Bump the npm-dependencies group across 1 directory with 10 updates by dependabot[bot] · Pull Request #110 · fosrl/pangolin-node

dependabot · 2026-11-06T03:24:44Z

Bumps the npm-dependencies group with 10 updates in the / directory:

Package	From	To
axios	`1.20.0`	`1.21.0`
eslint	`10.12.0`	`10.14.0`
eslint-config-next	`16.4.0`	`16.4.4`
express-rate-limit	`8.7.1`	`8.7.3`
lru-cache	`11.5.2`	`11.5.3`
js-yaml	`5.4.3`	`5.5.0`
semver	`7.8.5`	`7.8.6`
ws	`8.22.0`	`8.22.1`
zod	`4.6.5`	`4.6.7`
@types/node	`26.6.5`	`26.6.6`

Updates axios from 1.20.0 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)

UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)

Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)

Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)

URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)

Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)

Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)

Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)

XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)

HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)

TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)

Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)

Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)

Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)

Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)

Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)

Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)

Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

@lazerg (#11194)

@QIU-Guanzong (#11228)

@Iams4kura (#11125)

@vjymisal0 (#11179)

@jarrensj (#11238)

@LineGu (#11132)

@luantaraschi (#11134)

@Cyberhet (#11284)

@nyxst4ck (#11138)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)

UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)

Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)

Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)

URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)

Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)

Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)

Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)

XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)

HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)

TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)

Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)

Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)

Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)

Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)

Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)

Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)

Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

@lazerg (#11194)

@QIU-Guanzong (#11228)

@Iams4kura (#11125)

@vjymisal0 (#11179)

@jarrensj (#11238)

@LineGu (#11132)

@luantaraschi (#11134)

@Cyberhet (#11284)

@nyxst4ck (#11138)

... (truncated)

Commits

aa54a5e docs: remove cancelled sponsors from README (#11369)
e6b79d9 chore(release): prepare release 1.21.0 (#11346)
fceeb10 chore(deps-dev): bump the development_dependencies group with 4 updates (#11342)
7d15df3 docs: refresh sponsor data (#11341)
8d8e844 docs: correct interceptor options and request lifecycle guide (#11335)
326843a test(no-proxy): cover the request-hostname path with a long dotted host (#11235)
e5195ec feat(core): expose request duration on the response (#11214)
8d415e6 fix(headers): bind matcher callbacks to the headers instance (#11216)
b16dd77 fix(xhr): remove progress event listeners on request completion (#11225)
790b2ca chore(deps): bump the github-actions group with 3 updates (#11323)
Additional commits viewable in compare view

Updates eslint from 10.12.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)

827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)

161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)

6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)

9155e14 fix: Update @humanfs/node dependency version (#21434) (Nicholas C. Zakas)

cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)

5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)

dab466e docs: Update README (GitHub Actions Bot)

97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)

7697550 docs: Update README (GitHub Actions Bot)

0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)

0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)

e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)

6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])

a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)

67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)

276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])

449724e chore: update ecosystem plugins (#21420) (ESLint Bot)

8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

v10.13.0

Features

48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)

a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)

66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

4783a68 docs: Update README (GitHub Actions Bot)

43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])

95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)

317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)

b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)

47b7063 chore: update dependency @eslint/json to ^2.1.1 (#21398) (renovate[bot])

... (truncated)

Commits

12cbff4 10.14.0
6b696e7 Build: changelog update for 10.14.0
0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
0f94f47 docs: remove zh-hans from docs language switcher (#21437)
dab466e docs: Update README
827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
161558a fix: handle LS, PS and empty hashbang comments (#21419)
Additional commits viewable in compare view

Updates eslint-config-next from 16.4.0 to 16.4.4

Release notes

Sourced from eslint-config-next's releases.

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

[lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)

[lts-active] Reload on missed Turbopack startup CSS updates (#100619)

[lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)

[lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)

[lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)

[lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)

[lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @icyJoseph, @mischnic, @wbinnssmith, @lukesandberg, and @eps1lon for helping!

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[lts-active] Fix extensionless Google font URLs in both bundlers (#100277)

[lts-active] Don't load the app-page runtime in proxy.ts (#100423)

[lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)

[lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)

[lts-active] test: Pin react-virtualized (#100545)

[lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)

[lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)

[lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @mischnic, @lukesandberg, @acdlite, @eps1lon, and @sokra for helping!

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

... (truncated)

Commits

b175f52 v16.4.4
29bbeab v16.4.3
2864b17 v16.4.2
7217011 v16.4.1
See full diff in compare view

Updates express-rate-limit from 8.7.1 to 8.7.3

Release notes

Sourced from express-rate-limit's releases.

v8.7.3

You can view the changelog here.

v8.7.2

You can view the changelog here.

Commits

b0d0c1f 8.7.3
307ca31 v8.7.3 changelog
34729c8 fix: forward async rate limit handler errors (#708)
3fa4577 8.7.2
7427a5c v8.7.2 changelog
da5b115 fix: don't un-count requests that complete after the window resets (#707)
28331a7 docs: Restore hyphenated anchor links for error codes (#705)
404bc3a docs: show how to reset the key of an IPv6 client (#704)
e0b3886 docs: fix inverted skipSuccessfulRequests and ipv6Subnet descriptions (#703)
97bc073 chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 (#702)
Additional commits viewable in compare view

Updates lru-cache from 11.5.2 to 11.5.3

Commits

7e71a1f 11.5.3
98b553f add react-native export condition with no diagnostics_channel
See full diff in compare view

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

Updated argparse to v3.

Updated development dependencies.

Fixed

Correct percent-encoding of shorthand and verbatim tags.

Reject ,, ], and } at the start of block plain scalars, #801.

Report the exact position of non-printable characters in errors, #801.

Commits

cb62b2d 5.5.0 released
87aed90 Deps bump
3aec511 Fix error positions for non-printable characters, #801
11aa483 Reject flow indicators at the start of block plain scalars, #801
339d8e0 Refactor tag encoder and decoder to match the YAML specification
See full diff in compare view

Updates semver from 7.8.5 to 7.8.6

Release notes

Sourced from semver's releases.

v7.8.6

7.8.6 (2026-11-02)

Bug Fixes

69b305d #918 improve range parsing performance (#918) (@reggi, @Copilot)

Chores

7257c14 #917 cover comparator normalization (#917) (@reggi, @Copilot)

Changelog

Sourced from semver's changelog.

7.8.6 (2026-11-02)

Bug Fixes

69b305d #918 improve range parsing performance (#918) (@reggi, @Copilot)

Chores

7257c14 #917 cover comparator normalization (#917) (@reggi, @Copilot)

Commits

b37b033 chore: release 7.8.6 (#940)
69b305d fix: improve range parsing performance (#918)
7257c14 chore: cover comparator normalization (#917)
See full diff in compare view

Updates ws from 8.22.0 to 8.22.1

Release notes

Sourced from ws's releases.

8.22.1

Bug fixes

The path of IPC URLs is no longer truncated at : (#2344).

Other notable changes

http.websocketMask() and http.websocketUnmask() are now used instead of the bufferutil variants when available (2ab3d3e5).

Sender.frame() no longer returns empty chunks (85319a72).

Commits

c18a80a [dist] 8.22.1
2ab3d3e [minor] Use http.websocket{M,Unm}ask() if possible (#2347)
c9efa88 [ci] Test on node 27
aa91518 [test] Skip test on Node.js versions where it does not apply (#2340)
b54ca10 [fix] Do not truncate the URL path of IPC URLs at : (#2344)
85319a7 [minor] Prevent Sender.frame() from returning empty chunks
See full diff in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (

Bumps the npm-dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.20.0` | `1.21.0` | | [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.14.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.0` | `16.4.4` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.7.1` | `8.7.3` | | [lru-cache](https://github.com/isaacs/node-lru-cache) | `11.5.2` | `11.5.3` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.3` | `5.5.0` | | [semver](https://github.com/npm/node-semver) | `7.8.5` | `7.8.6` | | [ws](https://github.com/websockets/ws) | `8.22.0` | `8.22.1` | | [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` | Updates `axios` from 1.20.0 to 1.21.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.20.0...v1.21.0) Updates `eslint` from 10.12.0 to 10.14.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.14.0) Updates `eslint-config-next` from 16.4.0 to 16.4.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.4/packages/eslint-config-next) Updates `express-rate-limit` from 8.7.1 to 8.7.3 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.7.1...v8.7.3) Updates `lru-cache` from 11.5.2 to 11.5.3 - [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md) - [Commits](isaacs/node-lru-cache@v11.5.2...v11.5.3) Updates `js-yaml` from 5.4.3 to 5.5.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.4.3...5.5.0) Updates `semver` from 7.8.5 to 7.8.6 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](npm/node-semver@v7.8.5...v7.8.6) Updates `ws` from 8.22.0 to 8.22.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.22.0...8.22.1) Updates `zod` from 4.6.5 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.7) Updates `@types/node` from 26.6.5 to 26.6.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: axios dependency-version: 1.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: eslint dependency-version: 10.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: eslint-config-next dependency-version: 16.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: express-rate-limit dependency-version: 8.7.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: lru-cache dependency-version: 11.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: js-yaml dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: semver dependency-version: 7.8.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: ws dependency-version: 8.22.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 6, 2026

Navigation Menu

Repository navigation

Bump the npm-dependencies group across 1 directory with 10 updates - #110

Bump the npm-dependencies group across 1 directory with 10 updates#110
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-908bb1af54

dependabot Bot commented on behalf of github Nov 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.21.0 — October 21, 2026

⚠️ Breaking Changes & Deprecations

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.21.0 — October 21, 2026

⚠️ Breaking Changes & Deprecations

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v10.14.0

Features

Bug Fixes

Documentation

Chores

v10.13.0

Features

Bug Fixes

Documentation

Chores

v16.4.4

Core Changes

Credits

v16.4.3

Core Changes

Credits

v16.4.2

What's Changed

v8.7.3

v8.7.2

[5.5.0] - 2026-10-16

Changed

Fixed

v7.8.6

7.8.6 (2026-11-02)

Bug Fixes

Chores

7.8.6 (2026-11-02)

Bug Fixes

Chores

8.22.1

Bug fixes

Other notable changes

v4.6.7

Commits:

v4.6.6

Commits:

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Nov 6, 2026 •

edited

Loading