception events (#25160)

fix(effect): Convert Effect span times to the Sentry clock (#24972)

fix(effect): Detect HTTP spans named after the request method (#25159)

fix(node): Register Vercel keep-alive listeners once (#25146)

fix(replay): Place CLS and INP web vitals at the right time (#24990)

fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)

fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)

chore: Add external contributor to CHANGELOG.md (#25136)

chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)

chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)

... (truncated)

Commits

3c0c830 release: 11.6.0
13743e9 Merge pull request #25184 from getsentry/prepare-release/11.6.0
3605c50 chore(size-limit): Bump @sentry/node size limits
53ae996 meta(changelog): Update changelog for 11.6.0
e99e6e1 feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
2fdcb23 test(e2e): Add Mastra Jev classifier test to node-mastra (#25115)
5bb9a68 feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate span...
221dd86 test(e2e): Add a cloudflare-pi-durable end-to-end application (#25022)
966e1ff feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
b70f6bb test(e2e): Add a node-pi-durable end-to-end application (#24994)
Additional commits viewable in compare view

Updates dotenv from 18.0.5 to 18.0.7

Changelog

Sourced from dotenv's changelog.

18.0.7 (2026-10-09)

Changed

Treat undefined settings like quiet: true as null rather than falsey (#1070)

CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

Use smarter parseBoolean not Boolean() to fix override (#1069)

Commits

2953207 18.0.7
9944723 make more readable for undefined -> null
d455db0 Merge branch 'master' of github.com:motdotla/dotenv
e411e02 changelog
6237c35 Merge pull request #1070 from Utkarsh-Singhal-26/fix/ignore-undefined-config-...
9af8c28 Merge pull request #1071 from himanshu748/fix-cli-env-quiet
c7161c6 fix(cli): honor quiet settings loaded from .env
3990466 fix: ignore undefined options so they don't mask DOTENV_* env settings
5d7cc39 18.0.6
750ba03 changelog
Additional commits viewable in compare view

Updates drizzle-orm from 0.45.3 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

Fixed postgres-js not using prepared queries on explicit .prepare(name)

Commits

eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
See full diff in compare view

Updates nodemailer from 10.0.13 to 10.1.0

Release notes

Sourced from nodemailer's releases.

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.

connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.

Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.

A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.

With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.

The envelope is pipelined (MAIL FROM, RCPT TO and DATA in one batch) when the server announces PIPELINING.

Errors carry originalCode (the system error code Nodemailer replaced, such as ECONNREFUSED) and, for ETIMEDOUT, timeoutType.

Features

harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

do not read the environment or the interface table on import (094179d)

end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)

keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)

let the proxy handshake and the SMTP connection share one deadline (91ed683)

mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)

mime-node: finish an encoded part only after its output was read (ec97d8f)

qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)

smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)

smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)

smtp-connection: refuse a second connect() call (24ba2e0)

turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

encode base64 and quoted-printable without per-chunk delays (fd377bb)

v10.0.16

10.0.16 (2026-10-07)

Bug Fixes

addressparser: keep an escaped parenthesis inside a comment (c4ae20d)

fetch: keep the case of cookie names (#1888) (9f16eed)

fetch: read the cookie name-value pair by position (645e97c)

v10.0.15

10.0.15 (2026-10-05)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.0 (2026-10-10)

Features

harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

do not read the environment or the interface table on import (094179d)

end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)

keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)

let the proxy handshake and the SMTP connection share one deadline (91ed683)

mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)

mime-node: finish an encoded part only after its output was read (ec97d8f)

qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)

smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)

smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)

smtp-connection: refuse a second connect() call (24ba2e0)

turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

encode base64 and quoted-printable without per-chunk delays (fd377bb)

10.0.16 (2026-10-07)

Bug Fixes

addressparser: keep an escaped parenthesis inside a comment (c4ae20d)

fetch: keep the case of cookie names (#1888) (9f16eed)

fetch: read the cookie name-value pair by position (645e97c)

10.0.15 (2026-10-05)

Bug Fixes

errors: inherit NodemailerError code from ErrnoException (e99db61), closes #1884

errors: keep NodemailerError compatible with @types/node 26 ErrnoException (#1885) (b660328)

10.0.14 (2026-10-03)

Bug Fixes

addressparser: keep a quoted display name that holds no "@" out of the address (3570d26)

... (truncated)

Commits

0780032 chore(master): release 10.1.0 (#1890)
42b91d9 fix(qp): encode a lone CR or LF in binary quoted-printable parts
b9b8c84 test(smtp-pool): fail the clear event test with the pool state instead of han...
4f1a34a test(smtp-connection): keep the scripted server silent after a stalled STARTTLS
f90fb04 fix(smtp-connection): drop the connection when DATA is taken after a refused ...
bdcd046 fix(smtp-connection): count the wait for the greeting against connectionTimeout
751330a test(smtp-pool): measure the rate limit against a window wider than connecting
ec97d8f fix(mime-node): finish an encoded part only after its output was read
24ba2e0 fix(smtp-connection): refuse a second connect() call
91ed683 fix: let the proxy handshake and the SMTP connection share one deadline
Additional commits viewable in compare view

Updates openai from 7.27.0 to 7.32.0

Release notes

Sourced from openai's releases.

v7.32.0

7.32.0 (2026-10-09)

Features

api: add agent environment suspension and expiration (#2904) (6e4ed63)

Bug Fixes

deps: bump next from 15.5.25 to 15.5.27 in /ecosystem-tests/vercel-edge (#2896) (88b4c05)

runners: preserve detailed token usage in totalUsage (#2900) (88bb984)

