Skip to content
This repository was archived by the owner on Dec 23, 2025. It is now read-only.

build(deps): bump the npm_and_yarn group across 4 directories with 8 updates#421

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/repository-management/2024-organizational-monorepository/npm_and_yarn-8e9e07002b
Open

build(deps): bump the npm_and_yarn group across 4 directories with 8 updates#421
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/repository-management/2024-organizational-monorepository/npm_and_yarn-8e9e07002b

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Apr 29, 2025 •
edited
Loading

Bumps the npm_and_yarn group with 6 updates in the /repository-management/2024-organizational-monorepository directory:

Package From To
@nestjs/common 10.3.2 10.4.16
express 5.0.0-beta.1 5.0.0
jose 5.2.2 5.2.3
nanoid 5.0.5 5.0.9
rollup 4.12.0 4.22.4
@babel/runtime 7.23.9 7.27.0

Bumps the npm_and_yarn group with 3 updates in the /repository-management/2024-organizational-monorepository/apps/server directory: @nestjs/common, express and jose.
Bumps the npm_and_yarn group with 1 update in the /repository-management/2024-organizational-monorepository/experiments/20240218-node-bundlers directory: express.
Bumps the npm_and_yarn group with 2 updates in the /repository-management/2024-organizational-monorepository/experiments/20240221-typespec directory: braces and micromatch.

Updates @nestjs/common from 10.3.2 to 10.4.16

Release notes

Sourced from @​nestjs/common's releases.

v10.4.16

What's Changed

Full Changelog: nestjs/nest@v10.4.15...v10.4.16

v10.4.15 (2024-12-09)

Dependencies

v10.4.13 (2024-12-03)

Bug fixes

  • common
    • #14256 chore(common): Add type declaration for RawBody decorator with pipes (@​sapenlei)

Dependencies

Committers: 3

v10.4.12 (2024-11-29)

Bug fixes

Dependencies

... (truncated)

Commits
  • 6c8aec6 chore(@​nestjs) publish v10.4.16 release
  • 2b9e132 chore: update outdated tests, make file-type optional
  • cb0d650 chore: remove duplicate packages
  • 6196ab2 Merge branch 'Chathula-fix-nestjs-common-mime-validator'
  • 0ac7959 chore: minor tweaks
  • 312a54a Update packages/common/pipes/file/file-type.validator.ts
  • a28fc03 refactor(common): move back file type validator options type
  • 07b4b38 refactor(common): move file-type package to peer dependencies
  • 0b7af8a refactor(common): refactor code to use simple eval
  • 6953b7a fix(common): used eval import
  • Additional commits viewable in compare view

Updates express from 5.0.0-beta.1 to 5.0.0

Release notes

Sourced from express's releases.

5.0.0

Express v5.0.0

🎉 Express v5 is finally here! 🎉

After years of development, the long-awaited Express v5 has been officially released. This version focuses on simplifying the codebase, improving security, and dropping support for older Node.js versions to enable better performance and maintainability.

For detailed information, please check out the official Express v5 release blog post.

Most relevant details

Major Changes in v5

  • Node.js version support: Dropped support for Node.js versions before v18.
  • Routing changes: Updated to path-to-regexp@8.x, removing sub-expression regex patterns for security reasons (ReDoS mitigation).
  • Promise support: Middleware can now return rejected promises, caught by the router as errors.
  • body-parser changes: Several improvements including the ability to customize urlencoded body depth and defaulting extended to false.
  • Deprecated API methods removed: Removed old, deprecated API method signatures from Express v3/v4.

For a complete list of breaking changes and API deprecations, see the migration guide.

Security Updates

This release includes important security fixes, including improvements to prevent ReDoS attacks and mitigation for CVE-2024-45590. Full details can be found in the security release notes.

Migration

Be sure to check out our migration guide for instructions on how to update your applications from Express v4 to v5.

Security Guidance

For best practices, we recommend reviewing the Threat Model which outlines Express' approach to securing your applications, including tips for user input validation and other critical aspects.

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:
    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0
    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0

5.0.0-beta.3 / 2024-03-25

This incorporates all changes after 4.19.1 up to 4.19.2.

5.0.0-beta.2 / 2024-03-20

This incorporates all changes after 4.17.2 up to 4.19.1.

Commits
Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.


Updates jose from 5.2.2 to 5.2.3

Release notes

Sourced from jose's releases.

v5.2.3

Refactor

  • move iv generation and optional outputs around (05c4351)
Changelog

Sourced from jose's changelog.

5.2.3 (2024-03-07)

Refactor

  • move iv generation and optional outputs around (05c4351)
Commits
  • 259db54 chore(release): 5.2.3
  • ea8a76e chore: bump dev deps
  • 7cb2e3e build: only run release action on the latest major tag releases
  • f009cc1 chore: bump dev deps
  • dc0fe2e build(deps-dev): bump edge-runtime from 2.5.8 to 2.5.9 (#643)
  • 05c4351 refactor: move iv generation and optional outputs around
  • e054f05 test: stop testing JWE RSA1_5 Algorithm
  • e65299c chore: bump dev deps
  • 43ba25e chore: cleanup after release
  • See full diff in compare view

Updates nanoid from 5.0.5 to 5.0.9

Release notes

Sourced from nanoid's releases.

5.0.9

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

5.0.8

5.0.7

5.0.6

  • Fixed React Native support.
Changelog

Sourced from nanoid's changelog.

5.0.9

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

5.0.8

5.0.7

5.0.6

  • Fixed React Native support.
Commits

Updates rollup from 4.12.0 to 4.22.4

Release notes

Sourced from rollup's releases.

v4.22.4

4.22.4

2024-09-21

Bug Fixes

  • Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

v4.22.3

4.22.3

2024-09-21

Bug Fixes

  • Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (#5669)

Pull Requests

v4.22.2

4.22.2

2024-09-20

Bug Fixes

  • Revert fix for side effect free modules until other issues are investigated (#5667)

Pull Requests

v4.22.1

4.22.1

2024-09-20

Bug Fixes

  • Revert #5644 "stable chunk hashes" while issues are being investigated

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.22.4

2024-09-21

Bug Fixes

  • Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

4.22.3

2024-09-21

Bug Fixes

  • Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (#5669)

Pull Requests

4.22.2

2024-09-20

Bug Fixes

  • Revert fix for side effect free modules until other issues are investigated (#5667)

Pull Requests

4.22.1

2024-09-20

Bug Fixes

  • Revert #5644 "stable chunk hashes" while issues are being investigated

Pull Requests

... (truncated)

Commits

Updates @babel/runtime from 7.23.9 to 7.27.0

Release notes

Sourced from @​babel/runtime's releases.

v7.27.0 (2025-03-24)

Thanks @​ishchhabra and @​vovkasm for your first PRs!

👓 Spec Compliance

  • babel-generator, babel-parser

🚀 New Feature

  • babel-helper-create-class-features-plugin, babel-traverse, babel-types
  • babel-parser, babel-types
    • #17110 Add ImportAttributes to Standardized and move its parser test fixtures (@​JLHwung)
  • babel-generator
  • babel-parser, babel-template
  • babel-plugin-transform-typescript, babel-traverse
  • babel-parser
  • babel-types
    • #17162 feat(babel-types): Add support for BigInt literal conversion in valueToNode (@​ishchhabra)

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • babel-traverse
  • babel-helpers, babel-preset-typescript, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-cli
  • babel-plugin-transform-named-capturing-groups-regex, babel-types

🏃‍♀️ Performance

Committers: 5

v7.26.10 (2025-03-11)

... (truncated)

Changelog

Sourced from @​babel/runtime's changelog.

v7.27.0 (2025-03-24)

👓 Spec Compliance

  • babel-generator, babel-parser

🚀 New Feature

  • babel-helper-create-class-features-plugin, babel-traverse, babel-types
  • babel-parser, babel-types
    • #17110 Add ImportAttributes to Standardized and move its parser test fixtures (@​JLHwung)
  • babel-generator
  • babel-parser, babel-template
  • babel-plugin-transform-typescript, babel-traverse
  • babel-parser
  • babel-types
    • #17162 feat(babel-types): Add support for BigInt literal conversion in valueToNode (@​ishchhabra)

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • babel-traverse
  • babel-helpers, babel-preset-typescript, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-cli
  • babel-plugin-transform-named-capturing-groups-regex, babel-types

🏃‍♀️ Performance

v7.26.10 (2025-03-11)

👓 Spec Compliance

🐛 Bug Fix

... (truncated)

Commits

Updates @nestjs/common from 10.2.8 to 10.4.16

Release notes

Sourced from @​nestjs/common's releases.

v10.4.16

What's Changed

Full Changelog: nestjs/nest@v10.4.15...v10.4.16

v10.4.15 (2024-12-09)

Dependencies

v10.4.13 (2024-12-03)

Bug fixes

  • common
    • #14256 chore(common): Add type declaration for RawBody decorator with pipes (@​sapenlei)

Dependencies

Committers: 3

v10.4.12 (2024-11-29)

Bug fixes

Dependencies

... (truncated)

Commits
  • 6c8aec6 chore(@​nestjs) publish v10.4.16 release
  • 2b9e132 chore: update outdated tests, make file-type optional
  • cb0d650 chore: remove duplicate packages
  • 6196ab2 Merge branch 'Chathula-fix-nestjs-common-mime-validator'
  • 0ac7959 chore: minor tweaks
  • 312a54a Update packages/common/pipes/file/file-type.validator.ts
  • a28fc03 refactor(common): move back file type validator options type
  • 07b4b38 refactor(common): move file-type package to peer dependencies
  • 0b7af8a refactor(common): refactor code to use simple eval
  • 6953b7a fix(common): used eval import
  • Additional commits viewable in compare view

Updates express from 4.18.2 to 4.20.0

Release notes

Sourced from express's releases.

5.0.0

Express v5.0.0

🎉 Express v5 is finally here! 🎉

After years of development, the long-awaited Express v5 has been officially released. This version focuses on simplifying the codebase, improving security, and dropping support for older Node.js versions to enable better performance and maintainability.

For detailed information, please check out the official Express v5 release blog post.

Most relevant details

Major Changes in v5

  • Node.js version support: Dropped support for Node.js versions before v18.
  • Routing changes: Updated to path-to-regexp@8.x, removing sub-expression regex patterns for security reasons (ReDoS mitigation).
  • Promise support: Middleware can now return rejected promises, caught by the router as errors.
  • body-parser changes: Several improvements including the ability to customize urlencoded body depth and defaulting extended to false.
  • Deprecated API methods removed: Removed old, deprecated API method signatures from Express v3/v4.

For a complete list of breaking changes and API deprecations, see the migration guide.

Security Updates

This release includes important security fixes, including improvements to prevent ReDoS attacks and mitigation for CVE-2024-45590. Full details can be found in the security release notes.

Migration

Be sure to check out our migration guide for instructions on how to update your applications from Express v4 to v5.

Security Guidance

For best practices, we recommend reviewing the Threat Model which outlines Express' approach to securing your applications, including tips for user input validation and other critical aspects.

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0
    • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
  • change:
    • res.clearCookie will ignore user provided maxAge and expires options
  • deps: cookie-signature@^1.2.1
  • deps: debug@4.3.6
  • deps: merge-descriptors@^2.0.0
  • deps: serve-static@^2.1.0
  • deps: qs@6.13.0
  • deps: accepts@^2.0.0
  • deps: mime-types@^3.0.0
    • application/javascript => text/javascript
  • deps: type-is@^2.0.0
  • deps: content-disposition@^1.0.0
  • deps: finalhandler@^2.0.0
  • deps: fresh@^2.0.0
  • deps: body-parser@^2.0.1
  • deps: send@^1.1.0

5.0.0-beta.3 / 2024-03-25

This incorporates all changes after 4.19.1 up to 4.19.2.

5.0.0-beta.2 / 2024-03-20

This incorporates all changes after 4.17.2 up to 4.19.1.

Commits
Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.


Updates jose from 5.10.0 to 6.0.10

Release notes

Sourced from jose's releases.

v5.2.3

Refactor

  • move iv generation and optional outputs around (05c4351)
Changelog

Sourced from jose's changelog.

5.2.3 (2024-03-07)

Refactor

  • move iv generation and optional outputs around (05c4351)
Commits
  • 259db54 chore(release): 5.2.3
  • ea8a76e chore: bump dev deps
  • 7cb2e3e build: only run release action on the latest major tag releases
  • f009cc1 chore: bump dev deps
  • dc0fe2e build(deps-dev): bump edge-runtime from 2.5.8 to 2.5.9 (#643)
  • 05c4351 refactor: move iv generation and optional outputs around
  • e054f05 test: stop testing JWE RSA1_5 Algorithm
  • e65299c chore: bump dev deps

@dependabot
build(deps): bump the npm_and_yarn group across 4 directories with 8 …
ceb3f3b 
…updates

Bumps the npm_and_yarn group with 6 updates in the /repository-management/2024-organizational-monorepository directory:

| Package | From | To |
| --- | --- | --- |
| [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `10.3.2` | `10.4.16` |
| [express](https://github.com/expressjs/express) | `5.0.0-beta.1` | `5.0.0` |
| [jose](https://github.com/panva/jose) | `5.2.2` | `5.2.3` |
| [nanoid](https://github.com/ai/nanoid) | `5.0.5` | `5.0.9` |
| [rollup](https://github.com/rollup/rollup) | `4.12.0` | `4.22.4` |
| [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.23.9` | `7.27.0` |

Bumps the npm_and_yarn group with 3 updates in the /repository-management/2024-organizational-monorepository/apps/server directory: [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common), [express](https://github.com/expressjs/express) and [jose](https://github.com/panva/jose).
Bumps the npm_and_yarn group with 1 update in the /repository-management/2024-organizational-monorepository/experiments/20240218-node-bundlers directory: [express](https://github.com/expressjs/express).
Bumps the npm_and_yarn group with 2 updates in the /repository-management/2024-organizational-monorepository/experiments/20240221-typespec directory: [braces](https://github.com/micromatch/braces) and [micromatch](https://github.com/micromatch/micromatch).


Updates `@nestjs/common` from 10.3.2 to 10.4.16
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v10.4.16/packages/common)

Updates `express` from 5.0.0-beta.1 to 5.0.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.0.0-beta.1...v5.0.0)

Updates `jose` from 5.2.2 to 5.2.3
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v5.2.2...v5.2.3)

Updates `nanoid` from 5.0.5 to 5.0.9
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.0.5...5.0.9)

Updates `rollup` from 4.12.0 to 4.22.4
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.12.0...v4.22.4)

Updates `@babel/runtime` from 7.23.9 to 7.27.0
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.27.0/packages/babel-runtime)

Updates `@nestjs/common` from 10.2.8 to 10.4.16
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v10.4.16/packages/common)

Updates `express` from 4.18.2 to 4.20.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.0.0-beta.1...v5.0.0)

Updates `jose` from 5.10.0 to 6.0.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v5.2.2...v5.2.3)

Updates `express` from 5.0.0-beta.1 to 5.0.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.0.0-beta.1...v5.0.0)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `micromatch` from 4.0.5 to 4.0.8
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/micromatch@4.0.5...4.0.8)

---
updated-dependencies:
- dependency-name: "@nestjs/common"
  dependency-version: 10.4.16
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-version: 5.0.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: jose
  dependency-version: 5.2.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 5.0.9
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.22.4
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@babel/runtime"
  dependency-version: 7.27.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@nestjs/common"
  dependency-version: 10.4.16
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-version: 4.20.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: jose
  dependency-version: 6.0.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-version: 5.0.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: micromatch
  dependency-version: 4.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 29, 2025
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github May 7, 2025

Dependabot couldn't find a package.json. Because of this, Dependabot cannot update this pull request.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants