[dependabot]

Bumps the production-dependencies group with 13 updates in the /apps/api directory:

Package	From	To
@anthropic-ai/sdk	0.131.0	0.135.0
@casl/ability	7.0.1	7.0.2
@opentelemetry/auto-instrumentations-node	0.80.0	0.81.2
@opentelemetry/exporter-trace-otlp-http	0.222.0	0.223.0
@opentelemetry/resources	2.11.0	2.12.0
@opentelemetry/sdk-node	0.222.0	0.223.0
@sentry/bun	11.2.0	11.8.0
dotenv	18.0.5	18.0.8
drizzle-orm	0.45.3	0.45.4
nodemailer	10.0.13	10.1.7
openai	7.27.0	7.39.0
pino	10.3.1	10.4.0
resend	6.32.0	6.34.1

Updates @anthropic-ai/sdk from 0.131.0 to 0.135.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.135.0

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints

Documentation

• api: note that some models need a beta header to use speed

sdk-v0.134.0

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: close an unread stream that was dropped while tracing is on
• client: don't follow redirects on token requests
• client: treat proxy-authorization as a sensitive header

Bug Fixes

• streaming: tolerate unknown event types in MessageStream and BetaMessageStream
• streaming: stop throwing "Unexpected event order" for an event before message_start
• streaming: yield events that arrive before message_start when iterating MessageStream and BetaMessageStream

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.135.0 (2026-10-15)

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints

Documentation

• api: note that some models need a beta header to use speed

0.134.0 (2026-10-14)

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: close an unread stream that was dropped while tracing is on
• client: don't follow redirects on token requests
• client: treat proxy-authorization as a sensitive header

Bug Fixes

• streaming: tolerate unknown event types in MessageStream and BetaMessageStream
• streaming: stop throwing "Unexpected event order" for an event before message_start

... (truncated)

Commits

• 04a4c28 release: 0.135.0
• 69dbe62 Merge pull request #935 from anthropics/synced/published
• b61a531 feat(helpers): retry a rate-limited fast fallback at standard speed (#943)
• 38d0ab4 feat(api): add between_tools to thinking types in model capabilities
• 366b53b chore(docs): describe headers on Managed Agents and telemetry endpoints
• ca50812 docs(api): note that some models need a beta header to use speed
• 03f6012 fix(helpers): honor speed overrides from fallback entries when streaming (#942)
• 88bf034 docs(changelog): shorten the OpenTelemetry tracing note (#941)
• 7c807a0 fix(client): close streams dropped without being read to the end
• 64758f6 feat(api): add the speed parameter and usage.speed to Messages
• Additional commits viewable in compare view

Updates @casl/ability from 7.0.1 to 7.0.2

Release notes

Sourced from @​casl/ability's releases.

@​casl/ability: v7.0.2

7.0.2 (2026-10-15)

Bug Fixes

• prevent rulesToFields to set properties on prototype and non-objects (#1305) (58242cb)

Changelog

Sourced from @​casl/ability's changelog.

7.0.2 (2026-10-15)

Bug Fixes

• prevent rulesToFields to set properties on prototype and non-objects (#1305) (58242cb)

Commits

• a9bd440 chore: release main (#1306)
• 58242cb fix: prevent rulesToFields to set properties on prototype and non-objects (#1...
• 873cd1f chore: migrates from master to main default branch
• ae625f1 chore: upgrades to ts 6 (#1252)
• 9840dc1 chore(deps): update dependency chai to v6 (#863)
• See full diff in compare view

Updates @opentelemetry/auto-instrumentations-node from 0.80.0 to 0.81.2

Release notes

Sourced from @​opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.81.2

0.81.2 (2026-10-16)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​opentelemetry/instrumentation-winston bumped from ^0.68.0 to ^0.68.1

auto-instrumentations-node: v0.81.1

0.81.1 (2026-10-15)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​opentelemetry/instrumentation-express bumped from ^0.71.0 to ^0.71.1
    • @​opentelemetry/instrumentation-mysql bumped from ^0.69.0 to ^0.69.1
    • @​opentelemetry/instrumentation-nestjs-core bumped from ^0.69.0 to ^0.70.0
    • @​opentelemetry/instrumentation-pg bumped from ^0.75.0 to ^0.76.0
    • @​opentelemetry/instrumentation-runtime-node bumped from ^0.36.0 to ^0.36.1
    • @​opentelemetry/instrumentation-winston bumped from ^0.67.0 to ^0.68.0

Changelog

Sourced from @​opentelemetry/auto-instrumentations-node's changelog.

0.81.2 (2026-10-16)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​opentelemetry/instrumentation-winston bumped from ^0.68.0 to ^0.68.1

0.81.1 (2026-10-15)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​opentelemetry/instrumentation-express bumped from ^0.71.0 to ^0.71.1
    • @​opentelemetry/instrumentation-mysql bumped from ^0.69.0 to ^0.69.1
    • @​opentelemetry/instrumentation-nestjs-core bumped from ^0.69.0 to ^0.70.0
    • @​opentelemetry/instrumentation-pg bumped from ^0.75.0 to ^0.76.0
    • @​opentelemetry/instrumentation-runtime-node bumped from ^0.36.0 to ^0.36.1
    • @​opentelemetry/instrumentation-winston bumped from ^0.67.0 to ^0.68.0

0.81.0 (2026-10-06)

Features

• deps: update deps matching '@opentelemetry/*' (#3804) (36fcb9c)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​opentelemetry/instrumentation-amqplib bumped from ^0.69.0 to ^0.70.0
    • @​opentelemetry/instrumentation-aws-lambda bumped from ^0.74.0 to ^0.75.0
    • @​opentelemetry/instrumentation-aws-sdk bumped from ^0.77.0 to ^0.78.0
    • @​opentelemetry/instrumentation-bunyan bumped from ^0.67.0 to ^0.68.0
    • @​opentelemetry/instrumentation-cassandra-driver bumped from ^0.67.0 to ^0.68.0
    • @​opentelemetry/instrumentation-connect bumped from ^0.65.0 to ^0.66.0
    • @​opentelemetry/instrumentation-cucumber bumped from ^0.38.0 to ^0.39.0
    • @​opentelemetry/instrumentation-dataloader bumped from ^0.39.0 to ^0.40.0
    • @​opentelemetry/instrumentation-dns bumped from ^0.65.0 to ^0.66.0
    • @​opentelemetry/instrumentation-express bumped from ^0.70.0 to ^0.71.0
    • @​opentelemetry/instrumentation-fs bumped from ^0.41.0 to ^0.42.0
    • @​opentelemetry/instrumentation-generic-pool bumped from ^0.65.0 to ^0.66.0
    • @​opentelemetry/instrumentation-graphql bumped from ^0.70.0 to ^0.71.0
    • @​opentelemetry/instrumentation-hapi bumped from ^0.68.0 to ^0.69.0
    • @​opentelemetry/instrumentation-host-metrics bumped from ^0.5.0 to ^0.6.0

... (truncated)

Commits

• 862c270 chore: release main (#3837)
• 3c48599 chore: release main (#3805)
• cc263ac chore: release main (#3719)
• 36fcb9c feat(deps): update deps matching '@opentelemetry/*' (#3804)
• 2729b78 chore: revert "chore!: raise minimum supported Node.js to 22.15.0, dropping 1...
• 36dffd2 chore!: raise minimum supported Node.js to 22.15.0, dropping 18 and 20 suppor...
• See full diff in compare view

Updates @opentelemetry/exporter-trace-otlp-http from 0.222.0 to 0.223.0

Release notes

Sourced from @​opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

• chore(web-common)!: clean up and deprecate network span utils #7114
  • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
  • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

• refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.

Commits

• 92b844e chore: prepare next v2.x release (#7151)
• a859aff fix(web-common): export getElementXPath utility (#7124)
• 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
• d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
• 5bd476e chore: move context manager to sdk-trace (#7086)
• 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
• 788922c ci: support maintenance branch releases (#7036)
• See full diff in compare view

Updates @opentelemetry/resources from 2.11.0 to 2.12.0

Release notes

Sourced from @​opentelemetry/resources's releases.

v2.12.0

2.12.0

🚀 Features

• chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #7086

🏠 Internal

• feat(ci): support releasing from maintenance branches #6767 @​pichlermarc
  • The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.

Changelog

Sourced from @​opentelemetry/resources's changelog.

CHANGELOG

All notable changes to this project will be documented in this file.

For API changes, see the API CHANGELOG. For experimental package changes, see the experimental CHANGELOG. For semantic convention package changes, see the semconv CHANGELOG. For notes on migrating to 2.x / 0.200.x see the upgrade guide. For notes on migrating to 3.x see the 3.x migration guide.

Unreleased

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

3.0.0

💥 Breaking Changes

• chore(sdk-trace-node)!: remove the @opentelemetry/sdk-trace-node package #7054
  • The sdk-trace-node package has been replaced by the @opentelemetry/sdk-trace package. See the 3.x migration guide for full migration instructions.
• chore(shim-opentracing)!: remove the @opentelemetry/shim-opentracing package
  • In the OpenTelemetry Specification v1.56.0 the OpenTracing compatibility requirements were deprecated. The JavaScript OpenTracing shim package will not receive any more releases after the current 2.12.0 release (source code for last release).
• chore(context-async-hooks)!: remove the unused class AsyncHooksContextManager #7078
• feat!: migrate package builds from tsc to tsdown, emitting dual CJS/ESM output from a single dist/ directory and declaring an exports map on every package #6293 @​overbalance
  • Importing a package by its name is unaffected in both CommonJS and ESM, as is every subpath listed in its exports map.
  • Deep imports into the build output no longer resolve. An exports map is an allowlist that Node.js and bundlers enforce, so specifiers such as @opentelemetry/core/build/src/... or @opentelemetry/core/build/esm/... now fail with ERR_PACKAGE_PATH_NOT_EXPORTED. Rewriting them to the new file layout does not help — unlisted subpaths are rejected whether or not the file exists.
  • The emitted files moved out of build/src (CJS), build/esm and build/esnext (ESM) into dist/, using .cjs/.mjs extensions with matching .d.cts/.d.mts declarations.
  • <package>/package.json is no longer importable for the same reason. Read a package's version from your own dependency metadata, or use SDK_INFO from @opentelemetry/core for the SDK version.
  • The non-standard esnext entry point has been removed; tools that preferred it fall back to module (ESM) or main (CJS).
  • If you depend on something that is only reachable through a deep import, please open an issue so it can be considered for the public API.
• feat(core)!: remove deprecated getTimeOrigin, otperformance, _globalThis, and unrefTimer from @opentelemetry/core #7053
  • getTimeOrigin() — use performance.timeOrigin directly.
  • otperformance — use the global performance object directly.
  • _globalThis — use globalThis directly.
  • unrefTimer(timer) — call timer.unref() directly in your own code.
• feat(sdk-trace)!: remove deprecated TracerProviderOptions.forceFlushTimeoutMillis #7057
  • Pass timeoutMillis to provider.forceFlush({ timeoutMillis }) instead. The default timeout is 30000ms.
• feat(propagator-jaeger)!: remove @opentelemetry/propagator-jaeger package #7077
  • The Jaeger propagator is deprecated by the OpenTelemetry specification in favour of W3CTraceContextPropagator. Use W3CTraceContextPropagator from @opentelemetry/core instead.
  • See the 3.x migration guide for full instructions.

... (truncated)

Commits

• 92b844e chore: prepare next v2.x release (#7151)
• a859aff fix(web-common): export getElementXPath utility (#7124)
• 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
• d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
• 5bd476e chore: move context manager to sdk-trace (#7086)
• 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
• 788922c ci: support maintenance branch releases (#7036)
• See full diff in compare view

Updates @opentelemetry/sdk-node from 0.222.0 to 0.223.0

Release notes

Sourced from @​opentelemetry/sdk-node's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

• chore(web-common)!: clean up and deprecate network span utils #7114
  • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
  • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

• refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.

Commits

• 92b844e chore: prepare next v2.x release (#7151)
• a859aff fix(web-common): export getElementXPath utility (#7124)
• 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
• d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
• 5bd476e chore: move context manager to sdk-trace (#7086)
• 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
• 788922c ci: support maintenance branch releases (#7036)
• See full diff in compare view

Updates @sentry/bun from 11.2.0 to 11.8.0

Release notes

Sourced from @​sentry/bun's releases.

11.8.0

Important Changes

• feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

  The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

  • Node.js 20.19.0 or higher is required.
  • @sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.
  • The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
  • Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

• feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

  OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

• feat(core): Support SuppressedError in LinkedErrors integration (#25246)
• fix(astro): Delete generated source maps for static output (#25310)
• fix(astro): Upload source maps of Astro 7's prerender build (#25309)
• fix(browser): Apply urlQueryParams to the Referer header (#25324)
• fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
• fix(hono): Expose runtime-specific SDK options (#25290)
• fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
• fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
• fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)
• fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
• fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
• fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
• fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)

• chore: Add external contributor to CHANGELOG.md (#25375)
• ci: Install the pnpm version that Volta pins (#25287)
• license: Add cli FSL notice to package licenses (#25314)
• ref(core): use shared MCP attribute conventions (#25059)
• ref(tanstackstart-react): Reuse shared component annotation options (#25313)
• test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
• test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)
• test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
• test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
• test(e2e): Add node-openai-send-to-sentry test app (#24824)
• test(e2e): Add nuxt-5-sourcemaps test (#25268)
• test(e2e): Inherit root Volta config in all e2e test apps (#25369)
• test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
• test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)
• test(nextjs): Switch DEBUG_BUILD with a getter instead of re-importing the SDK (#25279)

... (truncated)

Changelog

Sourced from @​sentry/bun's changelog.

11.8.0

Important Changes

• feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

  The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

  • Node.js 20.19.0 or higher is required.
  • @sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.
  • The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
  • Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

• feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

  OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

• feat(core): Support SuppressedError in LinkedErrors integration (#25246)
• fix(astro): Delete generated source maps for static output (#25310)
• fix(astro): Upload source maps of Astro 7's prerender build (#25309)
• fix(browser): Apply urlQueryParams to the Referer header (#25324)
• fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
• fix(hono): Expose runtime-specific SDK options (#25290)
• fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
• fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
• fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)
• fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
• fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
• fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
• fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)

• chore: Add external contributor to CHANGELOG.md (#25375)
• ci: Install the pnpm version that Volta pins (#25287)
• license: Add cli FSL notice to package licenses (#25314)
• ref(core): use shared MCP attribute conventions (#25059)
• ref(tanstackstart-react): Reuse shared component annotation options (#25313)
• test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
• test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)
• test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
• test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
• test(e2e): Add node-openai-send-to-sentry test app (#24824)
• test(e2e): Add nuxt-5-sourcemaps test (#25268)
• test(e2e): Inherit root Volta config in all e2e test apps (#25369)
• test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
• test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)

... (truncated)

Commits

• c6492ef release: 11.8.0
• e091f7f meta(changelog): Update changelog for 11.8.0 (#25388)
• 30ec754 meta(changelog): Update changelog for 11.8.0
• a309cf8 test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
• 71f1ef9 test(e2e): Inherit root Volta config in all e2e test apps (#25369)
• e54e577 chore: Add external contributor to CHANGELOG.md (#25375)
• 0ed4606 fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
• 9516aeb fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
• 7471347 feat(core): Support SuppressedError in LinkedErrors integration (#25246)
• f4ae6c5 fix(browser): Apply urlQueryParams to the Referer header (#25324)
• Additional commits viewable in compare view

Updates dotenv from 18.0.5 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

• Fast parser should strip appended extra quotes (#1073)
• Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#1070)
• CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

• Use smarter parseBoolean not Boolean() to fix override (#1069)

Commits

• e2fe95e 18.0.8
• 7aa712a type detail improvement
• 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
• 0b4843a changelog
• 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
• f757811 fix(types): allow undefined values in populate output
• fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
• 2953207 18.0.7
• 9944723 make more readable for undefined -> null
• d455db0 Merge branch 'master' of github.com:motdotla/dotenv
• Additional commits viewable in compare view

Updates drizzle-orm from 0.45.3 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

• Fixed postgres-js not using prepared queries on explicit .prepare(name)

Commits

• eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
• See full diff in compare view

Updates nodemailer from 10.0.13 to 10.1.7

Release notes

Sourced from nodemailer's releases.

v10.1.7

10.1.7 (2026-10-18)

Bug Fixes

• mime-funcs: encode parameter values that look like encoded words (651d79b)

v10.1.6

10.1.6 (2026-10-18)

Bug Fixes

• addressparser: read groups in the same pass as the rest of the list (ddf0de1)

v10.1.5

10.1.5 (2026-10-18)

Bug Fixes

• addressparser: handle an address list without copying it per address (6bd09b3)
• addressparser: tokenize into offsets instead of an object per token (3fd3f50)

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

• addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
• addressparser: bound group nesting at ten levels (ce63303)
• addressparser: drop the obsolete route from an angle-addr (3dbc730)
• addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
• addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
• addressparser: never read a mailbox out of a comment (a1538ea)
• addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
• addressparser: read the first addr-spec of the display text (038940a)
• split a domain literal off at the "@" in front of it (d5983b0)

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

• format References and strip URLs in linear time, release any number of streams (2f18641)

v10.1.2

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.7 (2026-10-18)

Bug Fixes

• mime-funcs: encode parameter values that look like encoded words (651d79b)

10.1.6 (2026-10-18)

Bug Fixes

• addressparser: read groups in the same pass as the rest of the list (ddf0de1)

10.1.5 (2026-10-18)

Bug Fixes

• addressparser: handle an address list without copying it per address (6bd09b3)
• addressparser: tokenize into offsets instead of an object per token (3fd3f50)

10.1.4 (2026-10-18)

Bug Fixes

• addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
• addressparser: bound group nesting at ten levels (ce63303)
• addressparser: drop the obsolete route from an angle-addr (3dbc730)
• addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
• addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
• addressparser: never read a mailbox out of a comment (a1538ea)
• addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
• addressparser: read the first addr-spec of the display text (038940a)
• split a domain literal off at the "@" in front of it (d5983b0)

10.1.3 (2026-10-18)

Bug Fixes

• format References and strip URLs in linear time, release any number of streams (2f18641)

10.1.2 (2026-10-16)

Bug Fixes

• bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

... (truncated)

Commits

• 7613a86 chore(master): release 10.1.7 (#1900)
• 651d79b fix(mime-funcs): encode parameter values that look like encode...

  Description has been truncated