Skip to content

chore(deps): bump the npm-minor-and-patch group in /registry-api with 5 updates - #1174

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/registry-api/npm-minor-and-patch-828b92894a
Open

chore(deps): bump the npm-minor-and-patch group in /registry-api with 5 updates#1174
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/registry-api/npm-minor-and-patch-828b92894a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group in /registry-api with 5 updates:

Package From To
dotenv 18.0.5 18.0.7
express 5.2.1 5.3.0
mongoose 9.10.4 9.11.1
@typescript-eslint/eslint-plugin 8.71.0 8.71.1
@typescript-eslint/parser 8.71.0 6.21.0

Updates dotenv from 18.0.5 to 18.0.7

Changelog

Sourced from dotenv's changelog.

18.0.7 (2026-10-09)

Changed

  • Treat undefined settings like quiet: true as null rather than falsey (#1070)
  • CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

  • Use smarter parseBoolean not Boolean() to fix override (#1069)
Commits
  • 2953207 18.0.7
  • 9944723 make more readable for undefined -> null
  • d455db0 Merge branch 'master' of github.com:motdotla/dotenv
  • e411e02 changelog
  • 6237c35 Merge pull request #1070 from Utkarsh-Singhal-26/fix/ignore-undefined-config-...
  • 9af8c28 Merge pull request #1071 from himanshu748/fix-cli-env-quiet
  • c7161c6 fix(cli): honor quiet settings loaded from .env
  • 3990466 fix: ignore undefined options so they don't mask DOTENV_* env settings
  • 5d7cc39 18.0.6
  • 750ba03 changelog
  • Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates mongoose from 9.10.4 to 9.11.1

Release notes

Sourced from mongoose's releases.

9.11.1 / 2026-10-07

  • fix(document): call recursive toObject() when setting a path to a nested object #16571
  • fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS
  • fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml
  • fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai
  • fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai
  • fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny
  • fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1
  • fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1
  • types(schema): treat Int32 paths as number #16565 #16564 lazerg
  • types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

  • feat: use MongoDB Node.js driver 7.7.x #16550
  • feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar
  • fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411
  • types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519
  • docs(guide): use async/await instead of removed callbacks #16566 joi-agent
  • test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506
Changelog

Sourced from mongoose's changelog.

9.11.1 / 2026-10-07

  • fix(document): call recursive toObject() when setting a path to a nested object #16571
  • fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS
  • fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml
  • fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai
  • fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai
  • fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny
  • fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1
  • fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1
  • types(schema): treat Int32 paths as number #16565 #16564 lazerg
  • types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

  • feat: use MongoDB Node.js driver 7.7.x #16550
  • feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar
  • fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411
  • types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519
  • docs(guide): use async/await instead of removed callbacks #16566 joi-agent
  • test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506
Commits
  • 754c8a7 chore: release 9.11.1
  • 2ce6c11 Merge pull request #16571 from Automattic/vkarpov15/gh-16530
  • 09ba87e cycle detection
  • 756fb10 Merge pull request #16569 from jeremyml/fix/flatten-decimals-shallow-toobject...
  • 0e30afa Merge pull request #16565 from lazerg/fix/issue-16564-int32-number-type
  • 171e39b Merge pull request #16563 from IbrahimHafez1/codex/query-cursor-initializatio...
  • f8f151f fix(document): call recursive toObject() when setting a path to a nested object
  • 8f49a3b Merge pull request #16562 from IbrahimHafez1/codex/query-cursor-destroy-close
  • 87902a7 Merge pull request #16559 from aipd506/fix/bulkwrite-update-typing-16545
  • beec597 Merge pull request #16558 from giaBaoJS/fix/array-filters-skip-unknown-path
  • Additional commits viewable in compare view

Updates @typescript-eslint/eslint-plugin from 8.71.0 to 8.71.1

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

  • eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
  • eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
  • eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
  • eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
  • eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
  • eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
  • eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
  • project-service: throttle cleanup when opening files (#12934)
  • type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.71.1 (2026-10-05)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
  • eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
  • eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
  • eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
  • eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
  • eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
  • eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • d57b8da chore(release): publish 8.71.1
  • e8593b2 fix(eslint-plugin): [no-unnecessary-type-parameters] count instantiated mappe...
  • 2211d3f fix(eslint-plugin): [prefer-optional-chain] check the constrained type (#12953)
  • ba9c0f1 fix(eslint-plugin): [no-confusing-void-expression] don't autofix when declare...
  • 466d739 fix(eslint-plugin): [no-unsafe-enum-assignment] skip identical types and boun...
  • e8c170f fix(eslint-plugin): [require-array-sort-compare] use array argument type cons...
  • effa652 fix(eslint-plugin): [no-unused-vars] report usedOnlyAsType for partially expo...
  • 9fbab43 fix(eslint-plugin): [no-misused-promises] skip argument checks for calls with...
  • 3ab28b1 chore(eslint-plugin): re-enable plugin-test-formatting in all tests (#12950)
  • See full diff in compare view

Updates @typescript-eslint/parser from 8.71.0 to 6.21.0

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.71.0 (2026-09-28)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.0 (2026-09-07)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.67.0 (2026-08-10)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.66.0 (2026-08-03)

... (truncated)

Commits
Attestation changes

This version has no provenance attestation, while the previous version (8.71.0) was attested. Review the package versions before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-minor-and-patch group
8ff70b7 
Bumps the npm-minor-and-patch group in /registry-api with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.5` | `18.0.7` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [mongoose](https://github.com/Automattic/mongoose) | `9.10.4` | `9.11.1` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.71.0` | `8.71.1` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.71.0` | `6.21.0` |


Updates `dotenv` from 18.0.5 to 18.0.7
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.5...v18.0.7)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `mongoose` from 9.10.4 to 9.11.1
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@9.10.4...9.11.1)

Updates `@typescript-eslint/eslint-plugin` from 8.71.0 to 8.71.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.1/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.71.0 to 6.21.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v6.21.0/packages/parser)

---
updated-dependencies:
- dependency-name: dotenv
  dependency-version: 18.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: mongoose
  dependency-version: 9.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.71.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 6.21.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies javascript Pull requests that update javascript code labels Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants