Skip to content

chore(deps): bump the production group across 1 directory with 5 updates - #66

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-618d9c634f
Open

chore(deps): bump the production group across 1 directory with 5 updates#66
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-618d9c634f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown

Bumps the production group with 5 updates in the / directory:

Package From To
@grpc/grpc-js 1.14.5 1.14.6
express 5.2.1 5.3.0
graphql-ws 6.3.0 6.4.1
pino 10.3.1 10.4.0
jose 6.2.12 6.2.13

Updates @grpc/grpc-js from 1.14.5 to 1.14.6

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.14.6

Commits
  • c63ed15 Merge pull request #3105 from murgatroid99/grpc-js_error_details_1.14
  • 025cc24 Merge pull request #3107 from olavloite/backport-perf-to-1.14.x
  • 9b50778 grpc-js: Increment version to 1.14.6
  • 1126061 grpc-js: Don't transmit error details by default in server interceptors
  • 40b61a0 perf(grpc-js): avoid allocations for empty CallCredentials on the RPC hot pat...
  • aed1745 test(grpc-js): stabilize weighted round robin tests on slow runners (#3104)
  • 8db8a06 perf(grpc-js): avoid redundant metadata clone in RetryingCall on initial atte...
  • 2aa8b88 perf(grpc-js): memoize method config lookup in default config selector (#3098)
  • e4ccd66 perf(grpc-js): cache precomputed serviceUrl in InternalChannel (#3097)
  • 17c61a5 test(grpc-js): fix Windows CI test failures (#3094)
  • Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates graphql-ws from 6.3.0 to 6.4.1

Release notes

Sourced from graphql-ws's releases.

v6.4.1

Patch Changes

  • #703 707c38c Thanks @​lprnmns! - Use the jsonMessageReplacer when automatically responding to a ping with a pong, on both the client and the server

v6.4.0

Minor Changes

  • #696 83be052 Thanks @​niukanen1! - Add an isProd option to the ws, uWebSockets.js and @fastify/websocket use-server helpers, matching the existing crossws option. It controls whether internal error messages are masked with Internal server error before reaching the client, defaulting to the NODE_ENV === 'production' check as before. This lets apps running in production keep reporting onConnect error messages to the client by opting out, or mask eagerly in non-production environments.

Patch Changes

  • #700 d8aeda6 Thanks @​kratam! - Fix the client closing an in-use socket when many subscriptions complete at once and a new one subscribes within the lazyCloseTimeout

    Every completing subscription scheduled its own lazy close timeout, but only the last one got cleared on the next connect. The client now keeps a single lazy close timeout and checks for active subscriptions before closing.

  • #702 1e05c8c Thanks @​Meemaw! - Avoid an unhandled rejection when a subscription is disposed before the connection is acknowledged and the socket closes before the subscription releases its connection lock (for example, when the client is disposed while connecting and the WebSocket implementation delivers the close event on a microtask).

Changelog

Sourced from graphql-ws's changelog.

6.4.1

Patch Changes

  • #703 707c38c Thanks @​lprnmns! - Use the jsonMessageReplacer when automatically responding to a ping with a pong, on both the client and the server

6.4.0

Minor Changes

  • #696 83be052 Thanks @​niukanen1! - Add an isProd option to the ws, uWebSockets.js and @fastify/websocket use-server helpers, matching the existing crossws option. It controls whether internal error messages are masked with Internal server error before reaching the client, defaulting to the NODE_ENV === 'production' check as before. This lets apps running in production keep reporting onConnect error messages to the client by opting out, or mask eagerly in non-production environments.

Patch Changes

  • #700 d8aeda6 Thanks @​kratam! - Fix the client closing an in-use socket when many subscriptions complete at once and a new one subscribes within the lazyCloseTimeout

    Every completing subscription scheduled its own lazy close timeout, but only the last one got cleared on the next connect. The client now keeps a single lazy close timeout and checks for active subscriptions before closing.

  • #702 1e05c8c Thanks @​Meemaw! - Avoid an unhandled rejection when a subscription is disposed before the connection is acknowledged and the socket closes before the subscription releases its connection lock (for example, when the client is disposed while connecting and the WebSocket implementation delivers the close event on a microtask).

Commits
  • 7281f1b Upcoming Release Changes (#704)
  • 707c38c fix: use the JSON message replacer for automatic pongs (#703)
  • 895b747 Upcoming Release Changes (#698)
  • d8aeda6 fix(client): keep a single lazy close timeout and respect active locks (#700)
  • 1e05c8c fix(client): avoid unhandled rejection when a subscription is disposed before...
  • 83be052 Add isProd option to the ws, uWebSockets.js and @​fastify/websocket use-server...
  • See full diff in compare view

Updates pino from 10.3.1 to 10.4.0

Release notes

Sourced from pino's releases.

v10.4.0

What's Changed

... (truncated)

Commits
  • b29dbe9 Bumped v10.4.0
  • 6ba157b docs: fix the pino-pretty flush explanation after thread-stream#198 (#2524)
  • 6429c14 docs: Note that serializers run on child bindings at creation time (#2518)
  • 6c71bc9 Add bindings method to browser logger (#2504)
  • b557f72 ci: pin lock-threads to upstream v6.0.2 to fix token validation failure (#2525)
  • 1de1212 docs: document the APIs that are unavailable in the browser (#2521)
  • af2fe10 Delete .github/dependabot.yml (#2517)
  • 5aa6230 build(deps-dev): bump eslint-plugin-n from 18.2.2 to 18.3.0 (#2515)
  • 6f5af07 build(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 (#2513)
  • 2ffe576 ci: check pull requests target main (#2500)
  • Additional commits viewable in compare view

Updates jose from 6.2.12 to 6.2.13

Release notes

Sourced from jose's releases.

v6.2.13

Refactor

  • align terminology with JOSE specifications (bafcb74)
  • preserve underlying error causes (724ba24), closes #908
Changelog

Sourced from jose's changelog.

6.2.13 (2026-10-20)

Refactor

  • align terminology with JOSE specifications (bafcb74)
  • preserve underlying error causes (724ba24), closes #908
Commits
  • 316b7f2 chore(release): 6.2.13
  • 8106395 chore: bump packages
  • 724ba24 refactor: preserve underlying error causes
  • b112a5e chore: bump packages
  • 2a3a525 chore(deps-dev): bump workerd in /tap/workerd
  • 8f540d8 chore(deps): bump the actions group with 3 updates
  • 8d6c02b chore(deps-dev): bump electron from 44.0.0 to 44.4.5 in /tap/electron
  • 55c959f ci: use gh run rerun for retries
  • 5b00c64 ci: address zizmor findings and bump shared workflows
  • 1761d7f chore: bump packages
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production group across 1 directory with 5 updates
be29392 
Bumps the production group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.14.5` | `1.14.6` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [graphql-ws](https://github.com/enisdenjo/graphql-ws) | `6.3.0` | `6.4.1` |
| [pino](https://github.com/pinojs/pino) | `10.3.1` | `10.4.0` |
| [jose](https://github.com/panva/jose) | `6.2.12` | `6.2.13` |



Updates `@grpc/grpc-js` from 1.14.5 to 1.14.6
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.5...@grpc/grpc-js@1.14.6)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `graphql-ws` from 6.3.0 to 6.4.1
- [Release notes](https://github.com/enisdenjo/graphql-ws/releases)
- [Changelog](https://github.com/enisdenjo/graphql-ws/blob/master/CHANGELOG.md)
- [Commits](enisdenjo/graphql-ws@v6.3.0...v6.4.1)

Updates `pino` from 10.3.1 to 10.4.0
- [Release notes](https://github.com/pinojs/pino/releases)
- [Commits](pinojs/pino@v10.3.1...v10.4.0)

Updates `jose` from 6.2.12 to 6.2.13
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.12...v6.2.13)

---
updated-dependencies:
- dependency-name: "@grpc/grpc-js"
  dependency-version: 1.14.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: graphql-ws
  dependency-version: 6.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: pino
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: jose
  dependency-version: 6.2.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants