Skip to content

Bump the all-dependencies group across 1 directory with 9 updates - #90

Merged
murraco merged 1 commit into
masterfrom
dependabot/npm_and_yarn/all-dependencies-c5e13d3fdd
Aug 24, 2026
Merged

Bump the all-dependencies group across 1 directory with 9 updates#90
murraco merged 1 commit into
masterfrom
dependabot/npm_and_yarn/all-dependencies-c5e13d3fdd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 9 updates in the / directory:

Package From To
body-parser 1.20.6 2.3.0
express 4.22.2 5.2.1
joi 17.13.4 17.13.6
mysql2 3.23.2 3.23.4
uuid 14.0.1 14.0.2
chai 4.5.0 6.2.2
eslint 10.8.0 10.8.1
globals 17.8.0 17.11.0
mocha 11.7.6 11.8.0

Updates body-parser from 1.20.6 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

v2.2.2

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: use static exports instead of lazy getters to improve ESM compatibility
  • feat: add subpath exports for individual parsers
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
  • deps:
    • content-type@^2.0.0
    • http-errors@^2.0.1
    • iconv-lite^0.7.2
    • qs@^6.15.2
    • raw-body@^3.0.2
    • type-is@^2.1.0

2.2.2 / 2026-01-07

  • deps: qs@^6.14.1
  • refactor(json): simplify strict mode error string construction

2.2.1 / 2025-11-24

  • Security fix for GHSA-wqch-xfxh-vrr4
  • deps:
    • type-is@^2.0.1
    • iconv-lite@^0.7.0
      • Handle split surrogate pairs when encoding UTF-8
      • Avoid false positives in encodingExists by using prototype-less objects
    • raw-body@^3.0.1
    • debug@^4.4.3

2.2.0 / 2025-03-27

  • refactor: normalize common options for all parsers
  • deps:
    • iconv-lite@^0.6.3

2.1.0 / 2025-02-10

  • deps:
    • type-is@^2.0.0
    • debug@^4.4.0
    • Removed destroy
  • refactor: prefix built-in node module imports

... (truncated)

Commits
  • d0f2ace 2.3.0 (#735)
  • 7d03f2f chore: updated deps to latest (#733)
  • 8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
  • 32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
  • ff0f6b9 docs: update outdated reference to MDN docs (#730)
  • 14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
  • 37f36a2 deps: update content-type and type-is (#728)
  • e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
  • e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
  • a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
  • Additional commits viewable in compare view

Updates express from 4.22.2 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

5.0.1 / 2024-10-08

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0

... (truncated)

Commits

Updates joi from 17.13.4 to 17.13.6

Commits
  • 850be1e 17.13.6
  • 9faeecc Merge pull request #3139 from hapijs/chore/backport-messages-proto
  • 8d0b808 fix: prevent messages proto injection
  • 566e73f 17.13.5
  • 3f3907c Merge pull request #3135 from hapijs/chore/backport-rename-proto
  • 172ecec fix: prevent proto on renames
  • 30766a2 chore: deny prototype pollution in objects by restoring prototype
  • See full diff in compare view

Updates mysql2 from 3.23.2 to 3.23.4

Release notes

Sourced from mysql2's releases.

v3.23.4

3.23.4 (2026-08-19)

Bug Fixes

  • keep leading zeros in TIME fractional seconds (#4481) (3cccf4a)
  • typings: align callback Pool and PoolConnection types with runtime (#4478) (8b1f829)

v3.23.3

3.23.3 (2026-08-10)

Bug Fixes

  • honor query-level namedPlaceholders as false (#4460) (20f732b)
  • keep connectTimeout active until the handshake completes (#4458) (508a731)
  • pool: give each pooled connection its own config copy (#4473) (361d232)
  • pool: propagate query dispatch errors instead of throwing (#4459) (7ce6943)
  • replace denque with a local ring buffer queue (#4472) (88f3d9e)
Changelog

Sourced from mysql2's changelog.

3.23.4 (2026-08-19)

Bug Fixes

  • keep leading zeros in TIME fractional seconds (#4481) (3cccf4a)
  • typings: align callback Pool and PoolConnection types with runtime (#4478) (8b1f829)

3.23.3 (2026-08-10)

Bug Fixes

  • honor query-level namedPlaceholders as false (#4460) (20f732b)
  • keep connectTimeout active until the handshake completes (#4458) (508a731)
  • pool: give each pooled connection its own config copy (#4473) (361d232)
  • pool: propagate query dispatch errors instead of throwing (#4459) (7ce6943)
  • replace denque with a local ring buffer queue (#4472) (88f3d9e)
Commits
  • 4df6770 chore(master): release 3.23.4 (#4479)
  • 3cccf4a fix: keep leading zeros in TIME fractional seconds (#4481)
  • 5bf517a build(deps-dev): bump tsx from 4.23.11 to 4.23.12 (#4482)
  • 8b1f829 fix(typings): align callback Pool and PoolConnection types with runtime (#4478)
  • bc30155 chore(master): release 3.23.3 (#4462)
  • 88f3d9e fix: replace denque with a local ring buffer queue (#4472)
  • c9ed1ca ci: add tests to idle sweeper cleanup on pool end (#4477)
  • 495c08f ci: add tests to handshake error greeting (#4476)
  • 61bea50 ci: add tests to large packet write chunking (#4475)
  • 361d232 fix(pool): give each pooled connection its own config copy (#4473)
  • Additional commits viewable in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Commits
  • fd59f02 chore(main): release 14.0.2 (#967)
  • f3c564e docs: point the Node support permalink at the CI version matrix (#974)
  • b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
  • 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
  • ea83515 docs: cleanup API summary (#968)
  • ac36860 chore: pin publint version in CI (#966)
  • a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
  • See full diff in compare view

Updates chai from 4.5.0 to 6.2.2

Release notes

Sourced from chai's releases.

v6.2.2

What's Changed

New Contributors

Full Changelog: chaijs/chai@v6.2.1...v6.2.2

v6.2.1

What's Changed

New Contributors

Full Changelog: chaijs/chai@v6.2.0...v6.2.1

... (truncated)

Commits
  • 814172d chore(deps): update dependency esbuild to v0.27.2 (#1759)
  • b38c22b chore: add legal-comments=none option (#1756)
  • 180d4cc chore(deps): update dependencies to v9.39.2 (#1757)
  • 678cd00 chore(deps): update dependencies (#1755)
  • c8fb100 chore(deps): update dependency prettier to v3.7.3 (#1754)
  • d63c74e chore(deps): update dependency eslint-plugin-jsdoc to v61.4.1 (#1751)
  • 243bf86 fix: avoid BigInt literal in closeTo for runtime compat (#1748)
  • d8b0395 chore(deps): update actions/checkout action to v6 (#1749)
  • 7e1e247 build(deps): bump glob from 10.4.5 to 10.5.0 (#1747)
  • b25e5d8 chore(deps): update dependency eslint-plugin-jsdoc to v61.2.1 (#1746)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chai since your current version.


Updates eslint from 10.8.0 to 10.8.1

Release notes

Sourced from eslint's releases.

v10.8.1

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

  • 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
  • 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
  • 5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
  • ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
  • f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
  • 1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
  • d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)
  • 65a6519 chore: add allowScripts field to package.json (#21092) (GiHoon Noh)
  • 22e5256 ci: add triage:no label to Dependabot PRs (#21141) (lumir)
  • 55c9038 ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])
  • 7280e78 chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])
  • eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#21156) (Francesco Trotta)
  • 60a178d chore: update ecosystem plugins (#21150) (ESLint Bot)
  • f9f61dc test: add error locations to no-unreachable (#21151) (JIYEON)
  • d086293 test: add error locations to no-undef (#21147) (JIYEON)
  • cc01b67 test: add error locations to no-useless-catch (#21144) (devoil)
  • 688e75e chore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)
  • 7c1e175 test: add error locations to require-await (#21145) (Grit)
  • 588a26d test: add error locations to no-extra-label (#21139) (dongkyu lee)
  • 059aa89 test: add error locations to no-useless-concat (#21140) (dongkyu lee)
  • 5a452a8 test: add error locations to no-const-assign (#21138) (dongkyu lee)
Commits

Description has been truncated

@dependabot
Bump the all-dependencies group across 1 directory with 9 updates
6959c0d 
Bumps the all-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.6` | `2.3.0` |
| [express](https://github.com/expressjs/express) | `4.22.2` | `5.2.1` |
| [joi](https://github.com/hapijs/joi) | `17.13.4` | `17.13.6` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.2` | `3.23.4` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` |
| [chai](https://github.com/chaijs/chai) | `4.5.0` | `6.2.2` |
| [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` |
| [globals](https://github.com/sindresorhus/globals) | `17.8.0` | `17.11.0` |
| [mocha](https://github.com/mochajs/mocha) | `11.7.6` | `11.8.0` |



Updates `body-parser` from 1.20.6 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.6...v2.3.0)

Updates `express` from 4.22.2 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v4.22.2...v5.2.1)

Updates `joi` from 17.13.4 to 17.13.6
- [Commits](hapijs/joi@v17.13.4...v17.13.6)

Updates `mysql2` from 3.23.2 to 3.23.4
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.23.2...v3.23.4)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v14.0.1...v14.0.2)

Updates `chai` from 4.5.0 to 6.2.2
- [Release notes](https://github.com/chaijs/chai/releases)
- [Changelog](https://github.com/chaijs/chai/blob/main/History.md)
- [Commits](chaijs/chai@v4.5.0...v6.2.2)

Updates `eslint` from 10.8.0 to 10.8.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.0...v10.8.1)

Updates `globals` from 17.8.0 to 17.11.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.8.0...v17.11.0)

Updates `mocha` from 11.7.6 to 11.8.0
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/v11.8.0/CHANGELOG.md)
- [Commits](mochajs/mocha@v11.7.6...v11.8.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: joi
  dependency-version: 17.13.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: mysql2
  dependency-version: 3.23.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: chai
  dependency-version: 6.2.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: globals
  dependency-version: 17.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: mocha
  dependency-version: 11.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 24, 2026
@murraco
murraco merged commit 92c1a77 into master Aug 24, 2026
0 of 2 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/all-dependencies-c5e13d3fdd branch August 24, 2026 02:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@murraco