Skip to content

Bump the npm-dependencies group across 1 directory with 9 updates - #108

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-ca2aedeb22
Closed

Bump the npm-dependencies group across 1 directory with 9 updates#108
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-ca2aedeb22

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 9 updates in the / directory:

Package From To
axios 1.20.0 1.21.0
eslint 10.12.0 10.14.0
eslint-config-next 16.4.0 16.4.3
express-rate-limit 8.7.1 8.7.2
lru-cache 11.5.2 11.5.3
js-yaml 5.4.3 5.5.0
ws 8.22.0 8.22.1
zod 4.6.5 4.6.7
@types/node 26.6.5 26.6.6

Updates axios from 1.20.0 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • aa54a5e docs: remove cancelled sponsors from README (#11369)
  • e6b79d9 chore(release): prepare release 1.21.0 (#11346)
  • fceeb10 chore(deps-dev): bump the development_dependencies group with 4 updates (#11342)
  • 7d15df3 docs: refresh sponsor data (#11341)
  • 8d8e844 docs: correct interceptor options and request lifecycle guide (#11335)
  • 326843a test(no-proxy): cover the request-hostname path with a long dotted host (#11235)
  • e5195ec feat(core): expose request duration on the response (#11214)
  • 8d415e6 fix(headers): bind matcher callbacks to the headers instance (#11216)
  • b16dd77 fix(xhr): remove progress event listeners on request completion (#11225)
  • 790b2ca chore(deps): bump the github-actions group with 3 updates (#11323)
  • Additional commits viewable in compare view

Updates eslint from 10.12.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

  • d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

  • 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
  • 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
  • 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
  • 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
  • 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
  • cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
  • 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

  • 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
  • dab466e docs: Update README (GitHub Actions Bot)
  • 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
  • 7697550 docs: Update README (GitHub Actions Bot)
  • 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
  • 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
  • e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

  • 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
  • 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
  • a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
  • 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
  • 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
  • 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
  • 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

v10.13.0

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

  • b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
  • 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
  • 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
  • b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
  • 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])

... (truncated)

Commits
  • 12cbff4 10.14.0
  • 6b696e7 Build: changelog update for 10.14.0
  • 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
  • 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
  • 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
  • dab466e docs: Update README
  • 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
  • 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
  • 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
  • 161558a fix: handle LS, PS and empty hashbang comments (#21419)
  • Additional commits viewable in compare view

Updates eslint-config-next from 16.4.0 to 16.4.3

Release notes

Sourced from eslint-config-next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
  • [lts-active] test: Pin react-virtualized (#100545)
  • [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
  • [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
  • [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

What's Changed

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

High:

Commits

Updates express-rate-limit from 8.7.1 to 8.7.2

Release notes

Sourced from express-rate-limit's releases.

v8.7.2

You can view the changelog here.

Commits
  • 3fa4577 8.7.2
  • 7427a5c v8.7.2 changelog
  • da5b115 fix: don't un-count requests that complete after the window resets (#707)
  • 28331a7 docs: Restore hyphenated anchor links for error codes (#705)
  • 404bc3a docs: show how to reset the key of an IPv6 client (#704)
  • e0b3886 docs: fix inverted skipSuccessfulRequests and ipv6Subnet descriptions (#703)
  • 97bc073 chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 (#702)
  • 991c16d chore(deps): bump ip-address from 10.7.1 to 10.7.3 (#699)
  • a6ace2a chore(deps-dev): bump the development-dependencies group with 9 updates (#698)
  • 518a0d5 chore(deps): bump ip-address from 10.7.0 to 10.7.1 (#696)
  • See full diff in compare view

Updates lru-cache from 11.5.2 to 11.5.3

Commits

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

  • Updated argparse to v3.
  • Updated development dependencies.

Fixed

  • Correct percent-encoding of shorthand and verbatim tags.
  • Reject ,, ], and } at the start of block plain scalars, #801.
  • Report the exact position of non-printable characters in errors, #801.
Commits
  • cb62b2d 5.5.0 released
  • 87aed90 Deps bump
  • 3aec511 Fix error positions for non-printable characters, #801
  • 11aa483 Reject flow indicators at the start of block plain scalars, #801
  • 339d8e0 Refactor tag encoder and decoder to match the YAML specification
  • See full diff in compare view

Updates ws from 8.22.0 to 8.22.1

Release notes

Sourced from ws's releases.

8.22.1

Bug fixes

  • The path of IPC URLs is no longer truncated at : (#2344).

Other notable changes

Commits
  • c18a80a [dist] 8.22.1
  • 2ab3d3e [minor] Use http.websocket{M,Unm}ask() if possible (#2347)
  • c9efa88 [ci] Test on node 27
  • aa91518 [test] Skip test on Node.js versions where it does not apply (#2340)
  • b54ca10 [fix] Do not truncate the URL path of IPC URLs at : (#2344)
  • 85319a7 [minor] Prevent Sender.frame() from returning empty chunks
  • See full diff in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why
Commits
  • b500a2e 4.6.7
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
  • 529f78d 4.6.6
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
  • c42596b release: hold the run on the release-approval environment until the staged ve...
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 74304ce release: stage npm versions instead of publishing them (#6622)
  • Additional commits viewable in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 4, 2026
@dependabot
Bump the npm-dependencies group across 1 directory with 9 updates
445e152 
Bumps the npm-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.20.0` | `1.21.0` |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.14.0` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.0` | `16.4.3` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.7.1` | `8.7.2` |
| [lru-cache](https://github.com/isaacs/node-lru-cache) | `11.5.2` | `11.5.3` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.3` | `5.5.0` |
| [ws](https://github.com/websockets/ws) | `8.22.0` | `8.22.1` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` |



Updates `axios` from 1.20.0 to 1.21.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.20.0...v1.21.0)

Updates `eslint` from 10.12.0 to 10.14.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.14.0)

Updates `eslint-config-next` from 16.4.0 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-config-next)

Updates `express-rate-limit` from 8.7.1 to 8.7.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.7.1...v8.7.2)

Updates `lru-cache` from 11.5.2 to 11.5.3
- [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-lru-cache@v11.5.2...v11.5.3)

Updates `js-yaml` from 5.4.3 to 5.5.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.4.3...5.5.0)

Updates `ws` from 8.22.0 to 8.22.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.22.0...8.22.1)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: axios
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: eslint
  dependency-version: 10.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: eslint-config-next
  dependency-version: 16.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: js-yaml
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: lru-cache
  dependency-version: 11.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: ws
  dependency-version: 8.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-dependencies-ca2aedeb22 branch from 46c23d2 to 445e152 Compare November 5, 2026 03:24
@dependabot @github

dependabot Bot commented on behalf of github Nov 6, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 6, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-dependencies-ca2aedeb22 branch November 6, 2026 03:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants