Skip to content

deps(server): bump the server-minor-and-patch group across 1 directory with 11 updates - #248

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/server/server-minor-and-patch-a41c9da465
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/server/server-minor-and-patch-a41c9da465

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the server-minor-and-patch group with 11 updates in the /server directory:

Package From To
@fastify/cookie 11.1.2 11.1.5
@fastify/helmet 13.1.0 13.2.0
@fastify/rate-limit 11.2.0 11.2.1
@fastify/sensible 6.0.4 6.0.7
@node-saml/node-saml 5.1.0 5.2.0
fastify 5.11.0 5.12.7
pg 8.22.0 8.23.1
pino 10.3.1 10.4.0
vite 8.2.0 8.3.5
vitest 4.1.10 4.1.12
nodemailer 9.0.3 9.1.1

Updates @fastify/cookie from 11.1.2 to 11.1.5

Release notes

Sourced from @​fastify/cookie's releases.

v11.1.5

What's Changed

New Contributors

Full Changelog: fastify/fastify-cookie@v11.1.4...v11.1.5

v11.1.4

What's Changed

New Contributors

Full Changelog: fastify/fastify-cookie@v11.1.3...v11.1.4

v11.1.3

What's Changed

New Contributors

Full Changelog: fastify/fastify-cookie@v11.1.2...v11.1.3

Commits
  • a96460b Bumped v11.1.5
  • 7f9551e fix: forward custom encode option to cookie serializer (#377)
  • 4f47cf1 Bumped v11.1.4
  • c07e472 fix: forward encode option to cookie serializer (#374)
  • d27beb4 perf(signer): add early delimiter check in unsign to avoid redundant HMAC com...
  • 576e0dd Bumped v11.1.3
  • 19a1307 ci: enable trusted publishing releases
  • 104aca7 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#368)
  • c838334 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#369)
  • 916538c chore(.npmrc): add min-release-age
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/cookie since your current version.


Updates @fastify/helmet from 13.1.0 to 13.2.0

Release notes

Sourced from @​fastify/helmet's releases.

v13.2.0

What's Changed

  • fix: inherit global enableCSPNonces on routes with custom helmet options by @​TalhaHunter101 in fastify/fastify-helmet#324
    • Note: routes with custom helmet options now inherit the global enableCSPNonces setting. If you relied on nonces being disabled on those routes, set { helmet: { enableCSPNonces: false } } on the route.

New Contributors

Full Changelog: fastify/fastify-helmet@v13.1.2...v13.2.0

v13.1.2

What's Changed

New Contributors

Full Changelog: fastify/fastify-helmet@v13.1.1...v13.1.2

v13.1.1

What's Changed

Full Changelog: fastify/fastify-helmet@v13.1.0...v13.1.1

Commits
  • f715808 Bumped v13.2.0
  • 6ab142a fix: inherit global enableCSPNonces on routes with custom helmet options (#324)
  • 6e3234f Bumped v13.1.2
  • 4b0aac4 ci: enable trusted publishing releases
  • 8854d49 Bumped v13.1.1
  • c4bbcb2 chore(.npmrc): add min-release-age (#319)
  • 8406fa8 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#321)
  • d8da457 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#320)
  • 655cd3a chore: bump c8 from 11.0.0 to 12.0.0 (#317)
  • 928d9b5 ci: pin actions to commit-hash
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/helmet since your current version.


Updates @fastify/rate-limit from 11.2.0 to 11.2.1

Release notes

Sourced from @​fastify/rate-limit's releases.

v11.2.1

What's Changed

New Contributors

Full Changelog: fastify/fastify-rate-limit@v11.2.0...v11.2.1

Commits
  • 4cc3d70 Bumped v11.2.1
  • f2dc235 ci: enable trusted publishing releases
  • 78a7d41 chore: Bump ioredis from 5.11.1 to 6.0.0 (#461)
  • a7fbb20 chore: Bump fastify/workflows/.github/workflows/lock-threads.yml (#460)
  • 258e4ae chore: Bump fastify/workflows/.github/workflows/plugins-ci-redis.yml (#459)
  • 25aaf33 chore(.npmrc): add min-release-age
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/rate-limit since your current version.


Updates @fastify/sensible from 6.0.4 to 6.0.7

Release notes

Sourced from @​fastify/sensible's releases.

v6.0.7

What's Changed

New Contributors

Full Changelog: fastify/fastify-sensible@v6.0.6...v6.0.7

v6.0.6

What's Changed

New Contributors

Full Changelog: fastify/fastify-sensible@v6.0.5...v6.0.6

v6.0.5

What's Changed

New Contributors

Full Changelog: fastify/fastify-sensible@v6.0.4...v6.0.5

Commits
  • e3908a1 Bumped v6.0.7
  • 9362646 ci: enable trusted publishing releases
  • d313b33 Bumped v6.0.6
  • 233a70d fix(request): support variadic request.is types (#235)
  • 7974df0 Bumped v6.0.5
  • 4d03816 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#234)
  • e189219 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#233)
  • 15806e0 chore(.npmrc): add min-release-age
  • d07f3d9 ci: pin actions to commit-hash
  • 05910cb chore: bump @​types/node in the dev-dependencies-typescript group (#230)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/sensible since your current version.


Updates @node-saml/node-saml from 5.1.0 to 5.2.0

Release notes

Sourced from @​node-saml/node-saml's releases.

v5.2.0

  • Check idpIssuer on a login Response and its assertion, and reject a message with more than one Issuer (#515) (71b30b2)
  • Warn before v6 rejects legacy decryption algorithms (#513) (521e9c8)
  • Update dependencies without raising the Node floor (#510) (3eb12e0)
  • Reject replayed assertions by remembering their IDs when asked to, and stop skipping a maxAssertionAgeMs deadline at the epoch (#506) (8ee2835)
  • Export from the root every type its API uses, and document lib/ as internal (#461) (a0a0123)
  • Warn when a response lacks a bearer confirmation, or a Recipient or Destination that matches (#505) (32f5b9d)
  • Check a POST-binding LogoutResponse's status and issuer, as the Redirect binding does (#500) (d3eb48a)
  • Reject a parsed query whose RelayState is not the one in the signed query string (#498) (ad08542)
  • Deprecate overriding the methods that validate an incoming message (#504) (b3f7f5f)
  • Give the attribute-value and multiple-reference warnings a migration path (#509) (49833a9)
  • Accept decryptionPvk as Base64, read Base64 PKCS #1 private keys, and correct the error for a key that can't be read (#447) (a4abbdc)
  • Retire the request a signed NoPassive response answers (#501) (d195c63)
  • Read the status of a signed response from the bytes its signature covers (#502) (dcb358a)
  • Sign the Redirect-binding parameters as they are sent (#496) (15ac505)
  • Process the Redirect-binding parameters that were verified, and deprecate the parsed-query argument (#494) (f74b332)
  • Add the sha256-mgf1 signature algorithm (RSASSA-PSS) (#479) (f5b76d0)
  • Make metadataContactPerson and metadataOrganization follow the metadata schema, and warn about request Extensions that SAML does not allow (#485) (afdb88a)
  • Add support for AttributeConsumingService in SAML metadata (#396) (8773120)
  • Warn when generateServiceProviderMetadata signs with an omitted or unrecognized algorithm (#478) (6b38d03)
  • Warn when a signature is ignored for having more than one reference (#477) (9c9d381)
  • Remove the tests of deprecation warnings (#482) (68dbb9a)
  • Group tests and deprecations in the changelog (#475) (ae42526)
  • Update xml-crypto to 6.3.3 (#476) (345199d)
  • Add tests for the signature ambiguity rejections, the SHA-1 fallback, and error statuses (#460) (ef8fef1)
  • Document turning on debug output with NODE_DEBUG=node-saml (#462) (3af74a3)
  • Remove normalizeNewlines now that xmldom normalizes line endings (#455) (ba5a887)
  • Export InMemoryCacheProvider from the package root (#454) (6762d23)
  • Stop unsigned input from retiring a pending request ID (#448) (bb96591)
  • Warn when an attribute reaches the profile with no usable value (#427) (c9b213d)
  • Read the verified bytes in validatePostRequestAsync, not the raw ones (#440) (081ba99)
  • Enforce SubjectConfirmationData NotOnOrAfter in every validateInResponseTo mode (#439) (fd7d8db)
  • Stop trusting an unsigned Response's InResponseTo (#434) (95e628e)
  • Deprecate Profile.getSamlResponseXml() (#426) (503b512)
  • Warn when a security-relevant default was never chosen, and close InResponseTo replay gaps (#425) (5a47bc4)
  • Warn when a redirect-binding logout message carries no signature (#420) (2616706)
  • Update xml-crypto to 6.3 and delegate PEM handling to it (#409) (ac1a318)
  • Docs: audit the README for accuracy and structure (#430) (b10fce3)
  • Deprecate the unused host argument on the getAuthorize* methods (#421) (9b07731)
  • Docs: add AGENTS.md and CLAUDE.md (#416) (91efe9a)
  • Update dependencies and fix the CI matrix (#417) (a78dfa3)
  • Security: remove debug dependency (#406) (25c434a)
  • Update to support Node strip-only TypeScript support (#407) (b6fc8b6)
Changelog

Sourced from @​node-saml/node-saml's changelog.

5.2.0 (2026-10-26)

🚀 Minor Changes

  • [security] Reject replayed assertions by remembering their IDs when asked to, and stop skipping a maxAssertionAgeMs deadline at the epoch #506
  • Export from the root every type its API uses, and document lib/ as internal #461
  • Accept decryptionPvk as Base64, read Base64 PKCS #1 private keys, and correct the error for a key that can't be read #447
  • Add the sha256-mgf1 signature algorithm (RSASSA-PSS) #479
  • Make metadataContactPerson and metadataOrganization follow the metadata schema, and warn about request Extensions that SAML does not allow #485
  • Add support for AttributeConsumingService in SAML metadata #396
  • Warn when generateServiceProviderMetadata signs with an omitted or unrecognized algorithm #478
  • [security] Warn when a signature is ignored for having more than one reference #477
  • Export InMemoryCacheProvider from the package root #454
  • Warn when an attribute reaches the profile with no usable value #427
  • [security] Warn when a security-relevant default was never chosen, and close InResponseTo replay gaps #425
  • [security] Warn when a redirect-binding logout message carries no signature #420

⚠️ Deprecations

  • [security] Warn before v6 rejects legacy decryption algorithms #513
  • [security] Warn when a response lacks a bearer confirmation, or a Recipient or Destination that matches #505
  • [security] Deprecate overriding the methods that validate an incoming message #504
  • Give the attribute-value and multiple-reference warnings a migration path #509
  • [security] Process the Redirect-binding parameters that were verified, and deprecate the parsed-query argument #494
  • [security] Deprecate Profile.getSamlResponseXml() #426
  • Deprecate the unused host argument on the getAuthorize* methods #421

🔗 Dependencies

  • Update dependencies without raising the Node floor #510
  • Update xml-crypto to 6.3.3 #476
  • Update dependencies and fix the CI matrix #417
  • security: remove debug dependency #406

🐛 Bug Fixes

  • [security] Check idpIssuer on a login Response and its assertion, and reject a message with more than one Issuer #515
  • [security] Check a POST-binding LogoutResponse's status and issuer, as the Redirect binding does #500
  • [security] Reject a parsed query whose RelayState is not the one in the signed query string #498
  • [security] Retire the request a signed NoPassive response answers #501
  • [security] Read the status of a signed response from the bytes its signature covers #502
  • Sign the Redirect-binding parameters as they are sent #496
  • [security] Stop unsigned input from retiring a pending request ID #448
  • [security] Read the verified bytes in validatePostRequestAsync, not the raw ones #440
  • [security] Enforce SubjectConfirmationData NotOnOrAfter in every validateInResponseTo mode #439
  • [security] Stop trusting an unsigned Response's InResponseTo #434
  • Update xml-crypto to 6.3 and delegate PEM handling to it #409

📚 Documentation

... (truncated)

Commits
  • 3d083fb Release 5.2.0
  • 71b30b2 Check idpIssuer on a login Response and its assertion, and reject a message...
  • 521e9c8 Warn before v6 rejects legacy decryption algorithms (#513)
  • 3eb12e0 Update dependencies without raising the Node floor (#510)
  • 8ee2835 Reject replayed assertions by remembering their IDs when asked to, and stop s...
  • a0a0123 Export from the root every type its API uses, and document lib/ as internal...
  • 32f5b9d Warn when a response lacks a bearer confirmation, or a Recipient or Destinati...
  • d3eb48a Check a POST-binding LogoutResponse's status and issuer, as the Redirect bind...
  • ad08542 Reject a parsed query whose RelayState is not the one in the signed query s...
  • b3f7f5f Deprecate overriding the methods that validate an incoming message (#504)
  • Additional commits viewable in compare view

Updates fastify from 5.11.0 to 5.12.7

Release notes

Sourced from fastify's releases.

v5.12.7

Full Changelog: fastify/fastify@v5.12.6...v5.12.7

v5.12.6

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

v5.12.5

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

What's Changed

... (truncated)

Commits
  • 9f40003 Bumped v5.12.7
  • 16469b9 Bumped v5.12.6
  • 63496de [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 (#7094)
  • 20b55d4 [Backport 5.x] fix: remove error when HTTP QUERY request has empty body (#7060)
  • 38d2b63 [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of...
  • 3241fbd [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/...
  • 1a46b1b [Backport 5.x] perf: use a FIFO cache for parsed content-types (#7072)
  • 7e06676 [Backport 5.x] fix: resolve reply.mediaType from raw response headers (#7067)
  • 1b0eb32 [Backport 5.x] perf: avoid resetting the level of request child loggers (#7058)
  • a636a10 [Backport 5.x] perf: decode string bodies once instead of per chunk (#7053)
  • Additional commits viewable in compare view

Updates pg from 8.22.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

pg@8.23.0

Commits
  • 0980cef Publish
  • 2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
  • 7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
  • 9683053 fix(pg): do not treat Sync as connection ending (#3772)
  • 4589038 fix: validate server certificate against host when connecting to an IP addres...
  • 9808955 cleanup: Fix typo in comment
  • 2b02f64 fix: avoid mutating query config (#3720)
  • 0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
  • 2991480 Deprecate serializing invalid Dates (#3731)
  • c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
  • Additional commits viewable in compare view

Updates pino from 10.3.1 to 10.4.0

Release notes

Sourced from pino's releases.

v10.4.0

What's Changed

…y with 11 updates

Bumps the server-minor-and-patch group with 11 updates in the /server directory:

| Package | From | To |
| --- | --- | --- |
| [@fastify/cookie](https://github.com/fastify/fastify-cookie) | `11.1.2` | `11.1.5` |
| [@fastify/helmet](https://github.com/fastify/fastify-helmet) | `13.1.0` | `13.2.0` |
| [@fastify/rate-limit](https://github.com/fastify/fastify-rate-limit) | `11.2.0` | `11.2.1` |
| [@fastify/sensible](https://github.com/fastify/fastify-sensible) | `6.0.4` | `6.0.7` |
| [@node-saml/node-saml](https://github.com/node-saml/node-saml) | `5.1.0` | `5.2.0` |
| [fastify](https://github.com/fastify/fastify) | `5.11.0` | `5.12.7` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.1` |
| [pino](https://github.com/pinojs/pino) | `10.3.1` | `10.4.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.0` | `8.3.5` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.12` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.3` | `9.1.1` |



Updates `@fastify/cookie` from 11.1.2 to 11.1.5
- [Release notes](https://github.com/fastify/fastify-cookie/releases)
- [Commits](fastify/fastify-cookie@v11.1.2...v11.1.5)

Updates `@fastify/helmet` from 13.1.0 to 13.2.0
- [Release notes](https://github.com/fastify/fastify-helmet/releases)
- [Commits](fastify/fastify-helmet@v13.1.0...v13.2.0)

Updates `@fastify/rate-limit` from 11.2.0 to 11.2.1
- [Release notes](https://github.com/fastify/fastify-rate-limit/releases)
- [Commits](fastify/fastify-rate-limit@v11.2.0...v11.2.1)

Updates `@fastify/sensible` from 6.0.4 to 6.0.7
- [Release notes](https://github.com/fastify/fastify-sensible/releases)
- [Commits](fastify/fastify-sensible@v6.0.4...v6.0.7)

Updates `@node-saml/node-saml` from 5.1.0 to 5.2.0
- [Release notes](https://github.com/node-saml/node-saml/releases)
- [Changelog](https://github.com/node-saml/node-saml/blob/master/CHANGELOG.md)
- [Commits](node-saml/node-saml@v5.1.0...v5.2.0)

Updates `fastify` from 5.11.0 to 5.12.7
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.11.0...v5.12.7)

Updates `pg` from 8.22.0 to 8.23.1
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg)

Updates `pino` from 10.3.1 to 10.4.0
- [Release notes](https://github.com/pinojs/pino/releases)
- [Commits](pinojs/pino@v10.3.1...v10.4.0)

Updates `vite` from 8.2.0 to 8.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

Updates `vitest` from 4.1.10 to 4.1.12
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/vitest)

Updates `nodemailer` from 9.0.3 to 9.1.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.3...v9.1.1)

---
updated-dependencies:
- dependency-name: "@fastify/cookie"
  dependency-version: 11.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-minor-and-patch
- dependency-name: "@fastify/helmet"
  dependency-version: 13.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-and-patch
- dependency-name: "@fastify/rate-limit"
  dependency-version: 11.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-minor-and-patch
- dependency-name: "@fastify/sensible"
  dependency-version: 6.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-minor-and-patch
- dependency-name: "@node-saml/node-saml"
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-and-patch
- dependency-name: fastify
  dependency-version: 5.12.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-and-patch
- dependency-name: pg
  dependency-version: 8.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-and-patch
- dependency-name: pino
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: server-minor-and-patch
- dependency-name: vitest
  dependency-version: 4.1.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: server-minor-and-patch
- dependency-name: nodemailer
  dependency-version: 9.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 2, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: server. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@strix-security

strix-security Bot commented Nov 2, 2026

Copy link
Copy Markdown

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants