build(deps): bump the npm_and_yarn group across 3 directories with 22 updates by dependabot[bot] · Pull Request #92 · SeedCompany/libs

dependabot · 2026-04-08T22:37:37Z

Bumps the npm_and_yarn group with 19 updates in the / directory:

Package	From	To
tsup	`7.1.0`	`8.3.5`
@nestjs/common	`10.4.4`	`10.4.16`
@nestjs/core	`10.4.4`	`11.1.18`
@apollo/server	`4.11.3`	`5.5.0`
nodemailer	`7.0.5`	`8.0.5`
mjml	`4.15.3`	`4.18.0`
@smithy/config-resolver	`3.0.8`	`3.0.13`
axios	`1.3.4`	`1.15.0`
ejs	`3.1.9`	`3.1.10`
flatted	`3.2.7`	`3.4.2`
formidable	`2.1.2`	`2.1.5`
handlebars	`4.7.7`	`4.7.9`
js-yaml	`3.14.1`	`3.14.2`
picomatch	`2.3.1`	`2.3.2`
sha.js	`2.4.11`	`2.4.12`
tar	`6.1.13`	`6.2.1`
validator	`13.15.15`	`13.15.35`
vite	`7.1.2`	`7.3.2`
ws	`7.5.9`	`7.5.10`

Bumps the npm_and_yarn group with 1 update in the /packages/data-loader directory: @apollo/server.
Bumps the npm_and_yarn group with 2 updates in the /packages/email directory: @nestjs/core and nodemailer.

Updates tsup from 7.1.0 to 8.3.5

Release notes

Sourced from tsup's releases.

v8.3.5

   🐞 Bug Fixes

Run experimentalDts only once - by @aryaemami59 in egoist/tsup#1236 (fddd4)

    View changes on GitHub

v8.3.4

No significant changes

    View changes on GitHub

v8.3.3

No significant changes

    View changes on GitHub

v8.3.1

   🚀 Features

Add es2024 target - by @sxzz (4c8cd)

   🐞 Bug Fixes

Support TS 5.6 for svelte - by @sxzz (28b9c)

Add neutral value to platform options in schema.json - by @venables in egoist/tsup#982 (a03db)

Wider restriction for target option - by @odanado in egoist/tsup#1118 (1979b)

Add terser value to minify option in schema.json - by @damienbutt in egoist/tsup#991 (34951)

Change newlineKind to lf for experimentalDts - by @aryaemami59 in egoist/tsup#1234 (4584b)

Enable rollup output.compact when minify is enabled - by @hyrious in egoist/tsup#1232 (9cc86)

Support Node16 and NodeNext module resolution in experimentalDts - by @aryaemami59 in egoist/tsup#1225 (41c98)

    View changes on GitHub

v8.3.0

8.3.0 (2024-09-17)

Bug Fixes

fix experimentalDts file cleaning and watching (#1199) (76dc18b)

Features

add support for cts and mts config files (#1178) (ec811b3)

add support for async injectStyle (#1193) (f25a9db)

v8.2.4

8.2.4 (2024-08-02)

... (truncated)

Commits

cd03e1e chore: release v8.3.5
fddd451 fix: run experimentalDts only once (#1236)
21b1193 chore: release v8.3.4
580e03d ci: fix release workflow
01b38f2 chore: release v8.3.3
4f5b71e ci: fix release workflow
e80dad6 chore: release v8.3.2
f4af79a ci: fix release workflow (#1241)
4b72d61 chore: release v8.3.1
41c98ff fix: support Node16 and NodeNext module resolution in experimentalDts (...
Additional commits viewable in compare view

Updates @nestjs/common from 10.4.4 to 10.4.16

Release notes

Sourced from @nestjs/common's releases.

v10.4.16

What's Changed

fix(common): introduce magic file type validator to nestjs common by @Chathula in nestjs/nest#14948

Full Changelog: nestjs/nest@v10.4.15...v10.4.16

v10.4.15 (2024-12-09)

Dependencies

platform-express

#14282 fix(deps): update dependency express to v4.21.2 (@renovate[bot])

v10.4.13 (2024-12-03)

Bug fixes

common

#14256 chore(common): Add type declaration for RawBody decorator with pipes (@sapenlei)

Dependencies

#14257 fix(deps): update dependency @fastify/static to v7.0.4 (@renovate[bot])

#14258 fix(deps): update dependency @nestjs/sequelize to v10.0.1 (@renovate[bot])

#14249 chore(deps): bump @apollo/gateway from 2.4.8 to 2.8.5 in /sample/32-graphql-federation-schema-first/users-application (@dependabot[bot])

#14250 chore(deps): update jest monorepo (@renovate[bot])

#14245 chore(deps): update dependency mqtt to v5.10.3 (@renovate[bot])

#14247 fix(deps): update nest monorepo to v10.4.12 (@renovate[bot])

#14251 chore(deps-dev): bump graphql-tools from 9.0.3 to 9.0.5 (@dependabot[bot])

#14246 chore(deps): update nest monorepo (@renovate[bot])

Committers: 3

Kamil Mysliwiec (@kamilmysliwiec)

Micael Levi L. Cavalcante (@micalevisk)

sapenlei (@sapenlei)

v10.4.12 (2024-11-29)

Bug fixes

common

#14241 fix(common): enforce string type in validationpipe (@LhonRafaat)

Dependencies

Other

#14243 chore(deps): update dependency @types/node to v20.17.9 (@renovate[bot])

#14240 chore(deps): update dependency @types/multer to v1.4.12 (@renovate[bot])

#14239 chore(deps): update dependency @types/chai to v4.3.20 (@renovate[bot])

#14237 chore(deps): update confluentinc/cp-zookeeper docker tag to v7.7.2 (@renovate[bot])

#14236 chore(deps): update confluentinc/cp-kafka docker tag to v7.7.2 (@renovate[bot])

#12253 fix(deps): update apollo graphql packages (@renovate[bot])

#14235 chore(deps-dev): bump @commitlint/config-angular from 19.5.0 to 19.6.0 (@dependabot[bot])

#14233 chore(deps): update nest monorepo (@renovate[bot])

... (truncated)

Commits

6c8aec6 chore(@nestjs) publish v10.4.16 release
2b9e132 chore: update outdated tests, make file-type optional
cb0d650 chore: remove duplicate packages
6196ab2 Merge branch 'Chathula-fix-nestjs-common-mime-validator'
0ac7959 chore: minor tweaks
312a54a Update packages/common/pipes/file/file-type.validator.ts
a28fc03 refactor(common): move back file type validator options type
07b4b38 refactor(common): move file-type package to peer dependencies
0b7af8a refactor(common): refactor code to use simple eval
6953b7a fix(common): used eval import
Additional commits viewable in compare view

Updates @nestjs/core from 10.4.4 to 11.1.18

Release notes

Sourced from @nestjs/core's releases.

v11.1.18 (2026-04-03)

Bug fixes

microservices

#16675 fix(microservices): preserve packet headers in nats serializer (@wwenrr)

core

#16683 fix(core): prevent injector hang when design:paramtypes is missing (@Youmoo)

#16637 fix(core): dependency injection edge case with moduleref.create (@JakobStaudinger)

nestjs/nest#16686 fix(core): sanitize sse message

Dependencies

core, platform-express, platform-fastify

#16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@renovate[bot])

platform-fastify

#16623 fix(deps): update dependency fastify to v5.8.4 (@renovate[bot])

platform-ws

#16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@dependabot[bot])

common

#16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@dependabot[bot])

Committers: 6

Ankit San (@ankitbelal)

Jakob Staudinger (@JakobStaudinger)

Kamil Mysliwiec (@kamilmysliwiec)

Krishna Chaitanya (@Krishnachaitanyakc)

MK (@wwenrr)

youmoo (@Youmoo)

v11.1.17 (2026-03-16)

Enhancements

microservices

#16218 feat(microservices): add redis driver identification (@vchomakov)

Bugs

platform-fastify

auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) nestjs/nest@cbdf737 (@kamilmysliwiec)

Dependencies

common

#16567 fix(deps): update dependency file-type to v21.3.2 (@renovate[bot])

platform-fastify

#16533 fix(deps): update dependency fastify to v5.8.2 (@renovate[bot])

Committers: 3

Rohan Santhosh Kumar (@Rohan5commit)

Vasil Chomakov (@vchomakov)

Kamil Mysliwiec (@kamilmysliwiec)

... (truncated)

Commits

3c1cc5f chore(release): publish v11.1.18 release
0f962c7 fix(core): sanitize sse message
94aa424 Merge pull request #16679 from nestjs/renovate/path-to-regexp-8.x
368691c fix(core): prevent injector hang when design:paramtypes is missing
25d4fde fix(deps): update dependency path-to-regexp to v8.4.2
5c0b11e fix(deps): update dependency path-to-regexp to v8.4.1
f7d4460 Merge pull request #16637 from JakobStaudinger/moduleref-create-transient-sco...
d0a9dc9 fix(deps): update dependency path-to-regexp to v8.4.0
4677434 feat(core): export IEntryNestModule type
7493b94 fix(core): dependency injection edge case with moduleref.create
Additional commits viewable in compare view

Updates @apollo/server from 4.11.3 to 5.5.0

Release notes

Sourced from @apollo/server's releases.

@apollo/server-integration-testsuite@5.5.0

Minor Changes

#8191 ada1200 - ⚠️ SECURITY @apollo/server/standalone:

Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

(GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

See advisory GHSA-9q82-xgwf-vj6h for more details.

Patch Changes

Updated dependencies [ada1200]:

@apollo/server@5.5.0

@apollo/server@5.5.0

Minor Changes

#8191 ada1200 Thanks @glasser! - ⚠️ SECURITY @apollo/server/standalone:

Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

(GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

See advisory GHSA-9q82-xgwf-vj6h for more details.

@apollo/server-integration-testsuite@5.4.0

Patch Changes

Updated dependencies [d25a5bd]:

@apollo/server@5.4.0

@apollo/server@5.4.0

Minor Changes

d25a5bd Thanks @phryneas! - ⚠️ SECURITY @apollo/server/standalone:

... (truncated)

Changelog

Sourced from @apollo/server's changelog.

5.5.0

Minor Changes

#8191 ada1200 Thanks @glasser! - ⚠️ SECURITY @apollo/server/standalone:

Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

(GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

See advisory GHSA-9q82-xgwf-vj6h for more details.

5.4.0

Minor Changes

d25a5bd Thanks @phryneas! - ⚠️ SECURITY @apollo/server/standalone:

The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8. Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now. In a future major release, we may tighten this restriction further to only allow UTF-8.

If you were not using startStandaloneServer, you were not affected by this vulnerability.

Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server. For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

5.3.0

Minor Changes
#8062 8e54e58 Thanks @cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)
const server = new ApolloServer({
  typeDefs,
  resolvers,
  executionOptions: {
    maxCoercionErrors: 50,
  },

... (truncated)

Commits

64c0e1b Version Packages (#8192)
ada1200 Reject GET requests with a Content-Type other than application/json (#8191)
ad45d15 Version Packages (#8179)
d25a5bd Merge commit from fork
443e547 fix repository urls
28d6d47 Version Packages (#8172)
26320bc feat: Allow configuration of graphql validation options #8014
f2c16a7 bump dependency
8e54e58 feat: Allow configuration of graphql execution options(maxCoercionErrors)
7be3686 Version Packages (#8163)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @apollo/server since your current version.

Updates nodemailer from 7.0.5 to 8.0.5

Release notes

Sourced from nodemailer's releases.

v8.0.5

8.0.5 (2026-04-07)

Bug Fixes

decode SMTP server responses as UTF-8 at line boundary (95876b1)

sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

v8.0.4

8.0.4 (2026-03-25)

Bug Fixes

sanitize envelope size to prevent SMTP command injection (2d7b971)

v8.0.3

8.0.3 (2026-03-18)

Bug Fixes

clean up addressparser and fix group name fallback producing undefined (9d55877)

fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)

refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)

remove familySupportCache that broke DNS resolution tests (c803d90)

v8.0.2

8.0.2 (2026-03-09)

Bug Fixes

merge fragmented display names with unquoted commas in addressparser (fe27f7f)

v8.0.1

8.0.1 (2026-02-07)

Bug Fixes

absorb TLS errors during socket teardown (7f8dde4)

absorb TLS errors during socket teardown (381f628)

Add Gmail Workspace service configuration (#1787) (dc97ede)

v8.0.0

8.0.0 (2026-02-04)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

8.0.5 (2026-04-07)

Bug Fixes

decode SMTP server responses as UTF-8 at line boundary (95876b1)

sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

8.0.4 (2026-03-25)

Bug Fixes

sanitize envelope size to prevent SMTP command injection (2d7b971)

8.0.3 (2026-03-18)

Bug Fixes

clean up addressparser and fix group name fallback producing undefined (9d55877)

fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)

refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)

remove familySupportCache that broke DNS resolution tests (c803d90)

8.0.2 (2026-03-09)

Bug Fixes

merge fragmented display names with unquoted commas in addressparser (fe27f7f)

8.0.1 (2026-02-07)

Bug Fixes

absorb TLS errors during socket teardown (7f8dde4)

absorb TLS errors during socket teardown (381f628)

Add Gmail Workspace service configuration (#1787) (dc97ede)

8.0.0 (2026-02-04)

⚠ BREAKING CHANGES

Error code 'NoAuth' renamed to 'ENOAUTH'

Bug Fixes

... (truncated)

Commits

202cfb3 chore(master): release 8.0.5 (#1809)
b634abf docs: add CLAUDE.md with project conventions and release process
95876b1 fix: decode SMTP server responses as UTF-8 at line boundary
0a43876 fix: sanitize CRLF in transport name option to prevent SMTP command injection...
08e59e6 chore: update dev dependencies
2d31975 chore(master): release 8.0.4 (#1806)
2d7b971 fix: sanitize envelope size to prevent SMTP command injection
4e702e9 chore(master): release 8.0.3 (#1804)
c803d90 fix: remove familySupportCache that broke DNS resolution tests
e8c8b92 fix: fix cookie bugs, remove dead code, and improve hot-path efficiency
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for nodemailer since your current version.

Updates mjml from 4.15.3 to 4.18.0

Release notes

Sourced from mjml's releases.

v4.18.0

What's Changed

Documentation

Content updates by @dazgreer in mjmlio/mjml#3021

Full Changelog: mjmlio/mjml@v4.17.2...v4.18.0

v4.17.2

What's Changed

Fixes

mj-section: do not inherit attributes from context #3019 by @dazgreer in mjmlio/mjml#3020

Full Changelog: mjmlio/mjml@v4.17.1...v4.17.2

v4.17.1

What's Changed

Fixes

mjml-wrapper: allowed attributes not inheriting #3011 by @dazgreer in mjmlio/mjml#3012

Full Changelog: mjmlio/mjml@v4.17.0...v4.17.1

v4.17.0

What's Changed

Features

mjml-wrapper: add gap between sections #2977 by @dazgreer in mjmlio/mjml#3004

Fixes

mjml-social: respect align and icon-height attributes #3001 by @dazgreer in mjmlio/mjml#3002

mjml-carousel: hide thumbnails if not supported #2999 by @dazgreer in mjmlio/mjml#3000

mjml-accordion: respect font-family and padding-x attributes #2997 by @dazgreer in mjmlio/mjml#2998

mjml-table: respect cellspacing #2995 by @dazgreer in mjmlio/mjml#2996

mjml-navbar: fix ico-padding-x that was not working #2991 by @dazgreer in mjmlio/mjml#2992

mjml-column: fix border-radius that was not working #2989 by @dazgreer in mjmlio/mjml#2990

Documentation

Added link to support matrix by @dazgreer in mjmlio/mjml#3005

Update image URLs by @dazgreer in mjmlio/mjml#3007

Examples indenting by @EtienneHosman in mjmlio/mjml#2974

Other

... (truncated)

Commits

7f4872c v4.18.0
95b9ebd v4.17.2
3f3b0bc v4.17.1
375c593 v4.17.0
81f37ea Merge pull request #2990 from mjmlio/bugfix/MJML-36-mj-column_border_radius
025e3fc Merge pull request #2992 from mjmlio/bugfix/MJML-37-mj-navbar_ico-padding-x
424cac8 Merge pull request #2996 from mjmlio/bugfix/MJML-39-mj-table-cellspacing
4d975b0 Merge pull request #2998 from mjmlio/bugfix/MJML-43-mj-accordion_font-family_...
4d41b9d Merge pull request #3000 from mjmlio/feature/MJML-49-mj-carousel_thumbnails_f...
9bac7c6 Merge pull request #3002 from mjmlio/bugfix/MJML-41-mj-social_align_icon-height
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by totocap, a new releaser for mjml since your current version.

Updates @smithy/config-resolver from 3.0.8 to 3.0.13

Changelog

Sourced from @smithy/config-resolver's changelog.

3.0.13

Patch Changes

Updated dependencies [b52b4e8]

@smithy/types@3.7.2

@smithy/node-config-provider@3.1.12

@smithy/util-middleware@3.0.11

3.0.12

Patch Changes

Updated dependencies [fcd5ca8]

@smithy/types@3.7.1

@smithy/node-config-provider@3.1.11

@smithy/util-middleware@3.0.10

3.0.11

Patch Changes

Updated dependencies [cd1929b]

@smithy/types@3.7.0

@smithy/node-config-provider@3.1.10

@smithy/util-middleware@3.0.9

3.0.10

Patch Changes

Updated dependencies [84bec05]

@smithy/types@3.6.0

@smithy/node-config-provider@3.1.9

@smithy/util-middleware@3.0.8

3.0.9

Patch Changes

Updated dependencies [a4c1285]

@smithy/types@3.5.0

@smithy/node-config-provider@3.1.8

@smithy/util-middleware@3.0.7

Commits

50d8c54 Version NPM packages
7877c9e Version NPM packages
012775c Version NPM packages
cd1929b test: convert tests to vitest (#1440)
5de4524 Version NPM packages
8051551 Version NPM packages
See full diff in compare view

Updates axios from 1.3.4 to 1.15.0

Release notes

Sourced from axios's releases.

v1.15.0

This release delivers two critical security patches, adds runtime support for Deno and Bun, and includes significant CI hardening, documentation improvements, and routine dependency updates.

⚠️ Important Changes

Deprecation: url.parse() usage has been replaced to address Node.js deprecation warnings. If you are on a recent version of Node.js, this resolves console warnings you may have been seeing. (#10625)

🔒 Security Fixes

Proxy Handling: Fixed a no_proxy hostname normalisation bypass that could lead to Server-Side Request Forgery (SSRF). (#10661)

Header Injection: Fixed an unrestricted cloud metadata exfiltration vulnerability via a header injection chain. (#10660)

🚀 New Features

Runtime Support: Added compatibility checks and documentation for Deno and Bun environments. (#10652, #10653)

🔧 Maintenance & Chores

CI Security: Hardened workflow permissions to least privilege, added the zizmor security scanner, pinned action versions, and gated npm publishing with OIDC and environment protection. (#10618, #10619, #10627, #10637, #10666)

Dependencies: Bumped serialize-javascript, handlebars, picomatch, vite, and denoland/setup-deno to latest versions. Added a 7-day Dependabot cooldown period. (#10574, #10572, #10568, #10663, #10664, #10665, #10669, #10670, #10616)

Documentation: Unified docs, improved beforeRedirect credential leakage example, clarified withCredentials/withXSRFToken behaviour, HTTP/2 support notes, async/await timeout error handling, header case preservation, and various typo fixes. (#10649, #10624, #7452, #7471, #10654, #10644, #10589)

Housekeeping: Removed stale files, regenerated lockfile, and updated sponsor scripts and blocks. (#10584, #10650, #10582, #10640, #10659, #10668)

Tests: Added regression coverage for urlencoded Content-Type casing. (#10573)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@raashish1601 (#10573)

@Kilros0817 (#10625)

@ashstrc (#10624)

@Abhi3975 (#10589)

@theamodhshetty (#7452)

v1.14.0

This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.

⚠️ Important Changes

Breaking Changes: None identified in this release.

Action Required: If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably proxy-from-env v2 alignment and main entry compatibility fix).

🚀 New Features

Runtime Features: No new end-user features were introduced in this release.

Test Coverage Expansion: Added broader smoke/module test coverage for CJS and ESM package usage. (#7510)

🐛 Bug Fixes

Headers: Trim trailing CRLF in normalised header values. (#7456)

HTTP/2: Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (#7457)

Fetch Adapter: Cancel ReadableStream created during request-stream capability probing to prevent async resource leaks. (#7515)

Proxy Handling: Fixed env proxy behavior with proxy-from-env v2 usage. (#7499)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)

interceptor: handle the error in the same interceptor (#6269) (

… updates Bumps the npm_and_yarn group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [tsup](https://github.com/egoist/tsup) | `7.1.0` | `8.3.5` | | [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `10.4.4` | `10.4.16` | | [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `10.4.4` | `11.1.18` | | [@apollo/server](https://github.com/apollographql/apollo-server/tree/HEAD/packages/server) | `4.11.3` | `5.5.0` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `7.0.5` | `8.0.5` | | [mjml](https://github.com/mjmlio/mjml/tree/HEAD/packages/mjml) | `4.15.3` | `4.18.0` | | [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver) | `3.0.8` | `3.0.13` | | [axios](https://github.com/axios/axios) | `1.3.4` | `1.15.0` | | [ejs](https://github.com/mde/ejs) | `3.1.9` | `3.1.10` | | [flatted](https://github.com/WebReflection/flatted) | `3.2.7` | `3.4.2` | | [formidable](https://github.com/node-formidable/formidable) | `2.1.2` | `2.1.5` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.7` | `4.7.9` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [sha.js](https://github.com/crypto-browserify/sha.js) | `2.4.11` | `2.4.12` | | [tar](https://github.com/isaacs/node-tar) | `6.1.13` | `6.2.1` | | [validator](https://github.com/validatorjs/validator.js) | `13.15.15` | `13.15.35` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.2` | `7.3.2` | | [ws](https://github.com/websockets/ws) | `7.5.9` | `7.5.10` | Bumps the npm_and_yarn group with 1 update in the /packages/data-loader directory: [@apollo/server](https://github.com/apollographql/apollo-server/tree/HEAD/packages/server). Bumps the npm_and_yarn group with 2 updates in the /packages/email directory: [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) and [nodemailer](https://github.com/nodemailer/nodemailer). Updates `tsup` from 7.1.0 to 8.3.5 - [Release notes](https://github.com/egoist/tsup/releases) - [Commits](egoist/tsup@v7.1.0...v8.3.5) Updates `@nestjs/common` from 10.4.4 to 10.4.16 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v10.4.16/packages/common) Updates `@nestjs/core` from 10.4.4 to 11.1.18 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.18/packages/core) Updates `@apollo/server` from 4.11.3 to 5.5.0 - [Release notes](https://github.com/apollographql/apollo-server/releases) - [Changelog](https://github.com/apollographql/apollo-server/blob/main/packages/server/CHANGELOG.md) - [Commits](https://github.com/apollographql/apollo-server/commits/@apollo/server@5.5.0/packages/server) Updates `nodemailer` from 7.0.5 to 8.0.5 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v7.0.5...v8.0.5) Updates `mjml` from 4.15.3 to 4.18.0 - [Release notes](https://github.com/mjmlio/mjml/releases) - [Commits](https://github.com/mjmlio/mjml/commits/v4.18.0/packages/mjml) Updates `@smithy/config-resolver` from 3.0.8 to 3.0.13 - [Release notes](https://github.com/smithy-lang/smithy-typescript/releases) - [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/config-resolver/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@3.0.13/packages/config-resolver) Updates `axios` from 1.3.4 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.3.4...v1.15.0) Updates `ejs` from 3.1.9 to 3.1.10 - [Release notes](https://github.com/mde/ejs/releases) - [Changelog](https://github.com/mde/ejs/blob/main/RELEASE_NOTES_v5.md) - [Commits](mde/ejs@v3.1.9...v3.1.10) Updates `esbuild` from 0.18.12 to 0.25.9 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md) - [Commits](evanw/esbuild@v0.18.12...v0.25.9) Updates `flatted` from 3.2.7 to 3.4.2 - [Commits](WebReflection/flatted@v3.2.7...v3.4.2) Updates `form-data` from 3.0.1 to 4.0.0 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v3.0.1...v4.0.0) Updates `formidable` from 2.1.2 to 2.1.5 - [Release notes](https://github.com/node-formidable/formidable/releases) - [Changelog](https://github.com/node-formidable/formidable/blob/master/CHANGELOG.md) - [Commits](https://github.com/node-formidable/formidable/commits) Updates `handlebars` from 4.7.7 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.7...v4.7.9) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `rollup` from 3.20.0 to 4.46.3 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/v4.46.3/CHANGELOG.md) - [Commits](rollup/rollup@v3.20.0...v4.46.3) Updates `sha.js` from 2.4.11 to 2.4.12 - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](browserify/sha.js@v2.4.11...v2.4.12) Updates `tar` from 6.1.13 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.13...v6.2.1) Updates `validator` from 13.15.15 to 13.15.35 - [Release notes](https://github.com/validatorjs/validator.js/releases) - [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md) - [Commits](validatorjs/validator.js@13.15.15...13.15.35) Updates `vite` from 7.1.2 to 7.3.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite) Updates `ws` from 7.5.9 to 7.5.10 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.9...7.5.10) Updates `@apollo/server` from 4.13.0 to 5.5.0 - [Release notes](https://github.com/apollographql/apollo-server/releases) - [Changelog](https://github.com/apollographql/apollo-server/blob/main/packages/server/CHANGELOG.md) - [Commits](https://github.com/apollographql/apollo-server/commits/@apollo/server@5.5.0/packages/server) Updates `@nestjs/core` from 10.4.22 to 11.1.18 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.18/packages/core) Updates `nodemailer` from 7.0.13 to 8.0.5 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v7.0.5...v8.0.5) --- updated-dependencies: - dependency-name: tsup dependency-version: 8.3.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@nestjs/common" dependency-version: 10.4.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@nestjs/core" dependency-version: 11.1.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@apollo/server" dependency-version: 5.5.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 8.0.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mjml dependency-version: 4.18.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@smithy/config-resolver" dependency-version: 3.0.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ejs dependency-version: 3.1.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: formidable dependency-version: 2.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.46.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 6.2.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: validator dependency-version: 13.15.35 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@apollo/server" dependency-version: 5.5.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@nestjs/core" dependency-version: 11.1.18 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 8.0.5 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 8, 2026

dependabot Bot requested a review from a team April 8, 2026 22:37

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the npm_and_yarn group across 3 directories with 22 updates#92

build(deps): bump the npm_and_yarn group across 3 directories with 22 updates#92
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-c5bff07b6b

dependabot Bot commented on behalf of github Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 8, 2026

v8.3.5

🐞 Bug Fixes

View changes on GitHub

v8.3.4

View changes on GitHub

v8.3.3

View changes on GitHub

v8.3.1

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v8.3.0

8.3.0 (2024-09-17)

Bug Fixes

Features

v8.2.4

8.2.4 (2024-08-02)

v10.4.16

What's Changed

v10.4.15 (2024-12-09)

Dependencies

v10.4.13 (2024-12-03)

Bug fixes

Dependencies

Committers: 3

v10.4.12 (2024-11-29)

Bug fixes

Dependencies

v11.1.18 (2026-04-03)

Bug fixes

Dependencies

Committers: 6

v11.1.17 (2026-03-16)

Enhancements

Bugs

Dependencies

Committers: 3

@​apollo/server-integration-testsuite@​5.5.0

Minor Changes

Patch Changes

@​apollo/server@​5.5.0

Minor Changes

@​apollo/server-integration-testsuite@​5.4.0

Patch Changes

@​apollo/server@​5.4.0

Minor Changes

5.5.0

Minor Changes

5.4.0

Minor Changes

5.3.0

Minor Changes

v8.0.5

8.0.5 (2026-04-07)

Bug Fixes

v8.0.4

8.0.4 (2026-03-25)

Bug Fixes

v8.0.3

8.0.3 (2026-03-18)

Bug Fixes

v8.0.2

8.0.2 (2026-03-09)

Bug Fixes

v8.0.1

8.0.1 (2026-02-07)

Bug Fixes

v8.0.0

8.0.0 (2026-02-04)

8.0.5 (2026-04-07)

Bug Fixes

8.0.4 (2026-03-25)

Bug Fixes

8.0.3 (2026-03-18)

Bug Fixes

8.0.2 (2026-03-09)

Bug Fixes

8.0.1 (2026-02-07)

`@apollo/server-integration-testsuite@5`.5.0

`@apollo/server@5`.5.0

`@apollo/server-integration-testsuite@5`.4.0

`@apollo/server@5`.4.0