Skip to content

Bump the dependencies group with 18 updates#1309

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/dependencies-5ca05dac1d
Open

Bump the dependencies group with 18 updates#1309
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/dependencies-5ca05dac1d

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 27, 2026

Bumps the dependencies group with 18 updates:

Package From To
@vitest/coverage-v8 4.1.4 4.1.5
npm-check-updates 21.0.2 22.0.1
typescript-eslint 8.58.2 8.59.0
vitest 4.1.4 4.1.5
dockerode 4.0.10 5.0.0
undici 7.24.7 8.1.0
@azure/cosmos 4.9.2 4.9.3
@azure/storage-blob 12.29.1 12.31.0
@azure/storage-queue 12.28.1 12.29.0
@clickhouse/client 1.18.2 1.18.3
msw 2.13.4 2.13.6
@kurrent/kurrentdb-client 1.1.1 1.1.2
@aws-sdk/client-s3 3.1032.0 3.1037.0
mariadb 3.4.5 3.5.2
mongoose 9.4.1 9.5.0
mssql 12.3.1 12.5.0
mysql2 3.22.1 3.22.2
toxiproxy-node-client 4.0.0 4.1.0

Updates @vitest/coverage-v8 from 4.1.4 to 4.1.5

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.5

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates npm-check-updates from 21.0.2 to 22.0.1

Release notes

Sourced from npm-check-updates's releases.

v22.0.1

What's Changed

Full Changelog: raineorshine/npm-check-updates@v22.0.0...v22.0.1

v22.0.0

Breaking Changes

--cooldown now falls back to the greatest non-prerelease version rather than skipping the upgrade entirely when the latest version falls within the cooldown window.

  • This only affects --cooldown (or inferred cooldown from min-release-age/minimumReleaseAge/npmMinimalAgeGate).
  • This only affects --target latest (which is the default).

⚠️ WARNING

In rare circumstances, it is now possible for ncu --cooldown 10 to install a version that was never published to latest. This is because the npm registry does not store a history of versions published to the latest dist-tag. It is impossible to fall back to an earlier latest version, because there is no record of it. However, we do have a list of all published versions, and it's likely that a boring version like 1.0.1 was published to latest at some point. Versions like 1.0.1-pre.0, 1.0.1-beta, 1.0.1-build.58157394, etc will be ignored, as you would expect.

While npm-check-updates typically takes a conservative approach to version upgrades, following semver exactly and only upgrading to the latest version, falling back to the highest version outside the cooldown window is clearly the more intuitive behavior, and this outweighs the few cases where the results would be undesirable. The discussion in #1556 and the large amount of confusion since the initial release of --cooldown attest to this.

How to opt out of the new behavior

You can opt out of the new behavior by using --target "@latest". This forces a strict upgrade (or downgrade) to the latest tag only, without any fallback behavior.

For granular control, use a custom ncurc function to set the target or disable cooldown for a single package.

What's Changed

New Contributors

Full Changelog: raineorshine/npm-check-updates@v21.0.3...v22.0.0

v21.0.3

What's Changed

Full Changelog: raineorshine/npm-check-updates@v21.0.2...v21.0.3

Commits
  • 28b5fcb 22.0.1
  • 127c552 fix: suppress cooldown config log messages when JSON output is active (#1692)
  • 7c62657 CHANGELOG
  • c94174d 22.0.0
  • 36e1fd2 feat(cooldown): fall back to greatest passing version when latest is within c...
  • 3641100 build: stub cosmiconfig's typescript dependency to reduce bundle size by 8MB ...
  • b44ec68 Update dependencies (#1685)
  • 2ceac56 Bump @​typescript-eslint/eslint-plugin from 8.58.2 to 8.59.0 (#1682)
  • 9025296 Bump @​typescript-eslint/parser from 8.58.2 to 8.59.0 (#1681)
  • 6803c3e Bump vite from 8.0.8 to 8.0.9 (#1680)
  • Additional commits viewable in compare view

Updates typescript-eslint from 8.58.2 to 8.59.0

Release notes

Sourced from typescript-eslint's releases.

v8.59.0

8.59.0 (2026-04-20)

🚀 Features

  • eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#11789)

❤️ Thank You

  • Ulrich Stark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.59.0 (2026-04-20)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates vitest from 4.1.4 to 4.1.5

Release notes

Sourced from vitest's releases.

v4.1.5

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • e399846 chore: release v4.1.5
  • 7dc6d54 Revert "fix: respect diff config options in soft assertions (#8696)"
  • 9787ded fix: respect diff config options in soft assertions (#8696)
  • 325463a fix(ast-collect): recognize _vi_import prefix in static test discovery (#10...
  • 0e0ff41 feat(coverage): istanbul to support instrumenter option (#10119)
  • 663b99f fix: alias agent reporter to minimal (#10157)
  • 122c25b fix: fix vi.defineHelper called as object method (#10163)
  • 6abd557 feat(api): make test-specification options writable (#10154)
  • 596f739 fix: project color label on html reporter (#10142)
  • 9423dc0 fix: --project negation excludes browser instances (#10131)
  • Additional commits viewable in compare view

Updates dockerode from 4.0.10 to 5.0.0

Release notes

Sourced from dockerode's releases.

v5.0.0

What's Changed

Full Changelog: apocas/dockerode@v4.0.10...v5.0.0

Commits
  • d8968eb chore: update chai to version 4.5.0 in package.json and package-lock.json
  • 62ded54 fix: downgrade chai to 6.2.0 and mocha to 11.7.0
  • 3f6f9c4 Update devDependencies: Upgrade chai to 6.2.2 and mocha to 11.7.5
  • c37ff26 Merge pull request #828 from apocas/dependabot/npm_and_yarn/protobufjs-7.5.5
  • 0f1a049 Bump protobufjs from 7.3.2 to 7.5.5
  • c073e27 fix: update version to 5.0.0 and remove uuid dependency
  • 8c4b4cd fix: update version to 4.0.12 and downgrade uuid dependency to 10.0.0
  • 7e6f694 fix: update version to 4.0.12 and downgrade uuid dependency to 10.0.0
  • 8124962 fix: update version to 4.0.11 and bump uuid dependency to 14.0.0
  • 7118249 Merge pull request #826 from apocas/dependabot/npm_and_yarn/picomatch-2.3.2
  • Additional commits viewable in compare view

Updates undici from 7.24.7 to 8.1.0

Release notes

Sourced from undici's releases.

v8.1.0

What's Changed

Full Changelog: nodejs/undici@v8.0.3...v8.1.0

v8.0.3

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.0.2...v8.0.3

v8.0.2

What's Changed

Full Changelog: nodejs/undici@v8.0.1...v8.0.2

... (truncated)

Commits

Updates @azure/cosmos from 4.9.2 to 4.9.3

Commits

Updates @azure/storage-blob from 12.29.1 to 12.31.0

Commits
  • c95f5d9 Post release automated changes for appconfiguration releases (#37234)
  • 19253d6 [EngSys] automatic pnpm update (#37266)
  • 9ba0f8a chore(instrumentation): bump @​opentelemetry/instrumentation (#37250)
  • 4eed3b9 Add invoke support for web pubsub client (#36750)
  • af673f5 Parse azd JSON output for cleaner AzureDeveloperCliCredential error messages ...
  • 2cf94a9 Simplify client authentication section in README (#37257)
  • 184e2b9 [Search] Separate Stable & Preview Test Structure (#37238)
  • 0ea4456 [Monitor-OpenTelemetry] Implement Fix for Mismatched API Versions (#37258)
  • 84c473e Update @​azure/storage-blob storage-common dependency to ^12.3.0 (#37259)
  • ad1b88f [Identity] Remove samples (#37242)
  • Additional commits viewable in compare view

Updates @azure/storage-queue from 12.28.1 to 12.29.0

Commits
  • 6e2a1d0 Update version for STG00 Release (#37038)
  • d33c492 [docs] teach AI agents about special snippets.spec.ts (#36481)
  • 0d11eb6 Sync eng/common directory with azure-sdk-tools for PR 13560 (#37033)
  • 348d979 Sync eng/common directory with azure-sdk-tools for PR 13556 (#37028)
  • aa58f75 add webSearchStream and fix imageGeneration (#37023)
  • a692f5f [Identity] Restarted Identity MI Test in Weekly Pipeline (#36097)
  • 4c12684 Sync eng/common directory with azure-sdk-tools for PR 13555 (#37032)
  • 7d814b6 [EngSys] upgrade dependency openai to 6.16.0 (#37027)
  • 7510363 [azure monitor opentelemetry exporter] Update autogenerated client to use lat...
  • 64d4796 Reference Azure SDK MCP in AGENTS.md (#37026)
  • Additional commits viewable in compare view

Updates @clickhouse/client from 1.18.2 to 1.18.3

Changelog

Sourced from @​clickhouse/client's changelog.

1.18.3

Improvements

  • Added keep_alive.eagerly_destroy_stale_sockets option (Node.js only, default: false). When enabled, sockets that have been idle for longer than idle_socket_ttl are destroyed immediately before each request, rather than waiting for the idle timeout to fire. This helps reclaim stale sockets during event loop delays, where the timeout callback may not run on time.
const client = createClient({
  keep_alive: {
    enabled: true,
    idle_socket_ttl: 2500,
    eagerly_destroy_stale_sockets: true,
  },
})
  • Added auto-detection and warning when request_timeout is high (> 60 seconds) but progress headers are not configured. Long-running queries may fail with socket hang-up errors if they exceed the load balancer idle timeout. The client now warns users to enable send_progress_in_http_headers and http_headers_progress_interval_ms settings to prevent such issues.
// This will now trigger a warning
const client = createClient({
  request_timeout: 120_000, // 120 seconds
  // send_progress_in_http_headers is not configured
})
// ✓ Properly configured to avoid load balancer timeouts
const client = createClient({
request_timeout: 400_000,
clickhouse_settings: {
send_progress_in_http_headers: 1,
http_headers_progress_interval_ms: '110000', // ~10s below LB timeout
},
})

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​clickhouse/client since your current version.


Updates msw from 2.13.4 to 2.13.6

Release notes

Sourced from msw's releases.

v2.13.6 (2026-04-24)

Bug Fixes

  • WebSocketHandler: add public test() method (#2727) (3da7048e05fae80fe3410e3af86f6c3dd3cfaead) @​kettanaito

v2.13.5 (2026-04-23)

Bug Fixes

  • reset generator state on .resetHandlers()/.restoreHandlers() (#2725) (8d16801cacd89e5aff336c43e888df19fad04417) @​kettanaito
Commits
  • a680221 chore(release): v2.13.6
  • 3da7048 fix(WebSocketHandler): add public test() method (#2727)
  • d814fc8 chore(release): v2.13.5
  • 8d16801 fix: reset generator state on .resetHandlers()/.restoreHandlers() (#2725)
  • edeb058 chore: replace missing ServiceWorkerIncomingRequest with `IncomingWorkerReq...
  • See full diff in compare view

Updates @kurrent/kurrentdb-client from 1.1.1 to 1.1.2

Release notes

Sourced from @​kurrent/kurrentdb-client's releases.

v1.1.2

What's Changed

Full Changelog: kurrent-io/KurrentDB-Client-NodeJS@v1.1.1...v1.1.2

Commits
  • 8cb9d89 chore: prepare relase v1.1.2
  • 244ce0f [release/v1.1] Fix connection string and gossip timeout documentation (#485)
  • 78136f5 [release/v1.1] fix: improve leader failover reconnection and error mapping (#...
  • fe8c18e add leader failover reconnection tests (#477)
  • See full diff in compare view

Updates @aws-sdk/client-s3 from 3.1032.0 to 3.1037.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1037.0

3.1037.0(2026-04-24)

New Features
  • clients: update client endpoints as of 2026-04-24 (ca3df2be)
  • client-evs: EVS now supports i7i.metal-24xl EC2 bare metal instance type, delivering high random IOPS performance with real-time latency, ideal for IO intensive and latency-sensitive workloads such as transactional databases, real-time analytics, and AI ML pre-processing. (fd92ee48)
  • client-cloudwatch-logs: Adding nextToken and maxItems to the GetQueryResults API. (1a5ef619)
  • client-transfer: AWS Transfer Family now support configurable IP address types for Web Apps of type VPC, enabling customers to select IPv4-only or dual-stack (IPv4 and IPv6) configurations based on their network requirements. (f2a72a85)
  • client-bedrock-agentcore-control: Added support for configuring identity providers and inbound authorizers within a private VPC for AWS Bedrock AgentCore, enabling secure network connection without public internet access (a0bf24cd)
  • client-connect: Amazon Connect is expanding attachment capabilities to give customers greater flexibility and control. Currently limited to predefined file types, the new feature will allow contact center administrators to customize which file extensions and sizes are supported across chat, email, tasks, and cases. (7e987e88)
  • client-connecthealth: Corrected CreateWebAppConfiguration documentation. Adding slash as an allowed character for the Ambient documentation agent to allow pronoun specifications. (c21882c4)
Bug Fixes
  • client-kinesis: tolerance for flaky H2 session ordering assertion in E2E test (#7959) (58734960)

For list of updated packages, view updated-packages.md in assets-3.1037.0.zip

v3.1036.0

3.1036.0(2026-04-23)

Chores
  • codegen: sync for http2 session closure, retry longpoll backoff, and fast-xml-parser version bump (#7958) (107aefc4)
  • xml-builder: up fast-xml-parser to 5.7.1 (#7957) (110b1c01)
Documentation Changes
  • client-pcs: This release adds support for Slurm 25.11 with expedited requeue enabled by default for jobs failing due to node issues, configurable requeue delay, health checks at node startup only, and unauthenticated HTTP endpoints disabled by default for improved security. (1110500a)
New Features
  • client-datazone: Releasing For LakehouseProperties attributes in the Connections API's (d0c03722)
  • client-iot-managed-integrations: Adds "Status" field to provisioning profile operation response types, giving users visibility into the readiness of a provisioning profile to be used for device provisioning. (72d6968c)
  • client-opensearch: Amazon OpenSearch UI applications now support cross-Region domain association, enabling you to connect OpenSearch Dashboards in one AWS Region to OpenSearch domains in other Regions within the same partition for centralized data visualization. (600311b9)
Tests
  • client-transcribe-streaming: add concurrency to startStreamTranscription test (#7948) (e2cf194b)

For list of updated packages, view updated-packages.md in assets-3.1036.0.zip

v3.1035.0

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1037.0 (2026-04-24)

Note: Version bump only for package @​aws-sdk/client-s3

3.1036.0 (2026-04-23)

Note: Version bump only for package @​aws-sdk/client-s3

3.1035.0 (2026-04-22)

Bug Fixes

  • client-s3: retry errors with 200 status code (#7945) (7d9d8d1)

Features

  • client-s3: This release adds five additional checksum algorithms for S3 data integrity (MD5, SHA-512, XXHash3, XXHash64, XXHash128) and support for S3 Inventory on directory buckets (S3 Express One Zone). (41a6a59)

3.1034.0 (2026-04-21)

Note: Version bump only for package @​aws-sdk/client-s3

3.1033.0 (2026-04-20)

Features

  • clients: use binary decision diagrams for endpoint resolution (#7931) (ff1b2ba)
Commits
  • 7babd8b Publish v3.1037.0
  • 46e4ac5 Publish v3.1036.0
  • 107aefc chore(codegen): sync for http2 session closure, retry longpoll backoff, and f...
  • d8fbfbc Publish v3.1035.0

@dependabot
Bump the dependencies group with 18 updates
00b8400 
Bumps the dependencies group with 18 updates:

| Package | From | To |
| --- | --- | --- |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.4` | `4.1.5` |
| [npm-check-updates](https://github.com/raineorshine/npm-check-updates) | `21.0.2` | `22.0.1` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.58.2` | `8.59.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.4` | `4.1.5` |
| [dockerode](https://github.com/apocas/dockerode) | `4.0.10` | `5.0.0` |
| [undici](https://github.com/nodejs/undici) | `7.24.7` | `8.1.0` |
| [@azure/cosmos](https://github.com/Azure/azure-sdk-for-js) | `4.9.2` | `4.9.3` |
| [@azure/storage-blob](https://github.com/Azure/azure-sdk-for-js) | `12.29.1` | `12.31.0` |
| [@azure/storage-queue](https://github.com/Azure/azure-sdk-for-js) | `12.28.1` | `12.29.0` |
| [@clickhouse/client](https://github.com/ClickHouse/clickhouse-js) | `1.18.2` | `1.18.3` |
| [msw](https://github.com/mswjs/msw) | `2.13.4` | `2.13.6` |
| [@kurrent/kurrentdb-client](https://github.com/kurrent-io/KurrentDB-Client-NodeJS) | `1.1.1` | `1.1.2` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1032.0` | `3.1037.0` |
| [mariadb](https://github.com/mariadb-corporation/mariadb-connector-nodejs) | `3.4.5` | `3.5.2` |
| [mongoose](https://github.com/Automattic/mongoose) | `9.4.1` | `9.5.0` |
| [mssql](https://github.com/tediousjs/node-mssql) | `12.3.1` | `12.5.0` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.22.1` | `3.22.2` |
| [toxiproxy-node-client](https://github.com/ihsw/toxiproxy-node-client) | `4.0.0` | `4.1.0` |


Updates `@vitest/coverage-v8` from 4.1.4 to 4.1.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.5/packages/coverage-v8)

Updates `npm-check-updates` from 21.0.2 to 22.0.1
- [Release notes](https://github.com/raineorshine/npm-check-updates/releases)
- [Changelog](https://github.com/raineorshine/npm-check-updates/blob/main/CHANGELOG.md)
- [Commits](raineorshine/npm-check-updates@v21.0.2...v22.0.1)

Updates `typescript-eslint` from 8.58.2 to 8.59.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.0/packages/typescript-eslint)

Updates `vitest` from 4.1.4 to 4.1.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.5/packages/vitest)

Updates `dockerode` from 4.0.10 to 5.0.0
- [Release notes](https://github.com/apocas/dockerode/releases)
- [Commits](apocas/dockerode@v4.0.10...v5.0.0)

Updates `undici` from 7.24.7 to 8.1.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.7...v8.1.0)

Updates `@azure/cosmos` from 4.9.2 to 4.9.3
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/documentation/Changelog-for-next-generation.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/compare/@azure/cosmos_4.9.2...@azure/cosmos_4.9.3)

Updates `@azure/storage-blob` from 12.29.1 to 12.31.0
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/documentation/Changelog-for-next-generation.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/compare/@azure/storage-blob_12.29.1...@azure/storage-blob_12.31.0)

Updates `@azure/storage-queue` from 12.28.1 to 12.29.0
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/documentation/Changelog-for-next-generation.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/compare/@azure/storage-queue_12.28.1...@azure/storage-queue_12.29.0)

Updates `@clickhouse/client` from 1.18.2 to 1.18.3
- [Release notes](https://github.com/ClickHouse/clickhouse-js/releases)
- [Changelog](https://github.com/ClickHouse/clickhouse-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ClickHouse/clickhouse-js/commits)

Updates `msw` from 2.13.4 to 2.13.6
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](mswjs/msw@v2.13.4...v2.13.6)

Updates `@kurrent/kurrentdb-client` from 1.1.1 to 1.1.2
- [Release notes](https://github.com/kurrent-io/KurrentDB-Client-NodeJS/releases)
- [Changelog](https://github.com/kurrent-io/KurrentDB-Client-NodeJS/blob/master/CHANGELOG.md)
- [Commits](kurrent-io/KurrentDB-Client-NodeJS@v1.1.1...v1.1.2)

Updates `@aws-sdk/client-s3` from 3.1032.0 to 3.1037.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1037.0/clients/client-s3)

Updates `mariadb` from 3.4.5 to 3.5.2
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-nodejs/blob/main/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-nodejs@3.4.5...3.5.2)

Updates `mongoose` from 9.4.1 to 9.5.0
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@9.4.1...9.5.0)

Updates `mssql` from 12.3.1 to 12.5.0
- [Release notes](https://github.com/tediousjs/node-mssql/releases)
- [Changelog](https://github.com/tediousjs/node-mssql/blob/master/CHANGELOG.txt)
- [Commits](tediousjs/node-mssql@v12.3.1...v12.5.0)

Updates `mysql2` from 3.22.1 to 3.22.2
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.22.1...v3.22.2)

Updates `toxiproxy-node-client` from 4.0.0 to 4.1.0
- [Commits](https://github.com/ihsw/toxiproxy-node-client/commits)

---
updated-dependencies:
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: npm-check-updates
  dependency-version: 22.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.59.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: vitest
  dependency-version: 4.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: dockerode
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: undici
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@azure/cosmos"
  dependency-version: 4.9.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@azure/storage-blob"
  dependency-version: 12.31.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@azure/storage-queue"
  dependency-version: 12.29.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@clickhouse/client"
  dependency-version: 1.18.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: msw
  dependency-version: 2.13.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@kurrent/kurrentdb-client"
  dependency-version: 1.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1037.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mariadb
  dependency-version: 3.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mongoose
  dependency-version: 9.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mssql
  dependency-version: 12.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mysql2
  dependency-version: 3.22.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: toxiproxy-node-client
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code major An incompatible API change labels Apr 27, 2026
@netlify
Copy link
Copy Markdown

netlify Bot commented Apr 27, 2026 •
edited
Loading

✅ Deploy Preview for testcontainers-node ready!

Name Link
🔨 Latest commit 00b8400
🔍 Latest deploy log https://app.netlify.com/projects/testcontainers-node/deploys/69eeb2764d70a5000999428e
😎 Deploy Preview https://deploy-preview-1309--testcontainers-node.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@manuel-rw
Copy link
Copy Markdown

manuel-rw commented Apr 27, 2026

@apocas can this be merged? See GHSA-xq3m-2v4x-88gg
We are currently relying on this vulnerable version.

@apocas
Copy link
Copy Markdown

apocas commented Apr 27, 2026

? If you are talking about dockerode, this was already fixed some days ago.
https://github.com/apocas/dockerode/releases/tag/v5.0.0

@manuel-rw
Copy link
Copy Markdown

manuel-rw commented Apr 27, 2026

Yes, but this package has a dependency to it, correct? :)

@ihsw
Copy link
Copy Markdown

ihsw commented Apr 28, 2026 •
edited
Loading

@manuel-rw just wanted to note that toxiproxy-node-client@4.1.0 removes the axios dependency, instead opting for fetch, mitigating related CVEs

@apocas
Copy link
Copy Markdown

apocas commented Apr 28, 2026

Yes, but this package has a dependency to it, correct? :)

Yaup. There was no breaking changes introduced.
I only major bumped it because I dropped support for very old EOLed versions of node. Now its node >= 14.17.

So regarding dockerode its safe to merge :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code major An incompatible API change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@manuel-rw @apocas @ihsw