fix(deps): update all non-major dependencies

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@grpc/grpc-js (source)	1.11.3 -> 1.13.1					dependencies	minor
@types/node (source)	16.18.109 -> 16.18.126					devDependencies	patch
@types/sinon (source)	17.0.3 -> 17.0.4					devDependencies	patch
@vercel/ncc	0.38.2 -> 0.38.3					devDependencies	patch
axios (source)	1.7.7 -> 1.8.4					dependencies	minor
express (source)	4.21.0 -> 4.21.2					dependencies	patch
gcp-metadata	6.1.0 -> 6.1.1					devDependencies	patch
golang	1.23 -> 1.24						minor
google-auth-library	9.14.1 -> 9.15.1					dependencies	minor
nock	13.5.5 -> 13.5.6					devDependencies	patch
otel/opentelemetry-collector-contrib	0.115.1 -> 0.122.1						minor

---

Release Notes

grpc/grpc-node (@​grpc/grpc-js)

v1.13.1: @​grpc/grpc-js 1.13.1

Compare Source

• Fix a bug that caused the rejectUnauthorized channel credentials option to be handled incorrectly (#​2926)
• Fix a bug that caused the client to never send retries if any retryThrottling config was set (#​2927)
• Fix a bug that caused clients to incorrectly send retries if the feature was disabled by a channel option and a retry config was provided (#​2927)

v1.13.0: @​grpc/grpc-js 1.13.0

Compare Source

Changelog

• Add support for channel option grpc-node.flow_control_window to control HTTP/2 flow control window size (#​2864 contributed by @​rickihastings)
• Show meaningful error messages more consistently when requests fail (#​2868)
• Add support for CIDR blocks in no_proxyenvironment variable (#​2876 contributed by @​melkouri)
• Fix a bug that caused server interceptor sendMetadata methods to not be called if the server interceptor did not explicitly send metadata (#​2897)
• Fix IPv6-mapped IPv4 address parsing in channelz, and represent them as IPv4 addresses (#​2909)

Experimental API changes

Added:

• SecureConnector
• SecureConnectResult
• SUBCHANNEL_ARGS_EXCLUDE_KEY_PREFIX
• Server#experimentalRegisterListenerToChannelz protected method
• ServerexperimentalUnregisterListenerFromChannelz protected method
• Server#experimentalCreateConnectionInjectorWithChannelzRef protected method

Modified:

• LoadBalancer: Removed the ChannelCredentials constructor argument
• LoadBalancer: Removed the ChannelOptions constructor argument
• LoadBalancer#updateAddressList: Replaced the attributes argument with one of type ChannelOptions.
• ChannelControlHelper#createSubchannel: Removed the ChannelCredentials argument
• LeafLoadBalancer: Removed the ChannelCredentials constructor argument

v1.12.6

Compare Source

• Allow garbage collection of IDLE channels (#​2896)

v1.12.5: @​grpc/grpc-js 1.12.5

Compare Source

• Prioritize HTTP status errors over message decoding errors (#​2873)

v1.12.4: @​grpc/grpc-js 1.12.4

Compare Source

• Prioritize reporting UNAVAILABLE status when handing connection drops (#​2862)

v1.12.3: @​grpc/grpc-js 1.12.3

Compare Source

• Report UNAVAILABLE if possible when handling connection drops (#​2861)

v1.12.2: @​grpc/grpc-js 1.12.2

Compare Source

• Use util.promisify instead of fs/promises for Node 12 compatibility (#​2838)

v1.12.1: @​grpc/grpc-js 1.12.1

Compare Source

• Port bugfixes from 1.11.x into 1.12.x (#​2836)

v1.12.0: @​grpc/grpc-js 1.12.0

Compare Source

Changelog

• Provide the method_name for the CallCredentials callback generateMetadata (#​2814 contributed by @​becoded)
• Add an optional rejectUnauthorized field to the VerifyOptions interface, which can be passed as an argument to credentials.createSsl and createFromSecureContext (#​2812 contributed by @​vinothsa4891)

Experimental API changes

Added:

• CaCertificateUpdate
• CaCertificateUpdateListener
• IdentityCertificateUpdate
• IdentityCertificateUpdateListener
• CertificateProvider
• FileWatcherCertificateProvider
• FileWatcherCertificateProviderConfig
• createCertificateProviderChannelCredentials
• createCertificateProviderServerCredentials

Modified:

• LoadBalancer: The constructor now takes an additional argument of type ChannelCredentials.
• ChannelControlHelper#createSubchannel: Now takes an additional argument of type ChannelCredentials | null. This should be passed along if overriding this function.
• LeafLoadBalancer: The constructor now takes an additional argument of type ChannelCredentials.

vercel/ncc (@​vercel/ncc)

v0.38.3

Compare Source

Bug Fixes

• add missing --asset-builds to cli help message (#​1228) (84f8c52)

axios/axios (axios)

v1.8.4

Compare Source

Bug Fixes

• buildFullPath: handle allowAbsoluteUrls: false without baseURL (#​6833) (f10c2e0)

Contributors to this release

• Marc Hassan

v1.8.3

Compare Source

Bug Fixes

• add missing type for allowAbsoluteUrls (#​6818) (10fa70e)
• xhr/fetch: pass allowAbsoluteUrls to buildFullPath in xhr and fetch adapters (#​6814) (ec159e5)

Contributors to this release

• Ashcon Partovi
• StefanBRas
• Marc Hassan

v1.8.2

Compare Source

Bug Fixes

• http-adapter: add allowAbsoluteUrls to path building (#​6810) (fb8eec2)

Contributors to this release

• Fasoro-Joseph Alexander

v1.8.1

Compare Source

Bug Fixes

• utils: move generateString to platform utils to avoid importing crypto module into client builds; (#​6789) (36a5a62)

Contributors to this release

• Dmitriy Mozgovoy

v1.8.0

Compare Source

Bug Fixes

• examples: application crashed when navigating examples in browser (#​5938) (1260ded)
• missing word in SUPPORT_QUESTION.yml (#​6757) (1f890b1)
• utils: replace getRandomValues with crypto module (#​6788) (23a25af)

Features

• Add config for ignoring absolute URLs (#​5902) (#​6192) (32c7bcc)

Reverts

• Revert "chore: expose fromDataToStream to be consumable (#​6731)" (#​6732) (1317261), closes #​6731 #​6732

BREAKING CHANGES

• code relying on the above will now combine the URLs instead of prefer request URL

• feat: add config option for allowing absolute URLs

• fix: add default value for allowAbsoluteUrls in buildFullPath

• fix: typo in flow control when setting allowAbsoluteUrls

Contributors to this release

• Michael Toscano
• Willian Agostini
• Naron
• shravan || श्रvan
• Justin Dhillon
• yionr
• Shin'ya Ueoka
• Dan Dascalescu
• Nitin Ramnani
• Shay Molcho
• Jay
• fancy45daddy
• Habip Akyol
• Bailey Lissington
• Bernardo da Eira Duarte
• Shivam Batham
• Lipin Kariappa

1.7.9 (2024-12-04)

Reverts

• Revert "fix(types): export CJS types from ESM (#​6218)" (#​6729) (c44d2f2), closes #​6218 #​6729

Contributors to this release

• Jay

1.7.8 (2024-11-25)

Bug Fixes

• allow passing a callback as paramsSerializer to buildURL (#​6680) (eac4619)
• core: fixed config merging bug (#​6668) (5d99fe4)
• fixed width form to not shrink after 'Send Request' button is clicked (#​6644) (7ccd5fd)
• http: add support for File objects as payload in http adapter (#​6588) (#​6605) (6841d8d)
• http: fixed proxy-from-env module import (#​5222) (12b3295)
• http: use globalThis.TextEncoder when available (#​6634) (df956d1)
• ios11 breaks when build (#​6608) (7638952)
• types: add missing types for mergeConfig function (#​6590) (00de614)
• types: export CJS types from ESM (#​6218) (c71811b)
• updated stream aborted error message to be more clear (#​6615) (cc3217a)
• use URL API instead of DOM to fix a potential vulnerability warning; (#​6714) (0a8d6e1)

Contributors to this release

• Remco Haszing
• Jay
• Aayush Yadav
• Dmitriy Mozgovoy
• Ell Bradshaw
• Amit Saini
• Tommaso Paulon
• Akki
• Sampo Silvennoinen
• Kasper Isager Dalsgarð
• Christian Clauss
• Pavan Welihinda
• Taylor Flatt
• Kenzo Wada
• Ngole Lawson
• Haven
• Shrivali Dutt
• Henco Appel

1.7.7 (2024-08-31)

Bug Fixes

• fetch: fix stream handling in Safari by fallback to using a stream reader instead of an async iterator; (#​6584) (d198085)
• http: fixed support for IPv6 literal strings in url (#​5731) (364993f)

Contributors to this release

• Rishi556
• Dmitriy Mozgovoy

1.7.6 (2024-08-30)

Bug Fixes

• fetch: fix content length calculation for FormData payload; (#​6524) (085f568)
• fetch: optimize signals composing logic; (#​6582) (df9889b)

Contributors to this release

• Dmitriy Mozgovoy
• Jacques Germishuys
• kuroino721

1.7.5 (2024-08-23)

Bug Fixes

• adapter: fix undefined reference to hasBrowserEnv (#​6572) (7004707)
• core: add the missed implementation of AxiosError#status property; (#​6573) (6700a8a)
• core: fix ReferenceError: navigator is not defined for custom environments; (#​6567) (fed1a4b)
• fetch: fix credentials handling in Cloudflare workers (#​6533) (550d885)

Contributors to this release

• Dmitriy Mozgovoy
• Antonin Bas
• Hans Otto Wirtz

1.7.4 (2024-08-13)

Bug Fixes

• sec: CVE-2024-39338 (#​6539) (#​6543) (6b6b605)
• sec: disregard protocol-relative URL to remediate SSRF (#​6539) (07a661a)

Contributors to this release

• Lev Pachmanov
• Đỗ Trọng Hải

1.7.3 (2024-08-01)

Bug Fixes

• adapter: fix progress event emitting; (#​6518) (e3c76fc)
• fetch: fix withCredentials request config (#​6505) (85d4d0e)
• xhr: return original config on errors from XHR adapter (#​6515) (8966ee7)

Contributors to this release

• Dmitriy Mozgovoy
• Valerii Sidorenko
• prianYu

1.7.2 (2024-05-21)

Bug Fixes

• fetch: enhance fetch API detection; (#​6413) (4f79aef)

Contributors to this release

• Dmitriy Mozgovoy

1.7.1 (2024-05-20)

Bug Fixes

• fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#​6410) (733f15f)

Contributors to this release

• Dmitriy Mozgovoy

v1.7.9

Compare Source

Reverts

• Revert "fix(types): export CJS types from ESM (#​6218)" (#​6729) (c44d2f2), closes #​6218 #​6729

Contributors to this release

• Jay

v1.7.8

Compare Source

Bug Fixes

• allow passing a callback as paramsSerializer to buildURL (#​6680) (eac4619)
• core: fixed config merging bug (#​6668) (5d99fe4)
• fixed width form to not shrink after 'Send Request' button is clicked (#​6644) (7ccd5fd)
• http: add support for File objects as payload in http adapter (#​6588) (#​6605) (6841d8d)
• http: fixed proxy-from-env module import (#​5222) (12b3295)
• http: use globalThis.TextEncoder when available (#​6634) (df956d1)
• ios11 breaks when build (#​6608) (7638952)
• types: add missing types for mergeConfig function (#​6590) (00de614)
• types: export CJS types from ESM (#​6218) (c71811b)
• updated stream aborted error message to be more clear (#​6615) (cc3217a)
• use URL API instead of DOM to fix a potential vulnerability warning; (#​6714) (0a8d6e1)

Contributors to this release

• Remco Haszing
• Jay
• Aayush Yadav
• Dmitriy Mozgovoy
• Ell Bradshaw
• Amit Saini
• Tommaso Paulon
• Akki
• Sampo Silvennoinen
• Kasper Isager Dalsgarð
• Christian Clauss
• Pavan Welihinda
• Taylor Flatt
• Kenzo Wada
• Ngole Lawson
• Haven
• Shrivali Dutt
• Henco Appel

expressjs/express (express)

v4.21.2

Compare Source

What's Changed

• Add funding field (v4) by @​bjohansebas in https://github.com/expressjs/express/pull/6065
• deps: [email protected] by @​blakeembrey in https://github.com/expressjs/express/pull/5956
• deps: bump [email protected] by @​jonchurch in https://github.com/expressjs/express/pull/6209
• Release: 4.21.2 by @​UlisesGascon in https://github.com/expressjs/express/pull/6094

Full Changelog: expressjs/express@4.21.1...4.21.2

v4.21.1

Compare Source

What's Changed

• Backport a fix for CVE-2024-47764 to the 4.x branch by @​joshbuker in https://github.com/expressjs/express/pull/6029
• Release: 4.21.1 by @​UlisesGascon in https://github.com/expressjs/express/pull/6031

Full Changelog: expressjs/express@4.21.0...4.21.1

googleapis/gcp-metadata (gcp-metadata)

v6.1.1

Compare Source

Bug Fixes

• Add extra logging for incorrect headers (#​637) (edafa87)
• Add extra logging for incorrect headers (#​637) (#​647) (ccbb98e)

googleapis/google-auth-library-nodejs (google-auth-library)

v9.15.1

Compare Source

Bug Fixes

• Resolve typo in document (#​1901) (12f2c87)

v9.15.0

Compare Source

Features

• Impersonated Universe Domain Support (#​1875) (902bf8b)

v9.14.2

Compare Source

Bug Fixes

• Disable Universe Domain Check (#​1878) (8adb44c)

nock/nock (nock)

v13.5.6

Compare Source

Bug Fixes

• types: return type of BackOptions.afterRecord (#​2782) (fc90bd3)

open-telemetry/opentelemetry-collector-releases (otel/opentelemetry-collector-contrib)

v0.122.1

Compare Source

Check the v0.122.1 contrib changelog and the v0.122.1 core changelog for changelogs on specific components.

Changelog

• 769df5c prepare v0.122.1 release (#​882)
• c3d70c3 Add tcpcheckreceiver To Contrib (#​865)
• fefdd1e Add tlscheckreceiver to otelcol-contrib (#​880)
• cd30bdc [core,contrib,k8s,otlp] Add Windows 2019 and 2022 container image (amd64 only) (#​872)
• 8d735b1 chore(deps): update docker/login-action action to v3.4.0 (#​877)

v0.122.0

Compare Source

🛑 Breaking changes 🛑

• contrib: Remove the component loki exporter from the distribution, as it has reached EOL (#​854)

🚀 New components 🚀

• opampsupervisor: publish binaries and container images for the OpAMP Supervisor (#​858)

🧰 Bug fixes 🧰

• packaging: Ensure Linux package scripts work in environments without systemd such as chrooted environments (#​767)

v0.121.0

Compare Source

🚀 New components 🚀

• aesprovider: Add the AES provider to the contrib distribution (#​843)
• envoyalsreceiver: Add the Envoy ALS receiver to the contrib distribution (#​842)
• netflowreceiver: Add the NetFlow receiver to the contrib distribution (#​847)
• s3provider: Add the s3 provider to the contrib distribution (#​546)
• secretsmanagerprovider: Add the Secrets Manager provider to the contrib distribution (#​844)

💡 Enhancements 💡

• images: set USER_GID alongside USER_UID (#​662)

v0.120.0

Compare Source

Check the following changelogs on specific components for more details:

• v0.120.0 core changelog
• v0.120.0 contrib changelog
• v0.120.1 contrib changelog

Changelog

• c5c9e63 Update version from 0.119.0 to 0.120.0 (#​832)
• 6356791 Add FOSSA scanning workflow (#​829)
• 9b51357 [chore] Refactor goreleaser config generation for distributions (#​797)
• d31bf94 bump version to go1.24 (#​827)
• 82cca5e [chore] use lychee for link checking (#​828)
• b89bc58 [chore] transfer default code ownership to releases-approvers (#​826)
• 6722b07 Improve contributor guide (#​816)
• ddc7d31 fix(deps): update module go.opentelemetry.io/build-tools/chloggen to v0.18.0 (#​821)
• 00024a9 fix(deps): update goreleaser pro (#​779)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun