Skip to content

chore(deps): bump the production-minor-patch group across 1 directory with 12 updates - #39

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/production-minor-patch-214a74beec
Closed

chore(deps): bump the production-minor-patch group across 1 directory with 12 updates#39
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/production-minor-patch-214a74beec

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-minor-patch group with 11 updates in the / directory:

Package From To
pg 8.20.0 8.21.0
nanoid 5.1.9 5.1.11
express-rate-limit 8.4.1 8.5.2
ioredis 5.10.1 5.11.1
fast-xml-parser 5.7.2 5.9.0
ansis 4.2.0 4.3.1
dayjs 1.11.20 1.11.21
next 16.2.4 16.2.9
next-intl 4.11.0 4.13.0
react-dom 19.2.5 19.2.7
joi 18.1.2 18.2.1

Updates pg from 8.20.0 to 8.21.0

Changelog

Sourced from pg's changelog.

pg@8.21.0

Commits
  • 544b1ce Publish
  • cc03fa5 Add scramMaxIterations option to limit SCRAM iteration count (#3677)
  • f776327 Remove compatibility code for unsupported versions of Node (<16) (#3678)
  • f252870 cleanup: pg utils (#3675)
  • c8da6ab Assorted test cleanup (#3673)
  • fa47e73 fix: Client#end callback being called multiple times when first is no-op (#...
  • 88a7e60 cleanup: Move declaration to more natural place
  • 2095247 cleanup: Combine duplicated code in Client#query and avoid unneeded early n...
  • 0ac3edd fix: apply SASLprep (RFC 4013) to passwords before SCRAM-SHA-256 PBKDF2 (#3669)
  • be880d4 Assorted test fixes and cleanup (#3672)
  • Additional commits viewable in compare view

Updates nanoid from 5.1.9 to 5.1.11

Release notes

Sourced from nanoid's releases.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

Changelog

Sourced from nanoid's changelog.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

Commits

Updates express-rate-limit from 8.4.1 to 8.5.2

Release notes

Sourced from express-rate-limit's releases.

v8.5.2

You can view the changelog here.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

Commits
  • 9774693 8.5.2
  • 0e94cc0 v8.5.2 changelog
  • 9a583c5 feat: simplify IPv6 key generation (#633)
  • 4f4b3fb chore(deps-dev): bump lint-staged from 16.4.0 to 17.0.4 (#632)
  • 3c1d6c5 chore(deps-dev): bump the development-dependencies group with 7 updates (#631)
  • 18884b6 chore(deps): bump basic-ftp from 5.2.0 to 5.3.1 (#630)
  • dacc980 chore(deps): bump handlebars from 4.7.8 to 4.7.9 (#629)
  • 486d0c6 chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#627)
  • 50cc3f6 8.5.1
  • 92c8e3e chore: bump ip-address library to latest (#626)
  • Additional commits viewable in compare view

Updates ioredis from 5.10.1 to 5.11.1

Release notes

Sourced from ioredis's releases.

v5.11.1

5.11.1 (2026-06-04)

Bug Fixes

  • cluster: reconnect to nodes that restart without slot changes (#2096) (c84b2ee)
  • parse protocol-relative Redis URLs as TCP connections (#2125) (131ee24)

v5.11.0

5.11.0 (2026-05-26)

Bug Fixes

Features

Changelog

Sourced from ioredis's changelog.

5.11.1 (2026-06-04)

Bug Fixes

  • cluster: reconnect to nodes that restart without slot changes (#2096) (c84b2ee)
  • parse protocol-relative Redis URLs as TCP connections (#2125) (131ee24)

5.11.0 (2026-05-26)

Bug Fixes

Features

Commits
  • fb224a7 chore(release): 5.11.1 [skip ci]
  • 131ee24 fix: parse protocol-relative Redis URLs as TCP connections (#2125)
  • c84b2ee fix(cluster): reconnect to nodes that restart without slot changes (#2096)
  • 1490432 chore(release): 5.11.0 [skip ci]
  • 5359d4d refactor(utils): inline defaults and isArguments helpers (#2107)
  • b7b3def feat: add vector set command support (#2116)
  • faa53fd ci: update Node.js and Redis test matrix (#2119)
  • 37d0695 feat: add increx command (#2115)
  • 612ee9d chore: update Redis 8.8 test image to custom (#2118)
  • baf68d6 feat: add array commands, typings and tests (#2114)
  • Additional commits viewable in compare view

Updates fast-xml-parser from 5.7.2 to 5.9.0

Release notes

Sourced from fast-xml-parser's releases.

update strnum, FXB. Use xml-naming for DOCTYPE

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is by deault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

fix minor old bugs and update builder

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated
Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

*5.9.0 / 2026-06-15 (not released yet)

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

5.7.2 / 2026-04-25

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

  • fix typo in CJS typing file

5.7.0 / 2026-04-17

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to user entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

... (truncated)

Commits

Updates ansis from 4.2.0 to 4.3.1

Release notes

Sourced from ansis's releases.

v4.3.1

Bug fixes

1. reset no longer appends a closing sequence

[!IMPORTANT] reset is now a single SGR command, not a paired open/close style. ansis.reset(value) prepends \x1b[0m and no longer appends a closing reset. If your code or snapshot tests relied on the trailing \x1b[0m, update them or add the reset explicitly (see below).

Before, reset was treated like any other style with an open and a close code, so it wrapped the value on both sides. That produced extra reset sequences in chained, nested, template literal, and multiline compositions, and the output did not match what a single reset should do.

Before:

ansis.reset('foo');
// "\x1b[0mfoo\x1b[0m"

Now:

ansis.reset('foo');
// "\x1b[0mfoo"

If you need a trailing reset, add it explicitly:

ansis.reset`foo ${ansis.red('bar')} baz` + ansis.reset();
// "\x1b[0mfoo \x1b[31mbar\x1b[39m baz\x1b[0m"

ansis.reset() without argument returns just the reset code \x1b[0m, which makes appending it easy.

2. strip() removes OSC 8 hyperlink sequences

strip() did not clear the OSC 8 sequences produced by link(). It now removes them and returns plain text:

ansis.strip(ansis.link('https://example.com', 'text'));
// "text"

3. No style leakage between instances with different color levels

Styles created on one Ansis instance could appear on another instance that was created with a different color level. That could give output rendered at the wrong color level. Now, instances are isolated, so each one keeps its own styles and level.

import { Ansis } from 'ansis';
</tr></table> 

... (truncated)

Changelog

Sourced from ansis's changelog.

4.3.1 (2026-05-31)

  • fix: remove closing reset ANSI sequence

    reset is now treated as a single SGR command, not as a paired style. This means ansis.reset(value) prepends \x1b[0m and does not append a closing reset sequence.

    Before:

    ansis.reset('foo');
    // "\x1b[0mfoo\x1b[0m"

    Now:

    ansis.reset('foo');
    // "\x1b[0mfoo"

    If a trailing reset is needed, add it explicitly:

    ansis.reset`foo ${ansis.red('bar')} baz` + ansis.reset();
    // "\x1b[0mfoo \x1b[31mbar\x1b[39m baz\x1b[0m"

    The fix removes extra reset sequences in chained, nested, template literal, and multiline style compositions where treating reset as a paired style gave wrong output.

  • fix: strip() now removes OSC 8 hyperlink sequences generated by link() ansis.strip(ansis.link(url, text)) now returns plain text

  • fix: prevent silent style leakage between Ansis instances created with different color levels

  • fix: .extend() on one Ansis instance no longer overrides styles created on other instances with different color levels

  • refactor: micro-optimisations to reduce code size

4.3.0 (2026-05-11)

  • feat: add link(url, text?) for OSC 8 hyperlinks, supported by many terminal emulators
  • feat: add constructor overload to pass a mock globalThis object for controlled color auto-detection
    import { Ansis } from 'ansis';
    const color = new Ansis({
    process: {
    env: { FORCE_COLOR: '1' },

... (truncated)

Commits
  • 3baa7aa refactor: micro-optimisations to reduce code size
  • 1914005 fix: prevent silent style leakage between Ansis instances created with differ...
  • 1d575d4 fix: fix edge cases in reset ANSI sequence generation
  • d83dd95 refactor: code micro optimisation
  • bc74986 test: add tests for style stack handling
  • fa344ef test: detected BUG in Node hasColors under Windows + Node 24 - NO_COLOR="" re...
  • 29c1412 chore: update git workflow
  • 3873dbd chore: update github templates
  • b514d49 chore: release 4.3.0
  • 8eb1334 refactor: micro optimisations
  • Additional commits viewable in compare view

Updates dayjs from 1.11.20 to 1.11.21

Release notes

Sourced from dayjs's releases.

v1.11.21

1.11.21 (2026-05-26)

Bug Fixes

Changelog

Sourced from dayjs's changelog.

1.11.21 (2026-05-26)

Bug Fixes

Commits

Updates next from 16.2.4 to 16.2.9

Release notes

Sourced from next's releases.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Backport documentation fixes for v16.2 (#93804)
  • [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
  • [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
  • [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
  • [backport] Encode non-ASCII characters in cache tags at construction (#93918)
  • [backport] Fix server action forwarding loop with middleware rewrites (#93919)
  • [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
  • [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
  • [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
  • [backport] Propagate adapter preferred regions (#94200)
  • [16.2.x] Don't drop FormData entries (#94240)
  • [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

Moderate:

... (truncated)

Commits
  • f37fad9 v16.2.9
  • d9aaaed [cd] Allow tagging semver-lower releases as @latest if @latest po… (#94627)
  • 6f16804 v16.2.8
  • 0dbc1d5 [16.2.x][cd] Ensure release can be triggered on old branches (#94598)
  • 90e3c81 [16.2.x] Align Actions dependencies with Canary (#94339)
  • 83f402c [16.2.x][cd] Stop fetching all tags when searching parent tag (#94334)
  • 411c455 v16.2.7
  • c63224f [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolut...
  • 63115c7 [16.2.x] Don't drop FormData entries (#94240)
  • aef22fd [backport] Propagate adapter preferred regions (#94200)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates next-intl from 4.11.0 to 4.13.0

Release notes

Sourced from next-intl's releases.

v4.13.0

4.13.0 (2026-05-28)

Features

⚠️ If you're using useExtracted, this requires an update to your existing keys. Please point your agent at amannn/next-intl#2330 to upgrade.

v4.12.0

4.12.0 (2026-05-13)

Features

⚠️ A small config change is required for useExtracted users to upgrade, please see amannn/next-intl#2316 for details.

v4.11.2

4.11.2 (2026-05-11)

Bug Fixes

v4.11.1

4.11.1 (2026-05-08)

Bug Fixes

Changelog

Sourced from next-intl's changelog.

4.13.0 (2026-05-28)

Features

4.12.0 (2026-05-13)

Features

4.11.2 (2026-05-11)

Bug Fixes

4.11.1 (2026-05-08)

Bug Fixes

Commits

Updates react-dom from 19.2.5 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates joi from 18.1.2 to 18.2.1

Commits

Updates react from 19.2.5 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… with 12 updates

Bumps the production-minor-patch group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.20.0` | `8.21.0` |
| [nanoid](https://github.com/ai/nanoid) | `5.1.9` | `5.1.11` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.4.1` | `8.5.2` |
| [ioredis](https://github.com/luin/ioredis) | `5.10.1` | `5.11.1` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.7.2` | `5.9.0` |
| [ansis](https://github.com/webdiscus/ansis) | `4.2.0` | `4.3.1` |
| [dayjs](https://github.com/iamkun/dayjs) | `1.11.20` | `1.11.21` |
| [next](https://github.com/vercel/next.js) | `16.2.4` | `16.2.9` |
| [next-intl](https://github.com/amannn/next-intl) | `4.11.0` | `4.13.0` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.7` |
| [joi](https://github.com/hapijs/joi) | `18.1.2` | `18.2.1` |



Updates `pg` from 8.20.0 to 8.21.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.21.0/packages/pg)

Updates `nanoid` from 5.1.9 to 5.1.11
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.1.9...5.1.11)

Updates `express-rate-limit` from 8.4.1 to 8.5.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.4.1...v8.5.2)

Updates `ioredis` from 5.10.1 to 5.11.1
- [Release notes](https://github.com/luin/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.10.1...v5.11.1)

Updates `fast-xml-parser` from 5.7.2 to 5.9.0
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.7.2...v5.9.0)

Updates `ansis` from 4.2.0 to 4.3.1
- [Release notes](https://github.com/webdiscus/ansis/releases)
- [Changelog](https://github.com/webdiscus/ansis/blob/master/CHANGELOG.md)
- [Commits](webdiscus/ansis@v4.2.0...v4.3.1)

Updates `dayjs` from 1.11.20 to 1.11.21
- [Release notes](https://github.com/iamkun/dayjs/releases)
- [Changelog](https://github.com/iamkun/dayjs/blob/dev/CHANGELOG.md)
- [Commits](iamkun/dayjs@v1.11.20...v1.11.21)

Updates `next` from 16.2.4 to 16.2.9
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.4...v16.2.9)

Updates `next-intl` from 4.11.0 to 4.13.0
- [Release notes](https://github.com/amannn/next-intl/releases)
- [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md)
- [Commits](amannn/next-intl@v4.11.0...v4.13.0)

Updates `react-dom` from 19.2.5 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `joi` from 18.1.2 to 18.2.1
- [Commits](hapijs/joi@v18.1.2...v18.2.1)

Updates `react` from 19.2.5 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

---
updated-dependencies:
- dependency-name: pg
  dependency-version: 8.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: nanoid
  dependency-version: 5.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: express-rate-limit
  dependency-version: 8.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: ioredis
  dependency-version: 5.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: fast-xml-parser
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: ansis
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: dayjs
  dependency-version: 1.11.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: next
  dependency-version: 16.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: next-intl
  dependency-version: 4.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: joi
  dependency-version: 18.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates and security issues label Jun 15, 2026
@github-actions github-actions Bot added apps Changes to apps/ packages Changes to packages/ labels Jun 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 22, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/develop/production-minor-patch-214a74beec branch June 22, 2026 06:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

apps Changes to apps/ dependencies Dependency updates and security issues packages Changes to packages/

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants