chore(deps): bump the npm-version-updates group across 1 directory with 19 updates by dependabot[bot] · Pull Request #30 · zitadel/express-auth

dependabot · 2026-10-20T06:07:16Z

Bumps the npm-version-updates group with 19 updates in the / directory:

Package	From	To
express	`5.2.1`	`5.3.0`
qs	`6.16.0`	`6.16.1`
@commitlint/config-conventional	`20.5.3`	`21.2.3`
@jest/globals	`30.4.1`	`30.5.2`
@semantic-release/git	`10.0.1`	`11.0.1`
@semantic-release/github	`12.0.8`	`12.0.10`
@semantic-release/npm	`13.1.5`	`13.2.0`
@tsconfig/node22	`22.0.5`	`22.0.6`
@types/node	`22.19.19`	`26.6.5`
eslint	`9.39.4`	`10.13.0`
jest	`30.0.5`	`30.5.2`
knip	`5.88.1`	`6.41.0`
prettier	`3.8.3`	`3.9.10`
semantic-release	`25.0.3`	`25.0.9`
supertest	`7.2.2`	`7.3.1`
@types/supertest	`6.0.3`	`7.2.1`
ts-jest	`29.4.0`	`29.4.15`
typedoc	`0.28.19`	`0.28.20`
typescript	`5.9.3`	`7.0.2`

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

cf6722b 5.3.0 (#7468)
8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
9efc29e docs: fix pass-through typos (#7509)
2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
9169cbe docs: add missing apostrophe in example (#7483)
7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
98bd4cd deps: proxy-addr@^2.0.8 (#7474)
9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates qs from 6.16.0 to 6.16.1

Changelog

Sourced from qs's changelog.

6.16.1

[Fix] parse: do not mutate an object input

[Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)

[Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly

[Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)

[Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)

[Fix] stringify: ignore inherited array format names (#622)

[Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString

[Fix] utils: merge: seed an overflow container's index from its own keys, not just the source

[Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct

[Fix] parse: only treat [] as array syntax when it ends the key

[Perf] decode: skip decoders when there is no percent sign (#583)

[Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values

[Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @Yeaseen)

[Docs] document that qs and flat parsers disagree about parameter names

[Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values

[Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)

[meta] fix changelog indents

[actions] set least-privilege cache-mode

[Tests] utils: decode: add missing cases

[Tests] parse: characterize the ]= split when an = precedes any bracket group (#620)

[Tests] parse: allowDots: cover stray close brackets before a dot

[Dev Deps] update @ljharb/eslint-config, eslint, tape

Commits

2471b66 v6.16.1
51f736e [Docs] document that qs and flat parsers disagree about parameter names
40239f7 [Dev Deps] update tape
d219359 [Fix] parse: do not mutate an object input
98157dc [Fix] stringify: stop re-encoding structural separator dots when `encodeDot...
cb075c5 [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments wi...
4b89c03 [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip
266527d [Perf] decode: skip decoders when there is no percent sign
82c5bd0 [Tests] utils: decode: add missing cases
3ee412c [Tests] parse: characterize the ]= split when an = precedes any bracket...
Additional commits viewable in compare view

Updates @commitlint/config-conventional from 20.5.3 to 21.2.3

Release notes

Sourced from @commitlint/config-conventional's releases.

v21.2.3

21.2.3 (2026-09-19)

Bug Fixes

fix(types): correct breaking-change-exclamation-mark rule config type by @lazerg in conventional-changelog/commitlint#4954

fix(config-nx-scopes): read scopes from the nx project graph by @dylanpulver in conventional-changelog/commitlint#4957

fix(lint): trim trailing whitespace off the message handed to ignore matchers by @dylanpulver in conventional-changelog/commitlint#4960

fix(load): detect dynamic await support on node majors above 20 by @dylanpulver in conventional-changelog/commitlint#4961

fix(rules): report the case that matched in case rule failure messages by @dylanpulver in conventional-changelog/commitlint#4962

fix(load): run the parser factory of scoped conventional-changelog presets by @maximilliangrand in conventional-changelog/commitlint#4968

Refactor

refactor(load): drop the node version check gating cosmiconfig loaders by @dylanpulver in conventional-changelog/commitlint#4972

Chore, ci, build, etc.

build: install pnpm via npm instead of corepack by @escapedcat in conventional-changelog/commitlint#4948

build: retire the docker compose dev environment by @escapedcat in conventional-changelog/commitlint#4949

build: verify pnpm tarball against the packageManager sha512 pin by @escapedcat in conventional-changelog/commitlint#4952

ci: stabilize Windows CI by raising Vitest default timeout by @escapedcat with @Copilot in conventional-changelog/commitlint#4959

docs: drop the Node 24 config-loading workaround note by @escapedcat in conventional-changelog/commitlint#4976

chore: move pnpm settings from .npmrc to pnpm-workspace.yaml by @escapedcat in conventional-changelog/commitlint#4977

chore: swap pnpm resolutionMode time-based for minimumReleaseAge by @escapedcat in conventional-changelog/commitlint#4984

New Contributors

@lazerg made their first contribution in conventional-changelog/commitlint#4954

@escapedcat with @Copilot made their first contribution in conventional-changelog/commitlint#4959

@dylanpulver made their first contribution in conventional-changelog/commitlint#4957

@maximilliangrand made their first contribution in conventional-changelog/commitlint#4968

Full Changelog: conventional-changelog/commitlint@v21.2.2...v21.2.3

v21.2.2

21.2.2 (2026-08-13)

Bug Fixes

parse: require colon after note keywords (conventional-commits-parser 7.1.2) (#4927) (b83c515), closes conventional-changelog/conventional-changelog#1517

fix(container): resolve packages from TypeScript configs by @Guflly in conventional-changelog/commitlint#4914

fix(resolve-extends): support Yarn Plug'n'Play by @Guflly in conventional-changelog/commitlint#4933

Chore, docs, etc.

docs: fix typos in comments and JSDoc by @maxtaran2010 in conventional-changelog/commitlint#4880

... (truncated)

Changelog

Sourced from @commitlint/config-conventional's changelog.

21.2.3 (2026-09-19)

Bug Fixes

rules: report the case that matched in case rule failure messages (#4962) (9f5f7bc)

21.2.2 (2026-08-13)

Note: Version bump only for package @commitlint/config-conventional

21.2.0 (2026-06-30)

Features

resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

21.1.0 (2026-06-23)

Note: Version bump only for package @commitlint/config-conventional

21.0.2 (2026-05-29)

Note: Version bump only for package @commitlint/config-conventional

21.0.1 (2026-05-12)

Note: Version bump only for package @commitlint/config-conventional

... (truncated)

Commits

95d4056 v21.2.3
9f5f7bc fix(rules): report the case that matched in case rule failure messages (#4962)
d00d190 v21.2.2
3146d04 docs(config-conventional): document rules that go beyond the spec (#4910)
f2e8dae chore: update dependency typescript to v7 (#4886)
1b4e5bc v21.2.0
fdb566f feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9...
6f1c0af v21.1.0
8069048 v21.0.2
db8d7d6 v21.0.1
Additional commits viewable in compare view

Updates @jest/globals from 30.4.1 to 30.5.2

Release notes

Sourced from @jest/globals's releases.

v30.5.2

Features

[@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

[jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)

[jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)

[@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

New Contributors

@winklemad made their first contribution in jestjs/jest#16345

Full Changelog: jestjs/jest@v30.5.1...v30.5.2

v30.5.1

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)

[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)

[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)

[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)

[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

@HuzaifaChaudary made their first contribution in jestjs/jest#16413

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴

This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @timkindberg (#16053):
const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
</tr></table> 

... (truncated)

Changelog

Sourced from @jest/globals's changelog.

30.5.2

Features

[@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

[jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)

[jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)

[@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

30.5.1

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)

[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)

[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)

[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)

[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

30.5.0

Features

[@jest/expect-utils, jest-mock] Add mockFn.whenCalledWith(...args) for configuring return values per argument list, with first-class asymmetric-matcher support (#16053)

[@jest/expect-utils] Export AsymmetricMatcher and FunctionParameters types (previously private to expect) (#16053)

[jest-circus, jest-core, jest-jasmine2, jest-test-result, jest-types] --collectTests now expands test.each/describe.each cases and reports per-status counts (skipped/todo via the new wouldRun flag for selected tests) plus a summary line that match a real run, including under --testNamePattern and .only/fdescribe focus on both the circus and jasmine2 runners (#16259)

[jest-circus, jest-environment, jest-runtime, jest-types] Add describe-level retries via jest.retryTimes(..., {entireDescribe: true}) (#16322)

[jest-circus, jest-message-util, jest-reporters, jest-types] Add retryMessages to AssertionResult and export formatErrorStack, so the retry log renders nested cause and AggregateError sections with code frames instead of serialized [cause]:/[errors]: markers (#16316)

[jest-circus, jest-types] Add unhandledErrorsDetailed to Circus.RunResult, so an unhandled rejection reports its cause chain and AggregateError entries with code frames instead of a pre-serialized stack (#16316)

[jest-haste-map] Replace NodeWatcher and FSEventsWatcher with @parcel/watcher for the non-watchman watch path (#16188)

[jest-resolve] Bump unrs-resolver to 1.12.1, remove jest-pnp-resolver and unnecessary checks (#15721)

[jest-resolve] Honor Node's --preserve-symlinks / NODE_PRESERVE_SYMLINKS in the default resolver by passing symlinks: false to unrs-resolver (#16260)

[jest-runtime] Apply automocking and manual __mocks__ files to synchronously evaluable ESM graphs on Node 24.9+ - static imports, dynamic import() and require() of an ESM file now generate an automock from the real module's namespace instead of failing with "Attempting to import a mock without a factory". Graphs that need async evaluation (top-level await) or an async-only resolver or transformer still throw (#16391)

[jest-runtime] Route process.getBuiltinModule through the sandbox, so it returns the sandbox process and the hooked node:module instead of the host's (#16391)

[jest-runtime] Throw an actionable error from module.register() and module.registerHooks() inside a test - the hooks attached to the loader running Jest itself, never saw the sandboxed requires they were meant for, and stayed registered for every later test file in the worker (#16391)

[jest-runtime] Surface resolution and import-attribute errors in an ESM graph before executing any of its CJS dependencies on Node 24.9+, matching Node's run-nothing-on-a-broken-graph behavior; the legacy loader on older versions keeps its linking-time execution order (#16391)

[jest-runtime] Throw ERR_SOURCE_PHASE_NOT_DEFINED with an actionable message for import source and import.source(), instead of failing at instantiation with V8's bare "Source phase import object is not defined" (#16391)

[jest-runtime] Emit the JSON-without-import-attribute deprecation warning once per test file instead of once per worker, so it is no longer silently swallowed for every file after the first (#16391)

[jest-runtime] Set import.meta.main to true in the test file and false in every module it loads, matching Node 24+ (#16367)

[jest-runtime] Resolve the module-sync export condition, so a package that exposes its ESM entry point for require() loads the same file Node would (#16336)

[jest-snapshot] Add external snapshot paths to custom reporter failure details (#16374)

Fixes

... (truncated)

Commits

202dd8a v30.5.2
9ab14fe v30.5.1
912baa3 v30.5.0
b91717a chore: refresh coding agent instructions (#16182)
See full diff in compare view

Updates @semantic-release/git from 10.0.1 to 11.0.1

Release notes

Sourced from @semantic-release/git's releases.

v11.0.1

11.0.1 (2026-07-24)

Bug Fixes

deps: update dependency execa to v10 (#564) (b39d5c6)

v11.0.0

11.0.0 (2026-07-21)

Features

ES Module (#544) (4d704a2), closes #491 #490

BREAKING CHANGES

@semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)

the minimum required version of semantic-release to use @semantic-release/git is now v20.1.0

v11.0.0-beta.2

11.0.0-beta.2 (2026-07-20)

Bug Fixes

update Node.js engine version requirements in package.json and package-lock.json (ddf699e)

v11.0.0-beta.1

11.0.0-beta.1 (2026-07-17)

Features

ES Module (#526) (e523946), closes #491 #490

BREAKING CHANGES

@semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)

the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

... (truncated)

Commits

b39d5c6 fix(deps): update dependency execa to v10 (#564)
9dd61f1 chore(deps): lock file maintenance (#470)
c5c6f06 chore(deps): update dependency lodash-es to v4.18.1 [security] (#545)
b67458c ci(action): update actions/setup-node action to v6.5.0 (#557)
d4990ff ci(action): update actions/checkout action to v6.1.0 (#556)
16d191f chore(deps): update dependency tempy to v3.2.0 (#448)
8efa7b7 chore(deps): update dependency sinon to v21.1.2 (#554)
e53dc53 chore(deps): update dependency prettier to v3.9.5 (#552)
4c2f87f chore(deps): update dependency ls-engines to v0.10.1 (#551)
7685d83 chore(deps): update dependency ava to v6.4.1 (#548)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @semantic-release/git since your current version.

Updates @semantic-release/github from 12.0.8 to 12.0.10

Release notes

Sourced from @semantic-release/github's releases.

v12.0.10

12.0.10 (2026-09-21)

Bug Fixes

deps: update dependency @octokit/plugin-paginate-rest to v15 (#1284) (a63f458)

v12.0.9

12.0.9 (2026-07-01)

Bug Fixes

asset-upload: stop setting content-length header manually (241f966), closes #1224

local-undici: always use the locally installed undici instead of the node built-in version (40973e3), closes #1224

publish: handle content-length header properly for asset uploads (#1260) (28e3741), closes #1224 #1224

Commits

a63f458 fix(deps): update dependency @octokit/plugin-paginate-rest to v15 (#1284)
f5f6d0e build(deps): bump brace-expansion (#1300)
eaffbba build(deps): bump undici from 6.27.0 to 6.28.1 (#1301)
07686dc chore(deps): update dependency undici to v7.29.0 [security] (#1283)
9f010ee build(deps-dev): bump baseline-browser-mapping from 2.10.42 to 2.11.25 (#1295)
81eeeca build(deps-dev): bump js-yaml from 3.15.0 to 3.15.2 (#1294)
43c2210 build(deps-dev): bump fast-uri from 3.1.4 to 3.1.8 (#1290)
e703272 build(deps-dev): bump browserslist from 4.28.4 to 4.29.0 (#1291)
e7f4b4b chore(deps): update dependency prettier to v3.9.8 (#1298)
2e9e42b chore(deps): update dependency prettier to v3.9.7 (#1296)
Additional commits viewable in compare view

Updates @semantic-release/npm from 13.1.5 to 13.2.0

Release notes

Sourced from @semantic-release/npm's releases.

v13.2.0

13.2.0 (2026-09-21)

Features

trusted-publishing: add support for CircleCI (fb35b81)

Commits

5ef76be Merge pull request #1212 from Thomaash/trusted-publishing--circleci
1a4bdda chore(deps): lock file maintenance (#1232)
886ec16 chore(deps): update dependency prettier to v3.9.8 (#1231)
0388a4d chore(deps): update dependency prettier to v3.9.7 (#1230)
fb35b81 feat(trusted-publishing): add support for CircleCI
f5cca0a chore(deps): lock file maintenance (#1229)
095f289 chore(deps): update dependency p-retry to v8.0.1 (#1227)
bb003a4 chore(deps): lock file maintenance (#1228)
ca0b340 chore(deps): update dependency got to v16 (#1226)
22a1e17 chore(deps): lock file maintenance (#1225)
Additional commits viewable in compare view

Updates @tsconfig/node22 from 22.0.5 to 22.0.6

Commits

See full diff in compare view

Updates @types/node from 22.19.19 to 26.6.5

Commits

See full diff in compare view

Updates eslint from 9.39.4 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)

a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)

66ac583 feat: check yield*Description has been truncated

…th 19 updates Bumps the npm-version-updates group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` | | [qs](https://github.com/ljharb/qs) | `6.16.0` | `6.16.1` | | [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `20.5.3` | `21.2.3` | | [@jest/globals](https://github.com/jestjs/jest/tree/HEAD/packages/jest-globals) | `30.4.1` | `30.5.2` | | [@semantic-release/git](https://github.com/semantic-release/git) | `10.0.1` | `11.0.1` | | [@semantic-release/github](https://github.com/semantic-release/github) | `12.0.8` | `12.0.10` | | [@semantic-release/npm](https://github.com/semantic-release/npm) | `13.1.5` | `13.2.0` | | [@tsconfig/node22](https://github.com/tsconfig/bases/tree/HEAD/bases) | `22.0.5` | `22.0.6` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.19` | `26.6.5` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `10.13.0` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.0.5` | `30.5.2` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `5.88.1` | `6.41.0` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.9.10` | | [semantic-release](https://github.com/semantic-release/semantic-release) | `25.0.3` | `25.0.9` | | [supertest](https://github.com/ladjs/supertest) | `7.2.2` | `7.3.1` | | [@types/supertest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/supertest) | `6.0.3` | `7.2.1` | | [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.0` | `29.4.15` | | [typedoc](https://github.com/TypeStrong/TypeDoc) | `0.28.19` | `0.28.20` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | Updates `express` from 5.2.1 to 5.3.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v5.2.1...v5.3.0) Updates `qs` from 6.16.0 to 6.16.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.16.0...v6.16.1) Updates `@commitlint/config-conventional` from 20.5.3 to 21.2.3 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.3/@commitlint/config-conventional) Updates `@jest/globals` from 30.4.1 to 30.5.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.2/packages/jest-globals) Updates `@semantic-release/git` from 10.0.1 to 11.0.1 - [Release notes](https://github.com/semantic-release/git/releases) - [Commits](semantic-release/git@v10.0.1...v11.0.1) Updates `@semantic-release/github` from 12.0.8 to 12.0.10 - [Release notes](https://github.com/semantic-release/github/releases) - [Commits](semantic-release/github@v12.0.8...v12.0.10) Updates `@semantic-release/npm` from 13.1.5 to 13.2.0 - [Release notes](https://github.com/semantic-release/npm/releases) - [Commits](semantic-release/npm@v13.1.5...v13.2.0) Updates `@tsconfig/node22` from 22.0.5 to 22.0.6 - [Commits](https://github.com/tsconfig/bases/commits/HEAD/bases) Updates `@types/node` from 22.19.19 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 9.39.4 to 10.13.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.4...v10.13.0) Updates `jest` from 30.0.5 to 30.5.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.2/packages/jest) Updates `knip` from 5.88.1 to 6.41.0 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.41.0/packages/knip) Updates `prettier` from 3.8.3 to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.3...3.9.10) Updates `semantic-release` from 25.0.3 to 25.0.9 - [Release notes](https://github.com/semantic-release/semantic-release/releases) - [Commits](semantic-release/semantic-release@v25.0.3...v25.0.9) Updates `supertest` from 7.2.2 to 7.3.1 - [Release notes](https://github.com/ladjs/supertest/releases) - [Commits](forwardemail/supertest@v7.2.2...v7.3.1) Updates `@types/supertest` from 6.0.3 to 7.2.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/supertest) Updates `ts-jest` from 29.4.0 to 29.4.15 - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md) - [Commits](kulshekhar/ts-jest@v29.4.0...v29.4.15) Updates `typedoc` from 0.28.19 to 0.28.20 - [Release notes](https://github.com/TypeStrong/TypeDoc/releases) - [Changelog](https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md) - [Commits](TypeStrong/typedoc@v0.28.19...v0.28.20) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v7.0.2) --- updated-dependencies: - dependency-name: express dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-version-updates - dependency-name: qs dependency-version: 6.16.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-version-updates - dependency-name: "@commitlint/config-conventional" dependency-version: 21.2.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates - dependency-name: "@jest/globals" dependency-version: 30.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-version-updates - dependency-name: "@semantic-release/git" dependency-version: 11.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates - dependency-name: "@semantic-release/github" dependency-version: 12.0.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-version-updates - dependency-name: "@semantic-release/npm" dependency-version: 13.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-version-updates - dependency-name: "@tsconfig/node22" dependency-version: 22.0.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-version-updates - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates - dependency-name: eslint dependency-version: 10.13.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates - dependency-name: jest dependency-version: 30.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-version-updates - dependency-name: knip dependency-version: 6.41.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-version-updates - dependency-name: semantic-release dependency-version: 25.0.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-version-updates - dependency-name: supertest dependency-version: 7.3.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-version-updates - dependency-name: "@types/supertest" dependency-version: 7.2.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates - dependency-name: ts-jest dependency-version: 29.4.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-version-updates - dependency-name: typedoc dependency-version: 0.28.20 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-version-updates - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-27T06:08:14Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update JavaScript / TypeScript code labels Oct 20, 2026

dependabot Bot closed this Oct 27, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-version-updates-856bbbc23a branch October 27, 2026 06:08

Navigation Menu

Repository navigation

chore(deps): bump the npm-version-updates group across 1 directory with 19 updates - #30

chore(deps): bump the npm-version-updates group across 1 directory with 19 updates#30
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-version-updates-856bbbc23a

dependabot Bot commented on behalf of github Oct 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 27, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.3.0

Highlights

🐞 Bug fixes

🚀 Improvements

5.3.0

🐞 Bug fixes

🚀 Improvements

6.16.1

v21.2.3

21.2.3 (2026-09-19)

Bug Fixes

Refactor

Chore, ci, build, etc.

New Contributors

v21.2.2

21.2.2 (2026-08-13)

Bug Fixes

Chore, docs, etc.

21.2.3 (2026-09-19)

Bug Fixes

21.2.2 (2026-08-13)

21.2.0 (2026-06-30)

Features

21.1.0 (2026-06-23)

21.0.2 (2026-05-29)

21.0.1 (2026-05-12)

v30.5.2

Features

Fixes

New Contributors

v30.5.1

Fixes

Chore & Maintenance

New Contributors

v30.5.0

Highlights

whenCalledWith

30.5.2

Features

Fixes

30.5.1

Fixes

Chore & Maintenance

30.5.0

Features

Fixes

v11.0.1

11.0.1 (2026-07-24)

Bug Fixes

v11.0.0

11.0.0 (2026-07-21)

Features

BREAKING CHANGES

v11.0.0-beta.2

11.0.0-beta.2 (2026-07-20)

Bug Fixes

v11.0.0-beta.1

11.0.0-beta.1 (2026-07-17)

Features

BREAKING CHANGES

Other Notable Changes

v12.0.10

12.0.10 (2026-09-21)

Bug Fixes

v12.0.9

12.0.9 (2026-07-01)

Bug Fixes

v13.2.0

13.2.0 (2026-09-21)

Features

v10.13.0

Features

Uh oh!

dependabot Bot commented on behalf of github Oct 27, 2026

Uh oh!

Reviewers

Uh oh!

dependabot Bot commented on behalf of github Oct 20, 2026 •

edited

Loading

`whenCalledWith`