Documentation

fix migration guide types troubleshooting link (#2901) (690e5d7)

v7.31.0

7.31.0 (2026-10-09)

Features

api: add prewarmed hosted environments (#2898) (7a0be86)

v7.30.1

7.30.1 (2026-10-08)

Bug Fixes

api: correct custom voice creation parameters (#2895) (3edaf0f)

deps-dev: bump @aws-sdk/credential-provider-node from 3.972.83 to 3.972.84 (#2877) (0878349)

deps-dev: bump @smithy/signature-v4 from 5.7.3 to 5.7.4 (#2870) (12ce5f2)

deps-dev: bump jest from 30.5.1 to 30.5.2 (#2867) (48b5c2a)

deps-dev: bump oxfmt from 0.67.0 to 0.70.0 (#2864) (91a226d)

deps-dev: bump puppeteer from 25.11.0 to 25.12.0 in /ecosystem-tests/browser-direct-import (#2863) (89ded6b)

deps-dev: bump pup...
Description has been truncated

…y with 12 updates Bumps the production-dependencies group with 12 updates in the /apps/api directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.131.0` | `0.133.0` | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.80.0` | `0.81.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.222.0` | `0.223.0` | | [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `2.12.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.222.0` | `0.223.0` | | [@sentry/bun](https://github.com/getsentry/sentry-javascript) | `11.2.0` | `11.6.0` | | [dotenv](https://github.com/motdotla/dotenv) | `18.0.5` | `18.0.7` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.3` | `0.45.4` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `10.0.13` | `10.1.0` | | [openai](https://github.com/openai/openai-node) | `7.27.0` | `7.32.0` | | [pino](https://github.com/pinojs/pino) | `10.3.1` | `10.4.0` | | [resend](https://github.com/resend/resend-node) | `6.32.0` | `6.32.1` | Updates `@anthropic-ai/sdk` from 0.131.0 to 0.133.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.131.0...sdk-v0.133.0) Updates `@opentelemetry/auto-instrumentations-node` from 0.80.0 to 0.81.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.81.0/packages/auto-instrumentations-node) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.222.0 to 0.223.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.222.0...experimental/v0.223.0) Updates `@opentelemetry/resources` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/v2.12.0/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.11.0...v2.12.0) Updates `@opentelemetry/sdk-node` from 0.222.0 to 0.223.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.222.0...experimental/v0.223.0) Updates `@sentry/bun` from 11.2.0 to 11.6.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@11.2.0...11.6.0) Updates `dotenv` from 18.0.5 to 18.0.7 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v18.0.5...v18.0.7) Updates `drizzle-orm` from 0.45.3 to 0.45.4 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.3...0.45.4) Updates `nodemailer` from 10.0.13 to 10.1.0 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v10.0.13...v10.1.0) Updates `openai` from 7.27.0 to 7.32.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v7.27.0...v7.32.0) Updates `pino` from 10.3.1 to 10.4.0 - [Release notes](https://github.com/pinojs/pino/releases) - [Commits](pinojs/pino@v10.3.1...v10.4.0) Updates `resend` from 6.32.0 to 6.32.1 - [Release notes](https://github.com/resend/resend-node/releases) - [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md) - [Commits](resend/resend-node@v6.32.0...v6.32.1) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.133.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.81.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.223.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/resources" dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.223.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@sentry/bun" dependency-version: 11.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: dotenv dependency-version: 18.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: drizzle-orm dependency-version: 0.45.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: nodemailer dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: openai dependency-version: 7.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pino dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: resend dependency-version: 6.32.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-26T08:13:08Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot requested a review from agjs as a code owner October 19, 2026 07:10

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 19, 2026

dependabot Bot closed this Oct 26, 2026

dependabot Bot deleted the dependabot/bun/apps/api/production-dependencies-3f632d6d3b branch October 26, 2026 08:13

Navigation Menu

Repository navigation

chore(deps): bump the production-dependencies group across 1 directory with 12 updates - #510

chore(deps): bump the production-dependencies group across 1 directory with 12 updates#510
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/apps/api/production-dependencies-3f632d6d3b

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

sdk-v0.133.0

Features

Chores

sdk-v0.132.1

Bug Fixes

Chores

Documentation

sdk: v0.132.0

0.132.0 (2026-10-07)

Features

Bug Fixes

0.133.0 (2026-10-09)

Features

Chores

0.132.1 (2026-10-08)

Bug Fixes

Chores

Documentation

0.132.0 (2026-10-07)

Features

Bug Fixes

auto-instrumentations-node: v0.81.0

0.81.0 (2026-10-06)

Features

Dependencies

0.81.0 (2026-10-06)

Features

Dependencies

experimental/v0.223.0

0.223.0

💥 Breaking Changes

🏠 Internal

v2.12.0

2.12.0

🚀 Features

🏠 Internal

2.12.0

🏠 Internal

experimental/v0.223.0

0.223.0

💥 Breaking Changes

🏠 Internal

11.6.0

Important Changes

Other Changes

11.6.0

Important Changes

Other Changes

18.0.7 (2026-10-09)

Changed

18.0.6 (2026-10-06)

Changed

0.45.4

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

Features

Bug Fixes

Performance Improvements

v10.0.16

10.0.16 (2026-10-07)

Bug Fixes

v10.0.15

10.0.15 (2026-10-05)

10.1.0 (2026-10-10)

Features

Bug Fixes

Performance Improvements

10.0.16 (2026-10-07)

Bug Fixes

10.0.15 (2026-10-05)

Bug Fixes

10.0.14 (2026-10-03)

Bug Fixes

v7.32.0

7.32.0 (2026-10-09)

Features

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading