Skip to content

Bump the npm_and_yarn group across 1 directory with 6 updates - #4

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-d0648faad1
Open

Bump the npm_and_yarn group across 1 directory with 6 updates#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-d0648faad1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
body-parser 2.3.0 2.4.0
multer 2.4.0 2.5.0
next 16.3.8 16.4.3
follow-redirects 1.16.0 1.16.2
ip-address 10.7.2 10.7.5
qs 6.16.0 6.17.1

Updates body-parser from 2.3.0 to 2.4.0

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

Changelog

Sourced from body-parser's changelog.

2.4.0

  • Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)
  • feat: add zstd content-encoding support (#586)
    • Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies
  • fix: avoid mutating the parser options and the request object while reading the body (#742, #750)
  • perf(json): avoid first-char regex for direct JSON bodies (#744)
  • deps:
    • content-type@^2.1.0
    • iconv-lite^0.7.3
    • qs@^6.16.1
Commits
  • b4744d7 2.4.0 (#777)
  • f7075ea fix: prevent process crash from trailing bytes after a compressed body
  • 185ff1d chore: update dependencies (#778)
  • 73713f7 docs: fix depth error description (#776)
  • 2dcc826 docs: improve readability (#756)
  • 402dbdc docs: note that req.body may be undefined in v2 (#752)
  • 9883a1e perf: inline content stream setup (#750)
  • 02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
  • 822a0fd build(deps): bump the github-actions group with 3 updates (#771)
  • aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.


Updates multer from 2.4.0 to 2.5.0

Release notes

Sourced from multer's releases.

v2.5.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/multer@v2.4.0...v2.5.0

Changelog

Sourced from multer's changelog.

2.5.0

  • Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
  • Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#1481)
  • Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#1489)
Commits
  • 2c380d0 2.5.0 (#1490)
  • 80a2d9d fix: swallow late busboy error after teardown
  • c901d48 chore(deps): bump github/codeql-action/analyze to 4.38.2 (#1486)
  • ba3619a chore(deps): bump github/codeql-action/upload-sarif (#1487)
  • 0b72081 chore(deps): bump github/codeql-action/init to 4.38.2 (#1488)
  • 7661ce7 fix: allow a field value exactly at the fieldSize limit (#1481)
  • 6dac92f fix: don't add a failed upload to the abort cleanup list (#1489)
  • dd9f062 docs: fix typo in .none() and grammar in .any() (#1485)
  • See full diff in compare view

Updates next from 16.3.8 to 16.4.3

Release notes

Sourced from next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
  • [lts-active] test: Pin react-virtualized (#100545)
  • [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
  • [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
  • [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

What's Changed

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

High:

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

  • Show compiler plugin warning in more situations: #75682
  • fix(scripts): correct typo in rm.mjs error message: #87015

... (truncated)

Commits
  • 29bbeab v16.4.3
  • 5117201 [lts-active] Avoid loading standalone React in server bootstrap (#100610)
  • 37d603b [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #1...
  • cf9d27d [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...
  • 3f6a632 [lts-active] test: Pin react-virtualized (#100545)
  • f715bba [lts-active][cd] Gate release bot credentials behind GitHub environments (#10...
  • c864c78 [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • f3ff943 [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • f697cf5 [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • 2864b17 v16.4.2
  • Additional commits viewable in compare view

Updates follow-redirects from 1.16.0 to 1.16.2

Commits
  • e3b45a7 Release version 1.16.2 of the npm package.
  • b0a7751 Use Array.isArray.
  • d96d1fe Add funding emergency notice.
  • 4630125 Release version 1.16.1 of the npm package.
  • 9865ca4 Support key/value header arrays.
  • 080a76d Escape all RegExp modifiers.
  • See full diff in compare view

Updates ip-address from 10.7.2 to 10.7.5

Release notes

Sourced from ip-address's releases.

v10.7.5

Full Changelog: beaugunderson/ip-address@v10.7.4...v10.7.5

v10.7.4

Full Changelog: beaugunderson/ip-address@v10.7.3...v10.7.4

v10.7.3

What's Changed

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

Commits
  • db0dbda 10.7.5
  • 82a72d7 Read Teredo flags from the bits inspectTeredo names
  • 172afdd Update mocha to 12 and patch vulnerable transitive dev dependencies
  • 8c0ec94 Test that every parser rejects fullwidth and other non-ASCII digits
  • 651c1dd 10.7.4
  • ec80fcd Find an IPv6 zone by index so a rejected zone costs one pass
  • e22eb4a Check generated docs without writing or hiding partial staging
  • c7f838e 10.7.3
  • 09b8072 Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)
  • See full diff in compare view

Updates qs from 6.16.0 to 6.17.1

Changelog

Sourced from qs's changelog.

6.17.1

  • [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as surrogate pairs (#640)
  • [Fix] parse: respect plainObjects for [] with parseArrays: false (#639)
  • [Fix] utils: merge: count the elements of a sparse array against arrayLimit, not its holes
  • [Fix] parse: guard bracket-wrapped prototype keys at depth 0 (#638)
  • [Refactor] parse: extract wrapping-bracket stripping helper
  • [readme] document that depth: 0 and depth: false keep keys flat
  • [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by allowPrototypes/plainObjects

6.17.0

  • [New] stringify: add WHATWG format (#623)
  • [Fix] stringify: do not sort the caller's filter array in place (#637)
  • [Fix] parse: copy an own __proto__ key as data (#636)
  • [Fix] parse: decode percent-encoded dots case-insensitively (#635)
  • [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
  • [Fix] parse: preserve comma arrays when interpreting numeric entities (#630)
  • [Fix] parse: allow scalar fields with a zero array limit (#627)
  • [Fix] parse: do not count an existing comma array toward arrayLimit when duplicates discards or replaces it
  • [Fix] utils: encode: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
  • [eslint] fix indentation
  • [readme] document the encoder's format argument
  • [meta] add changelog acknowledgement
  • [meta] fix changelog indents
  • [Dev Deps] update eslint, evalmd, npmignore
  • [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding
  • [Tests] stringify: pin sort order for nested keys selected by an array filter
  • [Tests] parse: cover interpretNumericEntities across value shapes, keys, and the charset sentinel
  • [Tests] parse: cover more input that builds no array at a zero or negative arrayLimit
  • [Tests] parse: cover comma with a zero or negative arrayLimit, and combining a full comma array
  • [Tests] parse: pin the behavior of a zero or negative arrayLimit
  • [Tests] utils/stringify: pin ~, *, and parens encoding in RFC3986 and RFC1738

6.16.2

  • [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
  • [meta] use double quotes for better OS support
  • [Dev Deps] update evalmd, npmignore
  • [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

  • [Fix] parse: do not mutate an object input
  • [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
  • [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
  • [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
  • [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
  • [Fix] stringify: ignore inherited array format names (#622)
  • [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
  • [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
  • [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
  • [Fix] parse: only treat [] as array syntax when it ends the key
  • [Perf] decode: skip decoders when there is no percent sign (#583)

... (truncated)

Commits
  • 43baea4 v6.17.1
  • 54623b6 [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as...
  • 7924b65 [Fix] parse: respect plainObjects for [] with parseArrays: false
  • 7d4b440 [readme] document that depth: 0 and depth: false keep keys flat
  • 101492a [Fix] utils: merge: count the elements of a sparse array against `arrayLi...
  • 42eccf0 [Fix] parse: guard bracket-wrapped prototype keys at depth 0
  • ae0b5c7 [Refactor] parse: extract wrapping-bracket stripping helper
  • 6459f9f [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by `al...
  • cb6855c Merge backport release tags v6.12.6–v6.16.2 into main
  • 136912a v6.16.2
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 6 updates
a44c286 
Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [body-parser](https://github.com/expressjs/body-parser) | `2.3.0` | `2.4.0` |
| [multer](https://github.com/expressjs/multer) | `2.4.0` | `2.5.0` |
| [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.3` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.0` | `1.16.2` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.7.2` | `10.7.5` |
| [qs](https://github.com/ljharb/qs) | `6.16.0` | `6.17.1` |



Updates `body-parser` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.3.0...v2.4.0)

Updates `multer` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.4.0...v2.5.0)

Updates `next` from 16.3.8 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.8...v16.4.3)

Updates `follow-redirects` from 1.16.0 to 1.16.2
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.2)

Updates `ip-address` from 10.7.2 to 10.7.5
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.7.2...v10.7.5)

Updates `qs` from 6.16.0 to 6.17.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.16.0...v6.17.1)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.4.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: multer
  dependency-version: 2.5.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 16.4.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.7.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 29, 2026
@dependabot dependabot Bot mentioned this pull request Oct 29, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants