Skip to content

chore(deps)(deps): bump the core-minor-patch group across 1 directory with 12 updates - #666

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nodyx-core/core-minor-patch-ad159cd5f9
Open

chore(deps)(deps): bump the core-minor-patch group across 1 directory with 12 updates#666
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nodyx-core/core-minor-patch-ad159cd5f9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the core-minor-patch group with 11 updates in the /nodyx-core directory:

Package From To
@fastify/cors 11.2.0 11.3.0
@fastify/multipart 10.0.0 10.1.1
music-metadata 11.13.0 11.15.0
nodemailer 9.0.3 9.0.6
otplib 13.4.1 13.5.0
pg 8.22.0 8.23.0
@types/pg 8.20.0 8.23.1
sharp 0.35.3 0.35.4
zod 4.4.3 4.5.4
@types/node 26.1.0 26.4.0
@vitest/coverage-v8 4.1.9 4.1.11

Updates @fastify/cors from 11.2.0 to 11.3.0

Release notes

Sourced from @​fastify/cors's releases.

v11.3.0

What's Changed

New Contributors

Full Changelog: fastify/fastify-cors@v11.2.0...v11.3.0

Commits
  • 2c60caa Bumped v11.3.0
  • cf4986e chore: bump @​types/node in the dev-dependencies-typescript group (#411)
  • 816d054 test: remove remaining tap-style assertions from vary tests (#410)
  • 20507ea chore(package.json): fix delvedor's personal url (#409)
  • 6fe85c4 docs(readme): update request origin link (#408)
  • 57bdc65 chore: bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group (#407)
  • a8ae57d chore: update depedabot setting
  • 4d34798 chore(.gitattributes): retain binary file eol style (#402)
  • 675ebef refactor(types): migrate from tsd to tstyche (#403)
  • ef25e0b ci: add lock-threads workflow (#401)
  • Additional commits viewable in compare view

Updates @fastify/multipart from 10.0.0 to 10.1.1

Release notes

Sourced from @​fastify/multipart's releases.

v10.1.1

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-multipart@v10.1.0...v10.1.1

v10.1.0

What's Changed

Full Changelog: fastify/fastify-multipart@v10.0.0...v10.1.0

Commits
  • 6c4478a Bumped v10.1.1
  • 4005714 Merge commit from fork
  • 556cdb1 Merge commit from fork
  • 25e8ccb chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#640)
  • d0d77b5 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#639)
  • c8e29f7 chore(.npmrc): add min-release-age
  • 3468939 chore: bump c8 from 11.0.0 to 12.0.0 (#635)
  • a2d1367 ci: pin actions to commit-hash
  • 0a8ab66 Bumped v10.1.0
  • a9d53e5 fix: update module version
  • Additional commits viewable in compare view

Updates music-metadata from 11.13.0 to 11.15.0

Release notes

Sourced from music-metadata's releases.

v11.15.0

Changes

🚀 Improvements

🔒 Security

🐛 Bug Fixes

📦 Dependencies

📦 NPM release

NPM release: music-metadata@11.15.0

v11.14.0

Changes

🎨 Improvements

🐛 Bug Fixes

📦 NPM release

NPM release: music-metadata@11.14.0

Commits
  • ec44cbb 11.15.0
  • fd345aa Harden ASF parser against infinite loop and malformed headers
  • 0e17e24 Bump @​types/node in the types group across 1 directory
  • 09fb6d9 Update to Biome 2.5.9
  • 972ed3e Bump c8 from 11.0.0 to 12.0.0
  • c9ea1da Upgrade TypeScript to 6.0.3 and add node types in tsconfig files
  • 783509b Switch coveralls to secret-less codecov
  • 403b857 Bump ip-address from 10.2.0 to 10.5.0
  • 9485cb8 Bump content-type from 2.0.0 to 2.1.0
  • 5c91795 Fix ASF header extension data size parsing
  • Additional commits viewable in compare view

Updates nodemailer from 9.0.3 to 9.0.6

Release notes

Sourced from nodemailer's releases.

v9.0.6

9.0.6 (2026-08-27)

Bug Fixes

  • addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
  • harden copies of user supplied keys and URL fetching (2f667f4)

v9.0.5

9.0.5 (2026-08-07)

Bug Fixes

  • ci: retrigger the workflows dropped during the Actions outage (85d16c1)
  • mailer: escape specials in List-* header comments (#1842) (75913bb)
  • mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
  • mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
  • mime: encode DEL in header parameters and List-* comments (cf69430)
  • mime: keep control chars out of the remaining header positions (5ed9d26)
  • mime: normalize an address parsed out of a string as well (63685f7)
  • mime: normalize an address so header and envelope agree (a9343b4)
  • mime: stop a header key callback and the dkim tags from injecting (b7d772e)

v9.0.4

9.0.4 (2026-08-04)

Bug Fixes

  • mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
  • mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
  • mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
  • mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
  • mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)
Changelog

Sourced from nodemailer's changelog.

9.0.6 (2026-08-27)

Bug Fixes

  • addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
  • harden copies of user supplied keys and URL fetching (2f667f4)

9.0.5 (2026-08-07)

Bug Fixes

  • ci: retrigger the workflows dropped during the Actions outage (85d16c1)
  • mailer: escape specials in List-* header comments (#1842) (75913bb)
  • mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
  • mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
  • mime: encode DEL in header parameters and List-* comments (cf69430)
  • mime: keep control chars out of the remaining header positions (5ed9d26)
  • mime: normalize an address parsed out of a string as well (63685f7)
  • mime: normalize an address so header and envelope agree (a9343b4)
  • mime: stop a header key callback and the dkim tags from injecting (b7d772e)

9.0.4 (2026-08-04)

Bug Fixes

  • mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
  • mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
  • mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
  • mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
  • mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)
Commits
  • 4e467a8 chore(master): release 9.0.6 (#1844)
  • e989a22 fix(addressparser): recover the addr-spec from an angle-addr holding whitespace
  • 7237b91 chore(deps): update dev dependencies
  • 34bc3d8 docs: reframe the EmailEngine README mentions
  • 2f667f4 fix: harden copies of user supplied keys and URL fetching
  • 742cff9 chore(master): release 9.0.5 (#1843)
  • 524f0af chore: apply prettier to the punycode decode loop
  • 63685f7 fix(mime): normalize an address parsed out of a string as well
  • d899213 test: cover the custom envelope path of every transport
  • c4daee0 chore(ci): trigger the workflows now that the Actions outage is over
  • Additional commits viewable in compare view

Updates otplib from 13.4.1 to 13.5.0

Release notes

Sourced from otplib's releases.

v13.5.0

What's Changed

Full Changelog: yeojz/otplib@v13.4.1...v13.5.0


Important behaviour change in this bugfix release.

[!NOTE] This is a bugfix release but has potentially breaking behaviour for library users passing invalid inputs (which is more likely in non-TypeScript or loosely-typed environments).

This release (#874) makes hash algorithm validation consistent and strict across all crypto plugins. Previously, an unrecognised algorithm string was handled differently by each plugin:

input noble node web
'SHA1' silently computed SHA-512 worked (OpenSSL alias tolerance) threw a raw TypeError
'totally-bogus' silently computed SHA-512 threw threw

All three now reject anything outside sha1/sha256/sha512 (case-insensitive, single-separator aliases like SHA-1 or sha_256 accepted) by throwing the new AlgorithmUnsupportedError, instead of silently substituting a different digest.

A library dependents passing a correctly-spelled algorithm name ('sha1', 'SHA1', 'sha-256', etc.) sees no change other than clearer, stricter errors on genuinely invalid input. In TypeScript-strict environments this is mostly moot as algorithm is typed as 'sha1' | 'sha256' | 'sha512', so a hardcoded typo like 'SHA1' won't compile. It can still surface if the value comes from outside the type system (e.g. JSON.parse, process.env, or an as HashAlgorithm cast).

If you were relying on noble's old silent fallback to SHA-512 for a misspelled or unrecognised algorithm string, tokens generated/verified that way will stop matching after upgrading with no error on the old side, just tokens that quietly stop verifying.

To recover

  • Change algorithm to sha512,
  • or re-enroll the affected accounts.

See "Existing enrollments stopped verifying after an upgrade" for details.

Commits

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

Commits

Updates @types/pg from 8.20.0 to 8.23.1

Commits

Updates sharp from 0.35.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

Commits
  • 7f1a0a2 Release v0.35.4
  • f927818 Upgrade to sharp-libvips v1.3.3
  • e802092 Prerelease v0.35.4-rc.0
  • e13eb2f CI: Fix wasm32 build (#4589)
  • a82a0b3 Upgrade to libvips v8.18.6
  • 8044fe4 Bound resize dimensions to coordinate limit
  • 147f859 Docs: changelog entries for #4578 #4584
  • ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
  • 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
  • ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
  • Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

  • 84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)
  • e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

  • e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema
  • 87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines
  • 99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)
  • e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open
  • 7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar
  • eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

  • a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
  • d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
  • 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
  • e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
  • fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
  • 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
  • 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

  • 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • e8e206f 4.5.4
  • 84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
  • 1a16102 4.5.3
  • eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
  • 7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
  • e3a695b docs(v4): record the email regex and container output-shape findings under Open
  • 99fce39 bench(v4): z.compile() against zod-compiler (#6499)
  • 87d6464 fix(docs): drop the OG description when the title wraps past two lines
  • e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
  • 9a193aa 4.5.2
  • Additional commits viewable in compare view

Updates @types/node from 26.1.0 to 26.4.0

Commits

Updates @vitest/coverage-v8 from 4.1.9 to 4.1.11

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.11

   🐞 Bug Fixes

  • Revive global concurrency limit for test lifecycle [backport to v4]  -  by

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 2, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: nodyx-core. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

… with 12 updates

Bumps the core-minor-patch group with 11 updates in the /nodyx-core directory:

| Package | From | To |
| --- | --- | --- |
| [@fastify/cors](https://github.com/fastify/fastify-cors) | `11.2.0` | `11.3.0` |
| [@fastify/multipart](https://github.com/fastify/fastify-multipart) | `10.0.0` | `10.1.1` |
| [music-metadata](https://github.com/Borewit/music-metadata) | `11.13.0` | `11.15.0` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.3` | `9.0.6` |
| [otplib](https://github.com/yeojz/otplib/tree/HEAD/packages/otplib) | `13.4.1` | `13.5.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.20.0` | `8.23.1` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.4` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.0` | `26.4.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.9` | `4.1.11` |



Updates `@fastify/cors` from 11.2.0 to 11.3.0
- [Release notes](https://github.com/fastify/fastify-cors/releases)
- [Commits](fastify/fastify-cors@v11.2.0...v11.3.0)

Updates `@fastify/multipart` from 10.0.0 to 10.1.1
- [Release notes](https://github.com/fastify/fastify-multipart/releases)
- [Commits](fastify/fastify-multipart@v10.0.0...v10.1.1)

Updates `music-metadata` from 11.13.0 to 11.15.0
- [Release notes](https://github.com/Borewit/music-metadata/releases)
- [Commits](Borewit/music-metadata@v11.13.0...v11.15.0)

Updates `nodemailer` from 9.0.3 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.3...v9.0.6)

Updates `otplib` from 13.4.1 to 13.5.0
- [Release notes](https://github.com/yeojz/otplib/releases)
- [Commits](https://github.com/yeojz/otplib/commits/v13.5.0/packages/otplib)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `@types/pg` from 8.20.0 to 8.23.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg)

Updates `sharp` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.4)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

Updates `@types/node` from 26.1.0 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 4.1.9 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

Updates `vitest` from 4.1.9 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: "@fastify/cors"
  dependency-version: 11.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: core-minor-patch
- dependency-name: "@fastify/multipart"
  dependency-version: 10.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: core-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-minor-patch
- dependency-name: "@types/pg"
  dependency-version: 8.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: core-minor-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: core-minor-patch
- dependency-name: music-metadata
  dependency-version: 11.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: core-minor-patch
- dependency-name: nodemailer
  dependency-version: 9.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: core-minor-patch
- dependency-name: otplib
  dependency-version: 13.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: core-minor-patch
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: core-minor-patch
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: core-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: core-minor-patch
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: core-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/nodyx-core/core-minor-patch-ad159cd5f9 branch from 1b376f7 to 98eae1a Compare September 2, 2026 21:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants