chore(deps)(deps): bump the production-dependencies group across 1 directory with 10 updates by dependabot[bot] · Pull Request #154 · FutureSolutionDev/Deploy-Center-Server

dependabot · 2026-10-19T03:06:30Z

Bumps the production-dependencies group with 10 updates in the / directory:

Package	From	To
axios	`1.19.0`	`1.20.0`
compression	`1.8.1`	`1.8.2`
express	`5.2.1`	`5.3.0`
express-rate-limit	`8.6.2`	`8.7.1`
fs-extra	`11.4.0`	`11.4.1`
joi	`18.2.5`	`18.2.9`
mariadb	`3.5.3`	`3.5.4`
morgan	`1.11.0`	`1.12.1`
mysql2	`3.23.4`	`3.24.6`
socket.io	`4.8.3`	`4.8.4`

Updates axios from 1.19.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

Changelog

Sourced from axios's changelog.

Changelog

Commits

84a9f3b chore(release): prepare release 1.20.0 (#11152)
e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
d19040b fix: harden runtime option handling (#11141)
e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
ba98559 docs: add ScrapingBee sponsor (#11137)
Additional commits viewable in compare view

Updates compression from 1.8.1 to 1.8.2

Release notes

Sourced from compression's releases.

v1.8.2

Important

Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95)

What's Changed

chore: add funding to package.json by @bjohansebas in expressjs/compression#248

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in expressjs/compression#249

build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in expressjs/compression#253

build(deps): bump github/codeql-action from 3.29.7 to 3.29.11 by @dependabot[bot] in expressjs/compression#252

build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in expressjs/compression#251

build(deps): bump actions/setup-node from 4.4.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#261

build(deps): bump github/codeql-action from 3.29.11 to 4.31.2 by @dependabot[bot] in expressjs/compression#260

build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in expressjs/compression#259

build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#258

build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by @dependabot[bot] in expressjs/compression#264

build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#263

build(deps): bump github/codeql-action from 4.31.2 to 4.31.5 by @dependabot[bot] in expressjs/compression#262

chore: up node version to 25.x in CI by @imangas in expressjs/compression#272

doc(package): remove history.md and add readme.md to published files by @sheplu in expressjs/compression#270

Update link to CONTRIBUTING.md by @krzysdz in expressjs/compression#281

test: run CI on Windows and macOS by @kilisamemarisaaa in expressjs/compression#283

build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in expressjs/compression#257

build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/compression#268

build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 by @dependabot[bot] in expressjs/compression#265

build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in expressjs/compression#266

build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#267

chore(ci): npm-publish via reusable workflows by @sheplu in expressjs/compression#269

docs: update outdated Brotli note and fix npm install docs URL by @Vansh1811 in expressjs/compression#276

fix: match Cache-Control no-transform directive case-insensitively by @vaibhavmashal in expressjs/compression#286

1.8.2 by @UlisesGascon in expressjs/compression#287

New Contributors

@imangas made their first contribution in expressjs/compression#272

@sheplu made their first contribution in expressjs/compression#270

@krzysdz made their first contribution in expressjs/compression#281

@kilisamemarisaaa made their first contribution in expressjs/compression#283

@Vansh1811 made their first contribution in expressjs/compression#276

@vaibhavmashal made their first contribution in expressjs/compression#286

Full Changelog: expressjs/compression@v1.8.1...v1.8.2

Changelog

Sourced from compression's changelog.

1.8.2

Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95)

deps: add destroy@1.2.0

Match Cache-Control: no-transform directive case-insensitively

Commits

0f97074 1.8.2 (#287)
151f63e fix: destroy compression stream on response close
0a76495 fix: match Cache-Control no-transform directive case-insensitively (#286)
c17b6e5 docs: update outdated Brotli note and fix npm install docs URL (#276)
112911a chore(ci): npm-publish via reusable workflows (#269)
1bf5eb0 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#267)
d8fe64d build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#266)
b218ff5 build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (#265)
8a1cf8e build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#268)
4a19855 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#257)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compression since your current version.

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

cf6722b 5.3.0 (#7468)
8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
9efc29e docs: fix pass-through typos (#7509)
2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
9169cbe docs: add missing apostrophe in example (#7483)
7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
98bd4cd deps: proxy-addr@^2.0.8 (#7474)
9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates express-rate-limit from 8.6.2 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

v8.7.0

You can view the changelog here.

Commits

c2e30b3 8.7.1
b40a390 v8.7.1 changelog
ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
Additional commits viewable in compare view

Updates fs-extra from 11.4.0 to 11.4.1

Changelog

Sourced from fs-extra's changelog.

11.4.1 / 2026-09-22

Properly handle read errors (e.g. due to permissions) in emptyDir*() (#1080)

Allow renaming with only Unicode normalization difference in the filename (APFS-specific) (#859, #1079)

Commits

1e223d3 11.4.1
8cfd0a0 Remove obsolete docs note
de72292 Treat Unicode-normalization-only renames like case-only renames (#1079)
7e0ce7f Remove broken link (#1083)
00e858c Update GH Actions versions (#1082)
f829cc9 fix: propagate emptyDir directory read errors (#1080)
See full diff in compare view

Updates joi from 18.2.5 to 18.2.9

Commits

fc3f3bc 18.2.9
e7791cb Merge pull request #3152 from hapijs/chore/3151-cleanup
7363128 chore: cleanup for #3151
03a9543 Merge pull request #3151 from carfeii/fix/messages-flat-code-proto-pollution
5b8333c Reject proto as a flat messages() code, closing a sibling of GHSA-gg4h-3h...
e30b50e 18.2.8
1c9dede Merge pull request #3149 from hapijs/chore/optimize-schema-creation
cdad986 chore: optimize schema creation
057dff2 18.2.7
a14051a Merge pull request #3148 from hapijs/chore/optimize-large-arrays
Additional commits viewable in compare view

Updates mariadb from 3.5.3 to 3.5.4

Release notes

Sourced from mariadb's releases.

MariaDB Connector/Node.js 3.5.4

3.5.4 (Jul 2026)

Full Changelog

Notable changes

CONJS-355: Avoid flat-cloning the connection options for every command, relying on a prototype-chain merge instead (#353 thanks to erulabs)

CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI

CONJS-365: Enable standard TLS certificate identity validation under Deno

CONJS-366: New option maxAllowedColumns (default 65535) bounding the column count announced by the server, a rogue server being otherwise able to have the client allocate metadata for a result-set that will never complete (report by fg0x0)

Issues Fixed

CONJS-329: An exception thrown by a callback was reported to that same callback as a database error, instead of propagating like it does from any other node-style callback (report by Assen Totin)

CONJS-356: Corrected ed25519 authentication with zero-configuration SSL

CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated

CONJS-359: Corrected the default maxAllowedPacket value when the option is not set

CONJS-360: batch() ignored the insertIdAsNumber / supportBigNumbers / bigNumberStrings options for insertId

CONJS-361: The connection stopped sending commands after a command ending on the last packet of a network chunk: a prepared statement was never executed, without error nor timeout (report by Assen Totin)

CONJS-362: Limit the parsec authentication PBKDF2 iteration factor and move the key derivation off the event loop, a rogue server being otherwise able to freeze the whole process for minutes (report by fg0x0)

CONJS-363: typeCast accessors returned corrupted values with prepared statements

CONJS-364: Types / TypeNumbers enums threw at runtime (#347, contribution by BrianDouglasIE)

CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)

CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)

CONJS-369: Fixed SQL injection through object keys in SET expansion when using permitSetMultiParamEntries (report by fg0x0)

Changelog

Sourced from mariadb's changelog.

3.5.4 (Jul 2026)

Full Changelog

Notable changes

CONJS-355: Avoid flat-cloning the connection options for every command, relying on a prototype-chain merge instead (#353 thanks to erulabs)

CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI

CONJS-365: Enable standard TLS certificate identity validation under Deno

CONJS-366: New option maxAllowedColumns (default 65535) bounding the column count announced by the server, a rogue server being otherwise able to have the client allocate metadata for a result-set that will never complete (report by fg0x0)

Issues Fixed

CONJS-329: An exception thrown by a callback was reported to that same callback as a database error, instead of propagating like it does from any other node-style callback (report by Assen Totin)

CONJS-356: Corrected ed25519 authentication with zero-configuration SSL

CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated

CONJS-359: Corrected the default maxAllowedPacket value when the option is not set

CONJS-360: batch() ignored the insertIdAsNumber / supportBigNumbers / bigNumberStrings options for insertId

CONJS-361: The connection stopped sending commands after a command ending on the last packet of a network chunk: a prepared statement was never executed, without error nor timeout (report by Assen Totin)

CONJS-362: Limit the parsec authentication PBKDF2 iteration factor and move the key derivation off the event loop, a rogue server being otherwise able to freeze the whole process for minutes (report by fg0x0)

CONJS-363: typeCast accessors returned corrupted values with prepared statements

CONJS-364: Types / TypeNumbers enums threw at runtime (#347, contribution by BrianDouglasIE)

CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)

CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)

CONJS-369: Fixed SQL injection through object keys in SET expansion when using permitSetMultiParamEntries (report by fg0x0)

3.4.7 (Jul 2026)

Full Changelog

Notable changes

CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI

Issues Fixed

CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated

CONJS-363: typeCast accessors returned corrupted values with prepared statements

CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)

CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)

CONJS-369: Fixed SQL injection through object keys in SET expansion when using permitSetMultiParamEntries (report by fg0x0)

Escape the server-supplied filename before building the LOCAL INFILE validation regular expression

3.3.4 (Jul 2026)

Full Changelog

Notable changes

CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI

Issues Fixed

CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated

CONJS-363: typeCast accessors returned corrupted values with prepared statements

CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)

CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)

... (truncated)

Commits

ff43a2c [misc] type definitions: StreamCallback declared as a value it never exports
2044071 Merge pull request #356 from GiHoon1123/fix-sqlerror-instanceof
f7009c4 [misc] fix SqlError losing its constructor shape via namespace import
1d9ae05 [misc] command queue: never discard a command that has not started
a666b5e [misc] test correction
8efc399 bump 3.5.4 version
f050ee7 [misc] callback API: give callbacks to the command layer instead of a promise
1e79cee [misc] test addition
3fdaf48 [CONJS-329] Exception thrown by a callback reported as a database error
a0671c2 [CONJS-361] Connection stops sending commands after a command ends on the las...
Additional commits viewable in compare view

Updates morgan from 1.11.0 to 1.12.1

Release notes

Sourced from morgan's releases.

1.12.1

Important

Security fix for CVE-2026-87859 (GHSA-9f6g-j8ch-79g4)

What's Changed

docs: fix typos across documentation by @vaibhavmashal in expressjs/morgan#378

test: run CI on Windows and macOS by @kilisamemarisaaa in expressjs/morgan#379

build(deps): bump github/codeql-action/upload-sarif to 4.37.9 by @dependabot[bot] in expressjs/morgan#381

build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.37.9 by @dependabot[bot] in expressjs/morgan#382

build(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 by @dependabot[bot] in expressjs/morgan#383

build(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 by @dependabot[bot] in expressjs/morgan#384

1.12.1 by @UlisesGascon in expressjs/morgan#386

New Contributors

@vaibhavmashal made their first contribution in expressjs/morgan#378

@kilisamemarisaaa made their first contribution in expressjs/morgan#379

Full Changelog: expressjs/morgan@1.12.0...1.12.1

1.12.0

What's Changed

fix: upgrade http:// to https:// in README by @hanu-14 in expressjs/morgan#363

build: bump github actions and dev dependencies by @sheplu in expressjs/morgan#369

chore(ci): npm-publish via reusable workflows by @sheplu in expressjs/morgan#334

docs: add ES modules import example by @aladi-debug in expressjs/morgan#352

docs: fix README lint errors by @UlisesGascon in expressjs/morgan#373

ci: use latest patch per Node.js major, add 23-26 by @UlisesGascon in expressjs/morgan#374

feat: pass objects through to streams in objectMode by @UlisesGascon in expressjs/morgan#375

feat: NO_COLOR env var removes color in dev format by @jonchurch in expressjs/morgan#377

New Contributors

@hanu-14 made their first contribution in expressjs/morgan#363

@sheplu made their first contribution in expressjs/morgan#369

@aladi-debug made their first contribution in expressjs/morgan#352

Full Changelog: expressjs/morgan@1.11.0...1.12.0

Changelog

Sourced from morgan's changelog.

1.12.1

Security fix for CVE-2026-87859(GHSA-9f6g-j8ch-79g4)

1.12.0

Security fix for CVE-2026-15603(GHSA-jxfw-x594-9x9m)

Allow format functions to return objects for streams in objectMode

Respect the NO_COLOR environment variable in the dev format

Commits

b1272e7 1.12.1 (#386)
4b695ed fix: escape double quotes in log fields
0f74eca build(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#384)
e399e3c build(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#383)
1e86b34 build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.37.9 (#382)
87c0afd build(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#381)
286b000 test: run CI on Windows and macOS (#379)
5a5902a docs: fix typos across documentation (#378)
063f084 1.12.0 (#376)
fbf9383 fix: escape all token values in log output
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new...

Description has been truncated

…rectory with 10 updates Bumps the production-dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.19.0` | `1.20.0` | | [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` | | [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.2` | `8.7.1` | | [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.4.0` | `11.4.1` | | [joi](https://github.com/hapijs/joi) | `18.2.5` | `18.2.9` | | [mariadb](https://github.com/mariadb-corporation/mariadb-connector-nodejs) | `3.5.3` | `3.5.4` | | [morgan](https://github.com/expressjs/morgan) | `1.11.0` | `1.12.1` | | [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.4` | `3.24.6` | | [socket.io](https://github.com/socketio/socket.io) | `4.8.3` | `4.8.4` | Updates `axios` from 1.19.0 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.19.0...v1.20.0) Updates `compression` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](expressjs/compression@v1.8.1...v1.8.2) Updates `express` from 5.2.1 to 5.3.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v5.2.1...v5.3.0) Updates `express-rate-limit` from 8.6.2 to 8.7.1 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.6.2...v8.7.1) Updates `fs-extra` from 11.4.0 to 11.4.1 - [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md) - [Commits](jprichardson/node-fs-extra@11.4.0...11.4.1) Updates `joi` from 18.2.5 to 18.2.9 - [Commits](hapijs/joi@v18.2.5...v18.2.9) Updates `mariadb` from 3.5.3 to 3.5.4 - [Release notes](https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases) - [Changelog](https://github.com/mariadb-corporation/mariadb-connector-nodejs/blob/main/CHANGELOG.md) - [Commits](mariadb-corporation/mariadb-connector-nodejs@3.5.3...3.5.4) Updates `morgan` from 1.11.0 to 1.12.1 - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.11.0...1.12.1) Updates `mysql2` from 3.23.4 to 3.24.6 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.23.4...v3.24.6) Updates `socket.io` from 4.8.3 to 4.8.4 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/socket.io@4.8.3...socket.io@4.8.4) --- updated-dependencies: - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: compression dependency-version: 1.8.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: express dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: express-rate-limit dependency-version: 8.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: fs-extra dependency-version: 11.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: joi dependency-version: 18.2.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: mariadb dependency-version: 3.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: morgan dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: mysql2 dependency-version: 3.24.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: socket.io dependency-version: 4.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-19T03:06:35Z

Assignees

The following users could not be added as assignees: FutureSolutionDev. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

coderabbitai · 2026-10-19T03:06:39Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: ffbdaad4-f8f9-40a5-a495-9fee46c55f2d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot · 2026-10-28T00:45:12Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 19, 2026

github-actions Bot added the server Changes in server/src/ label Oct 19, 2026

dependabot Bot closed this Oct 28, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-e5df4f9556 branch October 28, 2026 00:45

Navigation Menu

Repository navigation

chore(deps)(deps): bump the production-dependencies group across 1 directory with 10 updates - #154

chore(deps)(deps): bump the production-dependencies group across 1 directory with 10 updates#154
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-dependencies-e5df4f9556

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.20.0 — August 19, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

Changelog

v1.8.2

Important

What's Changed

New Contributors

1.8.2

v5.3.0

Highlights

🐞 Bug fixes

🚀 Improvements

5.3.0

🐞 Bug fixes

🚀 Improvements

v8.7.1

v8.7.0

11.4.1 / 2026-09-22

MariaDB Connector/Node.js 3.5.4

3.5.4 (Jul 2026)

Notable changes

Issues Fixed

3.5.4 (Jul 2026)

Notable changes

Issues Fixed

3.4.7 (Jul 2026)

Notable changes

Issues Fixed

3.3.4 (Jul 2026)

Notable changes

Issues Fixed

1.12.1

Important

What's Changed

New Contributors

1.12.0

What's Changed

New Contributors

1.12.1

1.12.0

Uh oh!

dependabot Bot commented on behalf of github Oct 19, 2026

Assignees

Labels

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading