Skip to content

build(deps): bump the npm_and_yarn group across 3 directories with 22 updates#94

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-54501f28a2
Closed

build(deps): bump the npm_and_yarn group across 3 directories with 22 updates#94
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-54501f28a2

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 16, 2026

Bumps the npm_and_yarn group with 18 updates in the / directory:

Package From To
tsup 7.1.0 8.3.5
@nestjs/common 10.4.4 10.4.16
@nestjs/core 10.4.4 11.1.18
@apollo/server 4.11.3 5.5.0
nodemailer 7.0.5 8.0.5
mjml 4.15.3 5.0.0
@smithy/config-resolver 3.0.8 3.0.13
axios 1.3.4 1.15.0
flatted 3.2.7 3.4.2
formidable 2.1.2 2.1.5
handlebars 4.7.7 4.7.9
js-yaml 3.14.1 3.14.2
picomatch 2.3.1 2.3.2
sha.js 2.4.11 2.4.12
tar 6.1.13 6.2.1
validator 13.15.15 13.15.35
vite 7.1.2 7.3.2
ws 7.5.9 7.5.10

Bumps the npm_and_yarn group with 1 update in the /packages/data-loader directory: @apollo/server.
Bumps the npm_and_yarn group with 3 updates in the /packages/email directory: @nestjs/core, nodemailer and mjml.

Updates tsup from 7.1.0 to 8.3.5

Release notes

Sourced from tsup's releases.

v8.3.5

   🐞 Bug Fixes

    View changes on GitHub

v8.3.4

No significant changes

    View changes on GitHub

v8.3.3

No significant changes

    View changes on GitHub

v8.3.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v8.3.0

8.3.0 (2024-09-17)

Bug Fixes

  • fix experimentalDts file cleaning and watching (#1199) (76dc18b)

Features

v8.2.4

8.2.4 (2024-08-02)

... (truncated)

Commits

Updates @nestjs/common from 10.4.4 to 10.4.16

Release notes

Sourced from @​nestjs/common's releases.

v10.4.16

What's Changed

Full Changelog: nestjs/nest@v10.4.15...v10.4.16

v10.4.15 (2024-12-09)

Dependencies

v10.4.13 (2024-12-03)

Bug fixes

  • common
    • #14256 chore(common): Add type declaration for RawBody decorator with pipes (@​sapenlei)

Dependencies

Committers: 3

v10.4.12 (2024-11-29)

Bug fixes

Dependencies

... (truncated)

Commits
  • 6c8aec6 chore(@​nestjs) publish v10.4.16 release
  • 2b9e132 chore: update outdated tests, make file-type optional
  • cb0d650 chore: remove duplicate packages
  • 6196ab2 Merge branch 'Chathula-fix-nestjs-common-mime-validator'
  • 0ac7959 chore: minor tweaks
  • 312a54a Update packages/common/pipes/file/file-type.validator.ts
  • a28fc03 refactor(common): move back file type validator options type
  • 07b4b38 refactor(common): move file-type package to peer dependencies
  • 0b7af8a refactor(common): refactor code to use simple eval
  • 6953b7a fix(common): used eval import
  • Additional commits viewable in compare view

Updates @nestjs/core from 10.4.4 to 11.1.18

Release notes

Sourced from @​nestjs/core's releases.

v11.1.18 (2026-04-03)

Bug fixes

Dependencies

Committers: 6

v11.1.17 (2026-03-16)

Enhancements

Bugs

Dependencies

Committers: 3

... (truncated)

Commits
  • 3c1cc5f chore(release): publish v11.1.18 release
  • 0f962c7 fix(core): sanitize sse message
  • 94aa424 Merge pull request #16679 from nestjs/renovate/path-to-regexp-8.x
  • 368691c fix(core): prevent injector hang when design:paramtypes is missing
  • 25d4fde fix(deps): update dependency path-to-regexp to v8.4.2
  • 5c0b11e fix(deps): update dependency path-to-regexp to v8.4.1
  • f7d4460 Merge pull request #16637 from JakobStaudinger/moduleref-create-transient-sco...
  • d0a9dc9 fix(deps): update dependency path-to-regexp to v8.4.0
  • 4677434 feat(core): export IEntryNestModule type
  • 7493b94 fix(core): dependency injection edge case with moduleref.create
  • Additional commits viewable in compare view

Updates @apollo/server from 4.11.3 to 5.5.0

Release notes

Sourced from @​apollo/server's releases.

@​apollo/server-integration-testsuite@​5.5.0

Minor Changes

  • #8191 ada1200 - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

Patch Changes

  • Updated dependencies [ada1200]:
    • @​apollo/server@​5.5.0

@​apollo/server@​5.5.0

Minor Changes

  • #8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

@​apollo/server-integration-testsuite@​5.4.0

Patch Changes

  • Updated dependencies [d25a5bd]:
    • @​apollo/server@​5.4.0

@​apollo/server@​5.4.0

Minor Changes

... (truncated)

Changelog

Sourced from @​apollo/server's changelog.

5.5.0

Minor Changes

  • #8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

5.4.0

Minor Changes

  • d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

    The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

    In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8. Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now. In a future major release, we may tighten this restriction further to only allow UTF-8.

    If you were not using startStandaloneServer, you were not affected by this vulnerability.

    Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server. For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

5.3.0

Minor Changes

  • #8062 8e54e58 Thanks @​cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)

    const server = new ApolloServer({
  typeDefs,
  resolvers,
  executionOptions: {
    maxCoercionErrors: 50,
  },

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​apollo/server since your current version.


Updates nodemailer from 7.0.5 to 8.0.5

Release notes

Sourced from nodemailer's releases.

v8.0.5

8.0.5 (2026-04-07)

Bug Fixes

  • decode SMTP server responses as UTF-8 at line boundary (95876b1)
  • sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

v8.0.4

8.0.4 (2026-03-25)

Bug Fixes

  • sanitize envelope size to prevent SMTP command injection (2d7b971)

v8.0.3

8.0.3 (2026-03-18)

Bug Fixes

  • clean up addressparser and fix group name fallback producing undefined (9d55877)
  • fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)
  • refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)
  • remove familySupportCache that broke DNS resolution tests (c803d90)

v8.0.2

8.0.2 (2026-03-09)

Bug Fixes

  • merge fragmented display names with unquoted commas in addressparser (fe27f7f)

v8.0.1

8.0.1 (2026-02-07)

Bug Fixes

  • absorb TLS errors during socket teardown (7f8dde4)
  • absorb TLS errors during socket teardown (381f628)
  • Add Gmail Workspace service configuration (#1787) (dc97ede)

v8.0.0

8.0.0 (2026-02-04)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

8.0.5 (2026-04-07)

Bug Fixes

  • decode SMTP server responses as UTF-8 at line boundary (95876b1)
  • sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

8.0.4 (2026-03-25)

Bug Fixes

  • sanitize envelope size to prevent SMTP command injection (2d7b971)

8.0.3 (2026-03-18)

Bug Fixes

  • clean up addressparser and fix group name fallback producing undefined (9d55877)
  • fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)
  • refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)
  • remove familySupportCache that broke DNS resolution tests (c803d90)

8.0.2 (2026-03-09)

Bug Fixes

  • merge fragmented display names with unquoted commas in addressparser (fe27f7f)

8.0.1 (2026-02-07)

Bug Fixes

  • absorb TLS errors during socket teardown (7f8dde4)
  • absorb TLS errors during socket teardown (381f628)
  • Add Gmail Workspace service configuration (#1787) (dc97ede)

8.0.0 (2026-02-04)

⚠ BREAKING CHANGES

  • Error code 'NoAuth' renamed to 'ENOAUTH'

Bug Fixes

... (truncated)

Commits
  • 202cfb3 chore(master): release 8.0.5 (#1809)
  • b634abf docs: add CLAUDE.md with project conventions and release process
  • 95876b1 fix: decode SMTP server responses as UTF-8 at line boundary
  • 0a43876 fix: sanitize CRLF in transport name option to prevent SMTP command injection...
  • 08e59e6 chore: update dev dependencies
  • 2d31975 chore(master): release 8.0.4 (#1806)
  • 2d7b971 fix: sanitize envelope size to prevent SMTP command injection
  • 4e702e9 chore(master): release 8.0.3 (#1804)
  • c803d90 fix: remove familySupportCache that broke DNS resolution tests
  • e8c8b92 fix: fix cookie bugs, remove dead code, and improve hot-path efficiency
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for nodemailer since your current version.


Updates mjml from 4.15.3 to 5.0.0

Release notes

Sourced from mjml's releases.

v5.0.0

Upgrade Guide

These are the changes users need to actively consider when upgrading to the MJML 5 beta from MJML 4.x (and early MJML 5 alphas):

Highlights

  • Replaced legacy html-minifier and js-beautify with htmlnano + cssnano. [breaking change]
  • Added templating syntax sanitization (runs before PostCSS and is restored afterwards)
  • Safer, stricter handling of mj-include and ignoreIncludes [breaking change]
  • Restructured outer HTML: the <body> tag is now driven by mj-body, not the global skeleton. [breaking change]
  • mjml-browser build/minification pipeline updated
  • Better attribute consistency across components (including more flexible border-radius). [breaking change]
  • Migration helper removed [breaking change]
  • Updated toolchain: Node 20/22/24 in CI. Removed Node 16/18 [breaking change]

HTML/CSS minification & formatting

What changed

  • HTML minification now uses htmlnano instead of html-minifier.
  • CSS minification now uses cssnano presets wired via mjml-core.
  • Minification options can be added via .mjmlconfig.js

Impact [potential breaking changes]

  • Generated HTML is more aggressively minified. If you rely on exact formatting (e.g. diffing raw HTML, parsing by regex, or checking snapshots), you may see changes.
  • Some obscure html-minifier specific options used in custom tooling will no longer apply; options are now expressed as htmlnano/cssnano configs.
  • Template tags may error in PostCSS (see Template syntax handling and sanitization below)
  • Fixes this issue: mjmlio/mjml#2589

What to do

  • Review any automation that assumes pretty‑printed HTML (tests, diffs, CI snapshot comparisons).
  • If you previously passed minify/beautify flags or custom minifier options, re‑map them to the new htmlnano/cssnano config.

Notes

  • cssnano uses lite preset by default. Due to this issue: mjmlio/mjml#2919. default preset can be used if your fonts don’t contain numerals

More detail: (mjmlio/mjml#2858)

Template syntax handling and sanitization (PostCSS)

What changed

  • Template syntax (e.g. {{ }}) is now sanitized before PostCSS and with syntax restored post-processing.

Impact

  • A CssSyntaxError error will occur when applying CSS minification to files with some template syntax
  • Fixes this issue: mjmlio/mjml#2858

... (truncated)

Commits
  • ddb2335 v5.0.0
  • 9aac8c6 v5.0.0-beta.2
  • 1dfbc95 v5.0.0-beta.1
  • 65e81da v5.0.0-alpha.11
  • 74f3577 Merge pull request #3045 from mjmlio/bugfix/3018-mjml5-ignoreIncludes-allowIn...
  • b8e6a60 Merge pull request #3044 from mjmlio/bugfix/attributes-adding-updating-for-co...
  • 2eb56d7 feature(includes): implemented tighter controls
  • 591fd1e bugfix(ignoreIncludes): updated test files
  • 6b22a67 feature(ignoreIncludes): added option for includePath
  • 9b7991f bugfix(border-radius): accept string input
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by totocap, a new releaser for mjml since your current version.


Updates @smithy/config-resolver from 3.0.8 to 3.0.13

Changelog

Sourced from @​smithy/config-resolver's changelog.

3.0.13

Patch Changes

  • Updated dependencies [b52b4e8]
    • @​smithy/types@​3.7.2
    • @​smithy/node-config-provider@​3.1.12
    • @​smithy/util-middleware@​3.0.11

3.0.12

Patch Changes

  • Updated dependencies [fcd5ca8]
    • @​smithy/types@​3.7.1
    • @​smithy/node-config-provider@​3.1.11
    • @​smithy/util-middleware@​3.0.10

3.0.11

Patch Changes

  • Updated dependencies [cd1929b]
    • @​smithy/types@​3.7.0
    • @​smithy/node-config-provider@​3.1.10
    • @​smithy/util-middleware@​3.0.9

3.0.10

Patch Changes

  • Updated dependencies [84bec05]
    • @​smithy/types@​3.6.0
    • @​smithy/node-config-provider@​3.1.9
    • @​smithy/util-middleware@​3.0.8

3.0.9

Patch Changes

  • Updated dependencies [a4c1285]
    • @​smithy/types@​3.5.0
    • @​smithy/node-config-provider@​3.1.8
    • @​smithy/util-middleware@​3.0.7
Commits

Updates axios from 1.3.4 to 1.15.0

Release notes

Sourced from axios's releases.

v1.15.0

This release delivers two critical security patches, adds runtime support for Deno and Bun, and includes significant CI hardening, documentation improvements, and routine dependency updates.

⚠️ Important Changes

  • Deprecation: url.parse() usage has been replaced to address Node.js deprecation warnings. If you are on a recent version of Node.js, this resolves console warnings you may have been seeing. (#10625)

🔒 Security Fixes

  • Proxy Handling: Fixed a no_proxy hostname normalisation bypass that could lead to Server-Side Request Forgery (SSRF). (#10661)
  • Header Injection: Fixed an unrestricted cloud metadata exfiltration vulnerability via a header injection chain. (#10660)

🚀 New Features

  • Runtime Support: Added compatibility checks and documentation for Deno and Bun environments. (#10652, #10653)

🔧 Maintenance & Chores

  • CI Security: Hardened workflow permissions to least privilege, added the zizmor security scanner, pinned action versions, and gated npm publishing with OIDC and environment protection. (#10618, #10619, #10627, #10637, #10666)
  • Dependencies: Bumped serialize-javascript, handlebars, picomatch, vite, and denoland/setup-deno to latest versions. Added a 7-day Dependabot cooldown period. (#10574, #10572, #10568, #10663, #10664, #10665, #10669, #10670, #10616)
  • Documentation: Unified docs, improved beforeRedirect credential leakage example, clarified withCredentials/withXSRFToken behaviour, HTTP/2 support notes, async/await timeout error handling, header case preservation, and various typo fixes. (#10649, #10624, #7452, #7471, #10654, #10644, #10589)
  • Housekeeping: Removed stale files, regenerated lockfile, and updated sponsor scripts and blocks. (#10584, #10650, #10582, #10640, #10659, #10668)
  • Tests: Added regression coverage for urlencoded Content-Type casing. (#10573)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

v1.14.0

This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.

⚠️ Important Changes

  • Breaking Changes: None identified in this release.
  • Action Required: If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably proxy-from-env v2 alignment and main entry compatibility fix).

🚀 New Features

  • Runtime Features: No new end-user features were introduced in this release.
  • Test Coverage Expansion: Added broader smoke/module test coverage for CJS and ESM package usage. (#7510)

🐛 Bug Fixes

  • Headers: Trim trailing CRLF in normalised header values. (#7456)
  • HTTP/2: Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (#7457)
  • Fetch Adapter: Cancel ReadableStream created during request-stream capability probing to prevent async resource leaks. (#7515)
  • Proxy Handling: Fixed env proxy behavior with proxy-from-env v2 usage. (#7499)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.15.0 — April 7, 2026

This release delivers two critical security patches targeting header injection and SSRF via proxy bypass, adds official runtime support for Deno and Bun, and includes significant CI security hardening.

🔒 Security Fixes

  • Header Injection (CRLF): Rejects any header value containing \r or \n characters to block CRLF injection chains that could be used to exfiltrate cloud metadata (IMDS). Behavior change: headers with CR/LF now throw "Invalid character in header content". (#10660)

  • SSRF via no_proxy Bypass: Introduces a shouldBypassProxy helper that normalises hostnames (strips trailing dots, handles bracketed IPv6) before evaluating no_proxy/NO_PROXY rules, closing a gap that could cause loopback or internal hosts to be inadvertently proxied. (#10661)

🚀 New Features

  • Deno & Bun Runtime Support: Added full smoke test suites for Deno and Bun, with CI workflows that run both runtimes before any release is cut. (#10652)

🐛 Bug Fixes

  • Node.js v22 Compatibility: Replaced deprecated url.parse() calls with the WHATWG URL/URLSearchParams API across examples, sandbox, and tests, eliminating DEP0169 deprecation warnings on Node.js v22+. (#10625)

🔧 Maintenance & C...

Description has been truncated

@dependabot
build(deps): bump the npm_and_yarn group across 3 directories with 22…
60d4387 
… updates

Bumps the npm_and_yarn group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [tsup](https://github.com/egoist/tsup) | `7.1.0` | `8.3.5` |
| [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `10.4.4` | `10.4.16` |
| [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `10.4.4` | `11.1.18` |
| [@apollo/server](https://github.com/apollographql/apollo-server/tree/HEAD/packages/server) | `4.11.3` | `5.5.0` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `7.0.5` | `8.0.5` |
| [mjml](https://github.com/mjmlio/mjml/tree/HEAD/packages/mjml) | `4.15.3` | `5.0.0` |
| [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver) | `3.0.8` | `3.0.13` |
| [axios](https://github.com/axios/axios) | `1.3.4` | `1.15.0` |
| [flatted](https://github.com/WebReflection/flatted) | `3.2.7` | `3.4.2` |
| [formidable](https://github.com/node-formidable/formidable) | `2.1.2` | `2.1.5` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.7` | `4.7.9` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [sha.js](https://github.com/crypto-browserify/sha.js) | `2.4.11` | `2.4.12` |
| [tar](https://github.com/isaacs/node-tar) | `6.1.13` | `6.2.1` |
| [validator](https://github.com/validatorjs/validator.js) | `13.15.15` | `13.15.35` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.2` | `7.3.2` |
| [ws](https://github.com/websockets/ws) | `7.5.9` | `7.5.10` |

Bumps the npm_and_yarn group with 1 update in the /packages/data-loader directory: [@apollo/server](https://github.com/apollographql/apollo-server/tree/HEAD/packages/server).
Bumps the npm_and_yarn group with 3 updates in the /packages/email directory: [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core), [nodemailer](https://github.com/nodemailer/nodemailer) and [mjml](https://github.com/mjmlio/mjml/tree/HEAD/packages/mjml).


Updates `tsup` from 7.1.0 to 8.3.5
- [Release notes](https://github.com/egoist/tsup/releases)
- [Commits](egoist/tsup@v7.1.0...v8.3.5)

Updates `@nestjs/common` from 10.4.4 to 10.4.16
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v10.4.16/packages/common)

Updates `@nestjs/core` from 10.4.4 to 11.1.18
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v11.1.18/packages/core)

Updates `@apollo/server` from 4.11.3 to 5.5.0
- [Release notes](https://github.com/apollographql/apollo-server/releases)
- [Changelog](https://github.com/apollographql/apollo-server/blob/main/packages/server/CHANGELOG.md)
- [Commits](https://github.com/apollographql/apollo-server/commits/@apollo/server@5.5.0/packages/server)

Updates `nodemailer` from 7.0.5 to 8.0.5
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v7.0.5...v8.0.5)

Updates `mjml` from 4.15.3 to 5.0.0
- [Release notes](https://github.com/mjmlio/mjml/releases)
- [Commits](https://github.com/mjmlio/mjml/commits/v5.0.0/packages/mjml)

Updates `@smithy/config-resolver` from 3.0.8 to 3.0.13
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/config-resolver/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@3.0.13/packages/config-resolver)

Updates `axios` from 1.3.4 to 1.15.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.3.4...v1.15.0)

Updates `esbuild` from 0.18.12 to 0.25.9
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md)
- [Commits](evanw/esbuild@v0.18.12...v0.25.9)

Updates `flatted` from 3.2.7 to 3.4.2
- [Commits](WebReflection/flatted@v3.2.7...v3.4.2)

Updates `follow-redirects` from 1.15.2 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.2...v1.16.0)

Updates `form-data` from 3.0.1 to 4.0.0
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v3.0.1...v4.0.0)

Updates `formidable` from 2.1.2 to 2.1.5
- [Release notes](https://github.com/node-formidable/formidable/releases)
- [Changelog](https://github.com/node-formidable/formidable/blob/master/CHANGELOG.md)
- [Commits](https://github.com/node-formidable/formidable/commits)

Updates `handlebars` from 4.7.7 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.7...v4.7.9)

Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `rollup` from 3.20.0 to 4.46.3
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/v4.46.3/CHANGELOG.md)
- [Commits](rollup/rollup@v3.20.0...v4.46.3)

Updates `sha.js` from 2.4.11 to 2.4.12
- [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md)
- [Commits](browserify/sha.js@v2.4.11...v2.4.12)

Updates `tar` from 6.1.13 to 6.2.1
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.1.13...v6.2.1)

Updates `validator` from 13.15.15 to 13.15.35
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.15.15...13.15.35)

Updates `vite` from 7.1.2 to 7.3.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite)

Updates `ws` from 7.5.9 to 7.5.10
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.9...7.5.10)

Updates `@apollo/server` from 4.13.0 to 5.5.0
- [Release notes](https://github.com/apollographql/apollo-server/releases)
- [Changelog](https://github.com/apollographql/apollo-server/blob/main/packages/server/CHANGELOG.md)
- [Commits](https://github.com/apollographql/apollo-server/commits/@apollo/server@5.5.0/packages/server)

Updates `@nestjs/core` from 10.4.22 to 11.1.19
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v11.1.18/packages/core)

Updates `nodemailer` from 7.0.13 to 8.0.5
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v7.0.5...v8.0.5)

Updates `mjml` from 4.18.0 to 5.0.1
- [Release notes](https://github.com/mjmlio/mjml/releases)
- [Commits](https://github.com/mjmlio/mjml/commits/v5.0.0/packages/mjml)

---
updated-dependencies:
- dependency-name: tsup
  dependency-version: 8.3.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@nestjs/common"
  dependency-version: 10.4.16
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@nestjs/core"
  dependency-version: 11.1.18
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@apollo/server"
  dependency-version: 5.5.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 8.0.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: mjml
  dependency-version: 5.0.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@smithy/config-resolver"
  dependency-version: 3.0.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: formidable
  dependency-version: 2.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.46.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sha.js
  dependency-version: 2.4.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 6.2.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: validator
  dependency-version: 13.15.35
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 7.5.10
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@apollo/server"
  dependency-version: 5.5.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@nestjs/core"
  dependency-version: 11.1.19
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 8.0.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: mjml
  dependency-version: 5.0.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 16, 2026
@dependabot dependabot Bot requested a review from a team April 16, 2026 10:13
@dependabot dependabot Bot mentioned this pull request Apr 16, 2026
Closed
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 23, 2026

Superseded by #95.

@dependabot dependabot Bot closed this Apr 23, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-54501f28a2 branch April 23, 2026 04:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants