Skip to content

chore(deps)(deps): bump the production-deps group across 1 directory with 12 updates - #1659

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-deps-20a1a487db
Open

chore(deps)(deps): bump the production-deps group across 1 directory with 12 updates#1659
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-deps-20a1a487db

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-deps group with 12 updates in the / directory:

Package From To
ajv 8.12.0 8.20.0
express-rate-limit 8.5.2 8.7.0
graphql-http 1.22.4 1.23.0
graphql-ws 6.0.8 6.2.1
helmet 8.2.0 8.3.0
maxmind 5.0.6 5.0.7
multer 2.1.1 2.3.0
pdfkit 0.18.0 0.20.2
ws 8.21.0 8.21.3
@opentelemetry/auto-instrumentations-node 0.54.0 0.80.0
@opentelemetry/exporter-trace-otlp-http 0.57.2 0.222.0
@opentelemetry/sdk-node 0.57.2 0.222.0

Updates ajv from 8.12.0 to 8.20.0

Release notes

Sourced from ajv's releases.

v8.20.0

What's Changed

Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0

v8.19.0

What's Changed

Full Changelog: ajv-validator/ajv@v8.18.0...v8.19.0

v8.18.0

What's Changed

New Contributors

Full Changelog: ajv-validator/ajv@v8.17.1...v8.18.0

v8.17.1

What's Changed

Full Changelog: ajv-validator/ajv@v8.17.0...v8.17.1

Plus everything in 8.17.0 which failed to release

The only functional change is to switch from uri-js (which is no longer supported), to fast-uri. This is the second attempt and the team on fast-uri have been really helpful addressing the issues we found last time.

Revert "Revert fast-uri change (ajv-validator/ajv#2444)" by @​gurgunday in ajv-validator/ajv#2448 fix: ignore new eslint error for @​typescript-eslint/no-extraneous-class by @​jasoniangreen in ajv-validator/ajv#2455 docs: clarify behaviour of addVocabulary by @​jasoniangreen in ajv-validator/ajv#2454 docs: refactor to improve legibility by @​blottn in ajv-validator/ajv#2432 Fix grammatical typo in managing-schemas.md by @​wetneb in ajv-validator/ajv#2305 docs: Fix broken strict-mode link by @​alexanderjsx in ajv-validator/ajv#2459 feat: add test for encoded refs and bump fast-uri by @​jasoniangreen in ajv-validator/ajv#2449 fix: changes for @​typescript-eslint/array-type rule by @​jasoniangreen in ajv-validator/ajv#2467 fixes ajv-validator/ajv#2217 - clarify custom keyword naming by @​jasoniangreen in ajv-validator/ajv#2457

v8.17.0

... (truncated)

Commits

Updates express-rate-limit from 8.5.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

Commits
  • 48db09e 8.7.0
  • dce5871 v8.7.0 changelog
  • 2f08044 Add inspect.software health badge (#673)
  • a29757c feat: add retryAfter option (#661)
  • 146e88b chore: rename license
  • 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
  • 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
  • 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
  • 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
  • 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
  • Additional commits viewable in compare view

Updates graphql-http from 1.22.4 to 1.23.0

Release notes

Sourced from graphql-http's releases.

v1.23.0

1.23.0 (2026-08-07)

Bug Fixes

Features

  • audit: graphql-response+json parsing failure handling (#149) (81e6a07)
Changelog

Sourced from graphql-http's changelog.

1.23.0 (2026-08-07)

Bug Fixes

Features

  • audit: graphql-response+json parsing failure handling (#149) (81e6a07)
Commits

Updates graphql-ws from 6.0.8 to 6.2.1

Release notes

Sourced from graphql-ws's releases.

v6.2.1

Patch Changes

v6.2.0

Minor Changes

v6.1.1

Patch Changes

  • #680 3fdd82f Thanks @​kkhys! - Disposing of a client event listener twice no longer removes an unrelated listener

    The unsubscribe function returned by client.on spliced at indexOf(listener) without checking for -1, so removing an already-removed listener would splice(-1, 1) and silently drop the most recently registered listener of the same event. This happens in practice without any double-dispose by the user: emits iterate over a copy of the listeners, so a one-shot internal listener that already unlistened itself during a nested emit (e.g. when client.terminate() is called from within a closed/error listener) is re-invoked from the copy and unlistens again, knocking out registered closed/error listeners.

v6.1.0

Minor Changes

Changelog

Sourced from graphql-ws's changelog.

6.2.1

Patch Changes

6.2.0

Minor Changes

6.1.1

Patch Changes

  • #680 3fdd82f Thanks @​kkhys! - Disposing of a client event listener twice no longer removes an unrelated listener

    The unsubscribe function returned by client.on spliced at indexOf(listener) without checking for -1, so removing an already-removed listener would splice(-1, 1) and silently drop the most recently registered listener of the same event. This happens in practice without any double-dispose by the user: emits iterate over a copy of the listeners, so a one-shot internal listener that already unlistened itself during a nested emit (e.g. when client.terminate() is called from within a closed/error listener) is re-invoked from the copy and unlistens again, knocking out registered closed/error listeners.

6.1.0

Minor Changes

Commits
  • 839ca7d Upcoming Release Changes (#684)
  • 61731f0 Import type WebSocketServer directly from 'ws' (#660)
  • af4f5c9 Upcoming Release Changes (#683)
  • 1e70c1a feat(server): Add parse option for custom GraphQL parsing (#682)
  • 716eb36 Upcoming Release Changes (#681)
  • 3fdd82f fix(client): don't remove an unrelated listener when disposing of an already-...
  • ea0d083 chore: no need for registry url
  • 0b69b9b Upcoming Release Changes (#679)
  • 8bbad60 chore: downgrade uws for node 20
  • 3675e0d chore: bump uws
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for graphql-ws since your current version.


Updates helmet from 8.2.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

  • Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
  • Content-Security-Policy: improved error handling for invalid directive names

Fixed

  • Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
  • Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
  • Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw
Commits
  • 75f1a98 8.3.0
  • f03f70d Update changelog for 8.3.0 release
  • a307fce Fix capitalization in CSP package changelog
  • 5347b43 Format default CSP in README for readability
  • 9afc570 CSP: fix middleware-specific README missing link
  • 266c95c Minor speedups to project setups test
  • 7a4196c CSP: update package-specific changelog
  • 02716b4 CSP: improve performance when there are no dynamic directives
  • 3f511ed CSP: move utility functions to separate file
  • 80338af CSP: disabling defaults with no directives is now an error
  • Additional commits viewable in compare view

Updates maxmind from 5.0.6 to 5.0.7

Release notes

Sourced from maxmind's releases.

v5.0.7

5.0.7 (2026-08-01)

Bug Fixes

  • deps: update dependency mmdb-lib to v3.0.3 (#976) (fa83560)
Commits
  • 5fb78b3 chore(deps): update dependency ip-address to v10.4.0 (#977)
  • fa83560 fix(deps): update dependency mmdb-lib to v3.0.3 (#976)
  • fd923ba chore(deps): update dependency sinon to v21.1.2 (#978)
  • 6abe654 chore(deps): update actions/checkout action to v7 (#979)
  • 1fd32a5 chore(deps): update dependency prettier to v3.9.6 (#974)
  • bd72caa chore(deps): update dependency @​types/node to v24.13.3 (#973)
  • b854c91 chore(deps): update dependency semantic-release to v25.0.8 (#975)
  • 4b3fd0d chore(deps): update dependency @​swc/core to v1.15.47 (#972)
  • 035f351 chore(deps): update dependency prettier to v3.9.4 (#971)
  • 18a571e chore(deps): update dependency @​types/node to v24.13.2 (#970)
  • Additional commits viewable in compare view

Updates multer from 2.1.1 to 2.3.0

Release notes

Sourced from multer's releases.

v2.3.0

Important

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from multer's changelog.

2.3.0

2.2.0

Commits
  • 4e8edf5 2.3.0 (#1455)
  • 87a584e fix: reject invalid field names instead of crashing on append-field errors
  • ab6aeae fix: enforce file size limit with async fileFilter
  • eef7444 fix: destroy disk write stream on aborted uploads to prevent fd leak
  • 25ec9bb docs: refresh all README translations (#1462)
  • 73c1759 feat: add an opt-in fieldArrayIndexLimit (#1438)
  • ece6735 Update 'README-zh-cn.md' up to now (#1264)
  • 3278e1b docs: add Japanese translation to README (#1354)
  • 3c0bc5e test: accept files exactly at fileSize limit (#1382)
  • b6d84b0 docs: add Indonesian translation for README (#1431)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.


Updates pdfkit from 0.18.0 to 0.20.2

Release notes

Sourced from pdfkit's releases.

v0.20.2

  • Fix bundlers and file tracers packing the ESM copies of the standard font metrics instead of the CommonJS ones the Node build actually loads, which left Cannot find module errors for every standard font at runtime, by resolving the internal #standard-fonts/* mapping to a single file under all conditions
  • Fix doc.file() throwing when the same in-memory attachment is embedded twice under one name, because the creation and modified dates the deduplication check compares are absent for sources that are not read from disk
  • Fix doc.text() throwing unsupported number: NaN when lineBreak: false is combined with underline, strike, link or goTo, because the rendered width was computed from the line wrapper's measurements, which are never produced when wrapping is disabled

v0.20.1

  • Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

v0.20.0

Highlights

TLDR: "A PDF generation library for Node.js" -> "A JavaScript PDF generation library"

Standard Font Support rewritten

Standard font support has been rewritten to use pre-parsed font metrics instead of parsing raw AFM definitions at runtime. The new approach is more efficient (less runtime overhead and memory usage) and reduces the size of the browser bundle significantly. Standalone build which bundles all standard fonts is down to 1.3MB from 2.3MB.

In Node, font metrics are loaded lazily as before, while in browser builds, except the standalone one, each font must be imported from pdfkit/standard-fonts/* and registered with registerStdFonts(). Previously, to use a standard font in browser was necessary to use a bundler.

See usage example in output helpers section below.

Removal of Node specific dependencies

Buffer is no longer used internally. Uint8Array is now the minimum denominator for binary data in both Node and browsers. Since Buffer is a Uint8Array subclass, this change is fully backward compatible.

Native fs, zlib and ReadableStream are conditionally imported only in Node. Browser builds use minimal implementations. This approach gives us the best of both worlds: Node builds still use the native modules, while browser ones are portable.

Many thanks to @​diegomura for his help in removing the Node specific dependencies.

registerFile API

The new registerFile(path, data) API allows registering in-memory files globally. The data argument must be a Uint8Array. Passing undefined as data unregisters the path.

In browsers, it can be used as a simplified virtual file system. In Node, this is useful for registering fonts, images and other resources that are not available on disk. The native file system is still used when the path is not registered.

import { PDFDocument, registerFile } from 'pdfkit';
const response = await fetch('/fonts/Roboto-Regular.ttf');
const fontData = new Uint8Array(await response.arrayBuffer());
registerFile('fonts/Roboto-Regular.ttf', fontData);
const doc = new PDFDocument();
// register an alias for the font path
doc.registerFont('Roboto', 'fonts/Roboto-Regular.ttf');
// or use the path directly
doc.font('fonts/Roboto-Regular.ttf');
</tr></table>

... (truncated)

Changelog

Sourced from pdfkit's changelog.

[v0.20.2] - 2026-08-29

  • Fix bundlers and file tracers packing the ESM copies of the standard font metrics instead of the CommonJS ones the Node build actually loads, which left Cannot find module errors for every standard font at runtime, by resolving the internal #standard-fonts/* mapping to a single file under all conditions
  • Fix doc.file() throwing when the same in-memory attachment is embedded twice under one name, because the creation and modified dates the deduplication check compares are absent for sources that are not read from disk
  • Fix doc.text() throwing unsupported number: NaN when lineBreak: false is combined with underline, strike, link or goTo, because the rendered width was computed from the line wrapper's measurements, which are never produced when wrapping is disabled

[v0.20.1] - 2026-08-23

  • Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

[v0.20.0] - 2026-08-23

  • [BREAKING CHANGE] Remove the virtual file system (pdfkit/virtual-fs). Browser builds no longer depend on fs: use registerFile to register Uint8Array data under a path, pass a Uint8Array or ArrayBuffer directly to registerFont, image and file, or pass a data URL directly to image and file
  • Add registerFile(path, data, options) to globally register in-memory files in Node and browsers, with optional birthtime and ctime metadata. Passing undefined as data unregisters the path
  • [BREAKING CHANGE] Export PDFDocument, LineWrapper and registerFile as named exports from the main Node and browser entry points while preserving the default PDFDocument export
  • Add experimental toBlob(document) and toBytes(document) output helpers under pdfkit/output
  • Accept already-parsed fontkit Font instances in doc.font() and registerFont
  • Load the PDF/A ICC profile from disk only when needed in Node, while continuing to bundle it in browser builds
  • Add tools to convert raw AFM standard-font definitions into parsed or compact runtime JavaScript modules
  • [BREAKING CHANGE] Use generated standard-font data instead of parsing raw AFM definitions at runtime. Node loads font metrics lazily; browser applications must import each font they use from pdfkit/standard-fonts/* and register it with registerStdFonts()
  • [BREAKING CHANGE] Restrict AcroForm options to documented mappings and explicit escape hatches.
  • [BREAKING CHANGE] Stop automatically uppercasing annotation option keys.
  • [BREAKING CHANGE] Throw from addNamedEmbeddedFile when no ref is given, instead of writing an unparseable undefined token into the /EmbeddedFiles name tree
  • Do not mutate options passed to doc.annotate() and its convenience methods (link, note, strike, lineAnnotation, rectAnnotation, ellipseAnnotation, textAnnotation, fileAnnotation)
  • Persist font options when adding a new page. Fixes #1739
  • Use Uint8Array instead of Node's Buffer internally
  • Fix date text field formatting emitting invalid JavaScript, so the format was never applied. Fixes #1546
  • Fix indentAllLines applying the indent again on every paragraph and every page break, and keep it applied across continued text. Fixes #1606
  • Fix a hole in a sparse array being skipped entirely, which shifted every later entry down one
  • Encrypt strings inside name trees. Fixes #1513

[v0.19.1] - 2026-06-10

  • Fix RGB JPEG embedded as DeviceGray (0.19.0 regression) (#1734)

[v0.19.0] - 2026-06-07

  • Bump node version requirement to 20+
  • Bump minimum supported browsers to Firefox 115, iOS/Safari 16
  • Fix text with input x as null
  • Add opacity option to doc.image() to control image transparency
  • Fix corrupted PDF when mixing standard and embedded fonts that share postscript name
  • Fix PDF/UA compliance issues in kitchen-sink-accessible example
  • Add bbox and placement options to PDFStructureElement for PDF/UA compliance
  • Extend roundedRect with borderRadius as number for all corners or per-corner array (CSS order)
  • Fix accessibility: scope in TH element
  • Fix PDF Name escaping for spot colors with spaces (#1644)
Commits
  • 8d72a71 v0.20.2
  • 70c9ad5 Document the parameter list each destination type takes (#1785)
  • e04b677 Fix doc.text() throwing NaN with lineBreak false and underline/strike/link/go...
  • c6f57c6 fix: resolve #standard-fonts/* to one file under every condition (#1782)
  • b87b5ac Fix case-insensitive lookup for named CSS colors (#1780)
  • 69671d9 Fix doc.file() throwing when the same in-memory attachment is added twice (#1...
  • 1f1abb8 Bump ip-address from 10.2.0 to 10.4.0 (#1761)
  • f58c4c7 Bump postcss from 8.5.15 to 8.5.25 (#1762)
  • f048bdd v0.20.1
  • 910c86a Add Node ESM build: route the node import condition to a real Node bundle (#1...
  • Additional commits viewable in compare view

Updates ws from 8.21.0 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c0).
  • The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).
Commits
  • c791e70 [dist] 8.21.3
  • e97a20e [fix] Reject offers with client_max_window_bits below config
  • 787ebf2 [dist] 8.21.2
  • b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
  • e4bb883 [security] Use GitHub PVR as main reporting channel
  • 2eb3be0 [test] Skip test on Node.js versions where it does not apply
  • ae1de54 [dist] 8.21.1
  • 8e9511b [ci] Trust Coveralls Homebrew tap
  • f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
  • 8df8265 [ci] Update actions/checkout action to v7
  • Additional commits viewable in compare view

Updates @opentelemetry/auto-instrumentations-node from 0.54.0 to 0.80.0

Changelog

Sourced from @​opentelemetry/auto-instrumentations-node's changelog.

0.80.0 (2026-08-31)

Features

  • deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

Dependencie...

Description has been truncated

@dependabot
chore(deps)(deps): bump the production-deps group across 1 directory …
8c4d39b 
…with 12 updates

Bumps the production-deps group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ajv](https://github.com/ajv-validator/ajv) | `8.12.0` | `8.20.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.5.2` | `8.7.0` |
| [graphql-http](https://github.com/graphql/graphql-http) | `1.22.4` | `1.23.0` |
| [graphql-ws](https://github.com/enisdenjo/graphql-ws) | `6.0.8` | `6.2.1` |
| [helmet](https://github.com/helmetjs/helmet) | `8.2.0` | `8.3.0` |
| [maxmind](https://github.com/runk/node-maxmind) | `5.0.6` | `5.0.7` |
| [multer](https://github.com/expressjs/multer) | `2.1.1` | `2.3.0` |
| [pdfkit](https://github.com/foliojs/pdfkit) | `0.18.0` | `0.20.2` |
| [ws](https://github.com/websockets/ws) | `8.21.0` | `8.21.3` |
| [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.54.0` | `0.80.0` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.57.2` | `0.222.0` |
| [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.57.2` | `0.222.0` |



Updates `ajv` from 8.12.0 to 8.20.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v8.12.0...v8.20.0)

Updates `express-rate-limit` from 8.5.2 to 8.7.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.5.2...v8.7.0)

Updates `graphql-http` from 1.22.4 to 1.23.0
- [Release notes](https://github.com/graphql/graphql-http/releases)
- [Changelog](https://github.com/graphql/graphql-http/blob/main/CHANGELOG.md)
- [Commits](graphql/graphql-http@v1.22.4...v1.23.0)

Updates `graphql-ws` from 6.0.8 to 6.2.1
- [Release notes](https://github.com/enisdenjo/graphql-ws/releases)
- [Changelog](https://github.com/enisdenjo/graphql-ws/blob/master/CHANGELOG.md)
- [Commits](enisdenjo/graphql-ws@v6.0.8...v6.2.1)

Updates `helmet` from 8.2.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v8.2.0...v8.3.0)

Updates `maxmind` from 5.0.6 to 5.0.7
- [Release notes](https://github.com/runk/node-maxmind/releases)
- [Commits](runk/node-maxmind@v5.0.6...v5.0.7)

Updates `multer` from 2.1.1 to 2.3.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.1.1...v2.3.0)

Updates `pdfkit` from 0.18.0 to 0.20.2
- [Release notes](https://github.com/foliojs/pdfkit/releases)
- [Changelog](https://github.com/foliojs/pdfkit/blob/master/CHANGELOG.md)
- [Commits](foliojs/pdfkit@v0.18.0...v0.20.2)

Updates `ws` from 8.21.0 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.0...8.21.3)

Updates `@opentelemetry/auto-instrumentations-node` from 0.54.0 to 0.80.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.80.0/packages/auto-instrumentations-node)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.57.2 to 0.222.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.57.2...experimental/v0.222.0)

Updates `@opentelemetry/sdk-node` from 0.57.2 to 0.222.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.57.2...experimental/v0.222.0)

---
updated-dependencies:
- dependency-name: ajv
  dependency-version: 8.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: express-rate-limit
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: graphql-http
  dependency-version: 1.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: graphql-ws
  dependency-version: 6.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: maxmind
  dependency-version: 5.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: multer
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: pdfkit
  dependency-version: 0.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: "@opentelemetry/auto-instrumentations-node"
  dependency-version: 0.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.222.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.222.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 4, 2026
@dependabot
dependabot Bot requested a review from Manuel1234477 as a code owner September 4, 2026 12:04
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 4, 2026
@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown

🚨 Security Scan Results

Check Status
Dependency Audit (npm audit) ❌ failure
SAST (eslint-plugin-security) ❌ failure
Secrets Scan (Gitleaks) ✅ success

One or more security checks failed. Please review the CI logs for details.

Last updated: 2026-09-04T12:04:55.855Z

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Manuel1234477 Manuel1234477 Awaiting requested review from Manuel1234477 Manuel1234477 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants