Skip to content

chore(deps): bump the production-minor-patch group across 1 directory with 11 updates - #36

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/production-minor-patch-70a9e82402
Closed

chore(deps): bump the production-minor-patch group across 1 directory with 11 updates#36
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/production-minor-patch-70a9e82402

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-minor-patch group with 10 updates in the / directory:

Package From To
pg 8.20.0 8.21.0
nanoid 5.1.9 5.1.11
express-rate-limit 8.4.1 8.5.2
fast-xml-parser 5.7.2 5.8.0
ansis 4.2.0 4.3.0
typeorm 0.3.28 0.3.30
next 16.2.4 16.2.6
next-intl 4.11.0 4.12.0
react-dom 19.2.5 19.2.6
joi 18.1.2 18.2.1

Updates pg from 8.20.0 to 8.21.0

Changelog

Sourced from pg's changelog.

pg@8.21.0

Commits
  • 544b1ce Publish
  • cc03fa5 Add scramMaxIterations option to limit SCRAM iteration count (#3677)
  • f776327 Remove compatibility code for unsupported versions of Node (<16) (#3678)
  • f252870 cleanup: pg utils (#3675)
  • c8da6ab Assorted test cleanup (#3673)
  • fa47e73 fix: Client#end callback being called multiple times when first is no-op (#...
  • 88a7e60 cleanup: Move declaration to more natural place
  • 2095247 cleanup: Combine duplicated code in Client#query and avoid unneeded early n...
  • 0ac3edd fix: apply SASLprep (RFC 4013) to passwords before SCRAM-SHA-256 PBKDF2 (#3669)
  • be880d4 Assorted test fixes and cleanup (#3672)
  • Additional commits viewable in compare view

Updates nanoid from 5.1.9 to 5.1.11

Release notes

Sourced from nanoid's releases.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

Changelog

Sourced from nanoid's changelog.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

Commits

Updates express-rate-limit from 8.4.1 to 8.5.2

Release notes

Sourced from express-rate-limit's releases.

v8.5.2

You can view the changelog here.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

Commits
  • 9774693 8.5.2
  • 0e94cc0 v8.5.2 changelog
  • 9a583c5 feat: simplify IPv6 key generation (#633)
  • 4f4b3fb chore(deps-dev): bump lint-staged from 16.4.0 to 17.0.4 (#632)
  • 3c1d6c5 chore(deps-dev): bump the development-dependencies group with 7 updates (#631)
  • 18884b6 chore(deps): bump basic-ftp from 5.2.0 to 5.3.1 (#630)
  • dacc980 chore(deps): bump handlebars from 4.7.8 to 4.7.9 (#629)
  • 486d0c6 chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#627)
  • 50cc3f6 8.5.1
  • 92c8e3e chore: bump ip-address library to latest (#626)
  • Additional commits viewable in compare view

Updates fast-xml-parser from 5.7.2 to 5.8.0

Release notes

Sourced from fast-xml-parser's releases.

update strnum, FXB. Use xml-naming for DOCTYPE

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is by deault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

fix minor old bugs and update builder

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated
Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

5.7.2 / 2026-04-25

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

  • fix typo in CJS typing file

5.7.0 / 2026-04-17

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to user entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

5.6.0 / 2026-04-15

  • fix: entity replacement for numeric entities
  • use @​nodable/entities to replace entities
    • this may change some error messages related to entities expansion limit or inavlid use
    • post check would be exposed in future version

... (truncated)

Commits

Updates ansis from 4.2.0 to 4.3.0

Changelog

Sourced from ansis's changelog.

4.3.0 (2026-05-11)

  • feat: add support for OSC 8 hyperlink: link(url, text)
  • feat: add constructor overload to pass a mock globalThis object for controlled color auto-detection 
    import { Ansis } from 'ansis';
const color = new Ansis({
process: {
env: { FORCE_COLOR: '1' },
argv: ['node', 'app.js'],
stdout: { isTTY: false },
platform: 'linux',
},
});
console.log(color.level); // 1

  • fix(color-support): correctly handle edge cases using ENV variables and CLI flags
Fixed edge case Old behavior (bug) New behavior (correct)
FORCE_COLOR=1, NO_COLOR=1 disable color enable color (FORCE_COLOR takes precedence over NO_COLOR)
NO_COLOR=1, --color disable color enable color (CLI color flags take precedence over NO_COLOR)
FORCE_COLOR=1, --no-color disable color enable color (FORCE_COLOR has the highest priority)
--no-color --color disable color enable color (last flag wins)
--color with no detected colors truecolor 16 colors (auto-detect fallback uses the minimum color level, not truecolor)
Commits

Updates typeorm from 0.3.28 to 0.3.30

Release notes

Sourced from typeorm's releases.

0.3.30

What's Changed

Full Changelog: typeorm/typeorm@0.3.29...0.3.30

0.3.29

What's Changed

New Contributors

Full Changelog: typeorm/typeorm@0.3.28...0.3.29

Changelog

Sourced from typeorm's changelog.

0.3.30 (2026-05-18)

Bug Fixes

  • cockroachdb: adjust join in loadTables to load correct table columns (#12413) (d93402e)
  • find-options: allow array values in JsonContains (#12420) (90f169d)
  • preserve user-defined shared join columns in change set (#12354) (0aba011)
  • scope computed-columns join to correct table in MSSQL schema query (#12288) (6170be6)
  • scope invalidWhereValuesBehavior to high-level abstractions only (#11878) (1e10fb8), closes hi#level

Reverts

0.3.29 (2026-05-08)

Bug Fixes

  • add async to the method using setFindOptions() (#10787) (cc07c90)
  • change import for process dependency (#11248) (1c67c3b)
  • cli: init command loading non-existing package.json (#11947) (4d9d1a6)
  • fix up aggregate methods ambiguous column (#11822) (6e34756)
  • fix up limit with joins (#11987) (3657db8)
  • getPendingMigrations unnecessarily creating migrations table (#11672) (1dbc224)
  • postgres: execute queries sequentially to avoid pg 8.19.0 deprecation warning (#12105) (79829a0)
  • prevent columns with select false from being returned (#11944) (6b20831)
  • prevent eager-loaded entities from overwriting manual relations (#11267) (2d8c515)
  • propagate schema and database to closure junction table (#12110) (58b403f)
  • redis: redis cache version detection (#11936) (f22c7a2)
  • release query runner when there is no migration to revert (#11232) (a46eb0a)
  • sap: QueryBuilder parameter of type JS Date not escaped correctly (#11867) (5153436)
  • security: validate limit() in Update/SoftDelete query builders (#12437) (0d7991a)
  • virtual property handling in schema builder (#11000) (5bd3255)

Features

Commits
  • 4c91616 chore(release): release 0.3.30 (#12511)
  • 7792d00 ci: use the v0.3 branch as base for detect-changes
  • d93402e fix(cockroachdb): adjust join in loadTables to load correct table columns (#1...
  • 90f169d fix(find-options): allow array values in JsonContains (#12420)
  • 66f1ff8 revert: fix up limit with joins (#11987)
  • 0aba011 fix: preserve user-defined shared join columns in change set (#12354)
  • 6170be6 fix: scope computed-columns join to correct table in MSSQL schema query (#12288)
  • 1e10fb8 fix: scope invalidWhereValuesBehavior to high-level abstractions only (#11878)
  • 0ed009a ci: add npm environment to publish job for trusted publishing
  • 6ede38b chore: enable trusted publishing in publish workflow
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for typeorm since your current version.


Updates next from 16.2.4 to 16.2.6

Release notes

Sourced from next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

Moderate:

Low:

Core Changes

  • fix: preserve HTTP access fallbacks during prerender recovery (#92231)
  • Fix fallback route params case in app-page handler (#91737)
  • Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
  • Patch setHeader for direct route handlers (#93101)
  • Include deployment id in cacheHandlers keys (#93453)
  • Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

... (truncated)

Commits
  • ee6e79b v16.2.6
  • afa053d Turbopack: Match proxy matchers with webpack implementation (#93594)
  • 97a154e Turbopack: Fix middleware matcher suffix (#93590)
  • 83899bc [backport] Disable build caches for production/staging/force-preview deploys ...
  • 7b222b9 [backport][test] Pin package manager to patch versions (#93595)
  • a8dc24f [backport] Turbopack: more strict vergen setup (#93587)
  • 766148f v16.2.5
  • 0dd9483 fix: add explicit checks for RSC header (#83) (#98)
  • d166096 fix proxy matching for segment prefetch URLs (#89) (#96)
  • 9d50c0b Strip next-resume header from incoming requests (#92)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates next-intl from 4.11.0 to 4.12.0

Release notes

Sourced from next-intl's releases.

v4.12.0

4.12.0 (2026-05-13)

Features

⚠️ A small config change is required for useExtracted users to upgrade, please see amannn/next-intl#2316 for details.

v4.11.2

4.11.2 (2026-05-11)

Bug Fixes

v4.11.1

4.11.1 (2026-05-08)

Bug Fixes

Changelog

Sourced from next-intl's changelog.

4.12.0 (2026-05-13)

Features

4.11.2 (2026-05-11)

Bug Fixes

4.11.1 (2026-05-08)

Bug Fixes

Commits

Updates react-dom from 19.2.5 to 19.2.6

Release notes

Sourced from react-dom's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Updates joi from 18.1.2 to 18.2.1

Commits

Updates react from 19.2.5 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-minor-patch group across 1 directory…
840db79 
… with 11 updates

Bumps the production-minor-patch group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.20.0` | `8.21.0` |
| [nanoid](https://github.com/ai/nanoid) | `5.1.9` | `5.1.11` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.4.1` | `8.5.2` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.7.2` | `5.8.0` |
| [ansis](https://github.com/webdiscus/ansis) | `4.2.0` | `4.3.0` |
| [typeorm](https://github.com/typeorm/typeorm) | `0.3.28` | `0.3.30` |
| [next](https://github.com/vercel/next.js) | `16.2.4` | `16.2.6` |
| [next-intl](https://github.com/amannn/next-intl) | `4.11.0` | `4.12.0` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.6` |
| [joi](https://github.com/hapijs/joi) | `18.1.2` | `18.2.1` |



Updates `pg` from 8.20.0 to 8.21.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.21.0/packages/pg)

Updates `nanoid` from 5.1.9 to 5.1.11
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.1.9...5.1.11)

Updates `express-rate-limit` from 8.4.1 to 8.5.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.4.1...v8.5.2)

Updates `fast-xml-parser` from 5.7.2 to 5.8.0
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.7.2...v5.8.0)

Updates `ansis` from 4.2.0 to 4.3.0
- [Release notes](https://github.com/webdiscus/ansis/releases)
- [Changelog](https://github.com/webdiscus/ansis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/webdiscus/ansis/commits)

Updates `typeorm` from 0.3.28 to 0.3.30
- [Release notes](https://github.com/typeorm/typeorm/releases)
- [Changelog](https://github.com/typeorm/typeorm/blob/0.3.30/CHANGELOG.md)
- [Commits](typeorm/typeorm@0.3.28...0.3.30)

Updates `next` from 16.2.4 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.4...v16.2.6)

Updates `next-intl` from 4.11.0 to 4.12.0
- [Release notes](https://github.com/amannn/next-intl/releases)
- [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md)
- [Commits](amannn/next-intl@v4.11.0...v4.12.0)

Updates `react-dom` from 19.2.5 to 19.2.6
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom)

Updates `joi` from 18.1.2 to 18.2.1
- [Commits](hapijs/joi@v18.1.2...v18.2.1)

Updates `react` from 19.2.5 to 19.2.6
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react)

---
updated-dependencies:
- dependency-name: pg
  dependency-version: 8.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: nanoid
  dependency-version: 5.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: express-rate-limit
  dependency-version: 8.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: fast-xml-parser
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: ansis
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: typeorm
  dependency-version: 0.3.30
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: next
  dependency-version: 16.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: next-intl
  dependency-version: 4.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: react-dom
  dependency-version: 19.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: joi
  dependency-version: 18.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: react
  dependency-version: 19.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates and security issues label May 18, 2026
@github-actions github-actions Bot added apps Changes to apps/ packages Changes to packages/ labels May 18, 2026
@dependabot @github

dependabot Bot commented on behalf of github May 25, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 25, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/develop/production-minor-patch-70a9e82402 branch May 25, 2026 19:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

apps Changes to apps/ dependencies Dependency updates and security issues packages Changes to packages/

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants