Skip to content

Bump the prod-minor-updates group across 1 directory with 11 updates#627

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/prod-minor-updates-0136700300
Closed

Bump the prod-minor-updates group across 1 directory with 11 updates#627
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/prod-minor-updates-0136700300

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 23, 2026 •
edited
Loading

Bumps the prod-minor-updates group with 11 updates in the / directory:

Package From To
@asteasolutions/zod-to-openapi 8.4.1 8.5.0
@aws-sdk/client-s3 3.1011.0 3.1035.0
@faker-js/faker 10.3.0 10.4.0
@tanstack/react-query 5.90.21 5.99.2
axios 1.13.5 1.15.2
express-rate-limit 8.3.0 8.4.0
next-intl 4.8.3 4.9.1
posthog-node 5.28.0 5.29.6
react-hook-form 7.71.2 7.73.1
resend 6.9.2 6.12.2
ws 8.19.0 8.20.0

Updates @asteasolutions/zod-to-openapi from 8.4.1 to 8.5.0

Release notes

Sourced from @​asteasolutions/zod-to-openapi's releases.

v8.5.0

What's Changed

  • fix: allow nested discriminated unions as they are supported in Zod v4 (#239)

Full Changelog: asteasolutions/zod-to-openapi@v8.4.3...v8.5.0

v8.4.3

What's Changed

  • Bump rollup from 4.22.4 to 4.59.0

Full Changelog: asteasolutions/zod-to-openapi@v8.4.2...v8.4.3

v8.4.2

What's Changed

  • Bump minimatch

Full Changelog: asteasolutions/zod-to-openapi@v8.4.1...v8.4.2

Commits
  • 2fb24b0 Release 8.5.0
  • edf336e Merge pull request #367 from dirkluijk/support-discriminated-unions
  • 2318125 fix: allow nested discriminated unions as they are supported in Zod v4
  • 34953fa Release 8.4.3
  • d2c22df Merge pull request #364 from asteasolutions/dependabot/npm_and_yarn/rollup-4....
  • b4f6a66 Release 8.4.2
  • ab21ef4 Bump rollup from 4.22.4 to 4.59.0
  • 6a115de Merge pull request #365 from asteasolutions/dependabot/npm_and_yarn/multi-acd...
  • fad449a Bump minimatch
  • See full diff in compare view

Updates @aws-sdk/client-s3 from 3.1011.0 to 3.1035.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1035.0

3.1035.0(2026-04-22)

New Features
  • client-iot-wireless: Enable customers to optionally specify a desired confidence level for Cellular and WiFi position estimates. Customers can use this to trade off confidence level and radius of uncertainty based on their needs. (9fcaea59)
  • client-ecs: GPU health monitoring and auto-repair for ECS Managed Instances (0ffa1090)
  • client-osis: Update the pipeline configuration body character limit for the CreatePipeline API call. (d19d4063)
  • client-opensearch: Adds support for RollbackServiceSoftwareUpdate API (e8b37945)
  • client-batch: Support of S3Files volume type, container start and stop timeouts. (802ac4b8)
  • client-ec2: Managed resource visibility settings control whether resources that AWS services provision on your behalf within your AWS account appear in your Amazon console views and API list operations. (698293af)
  • client-emr-serverless: This release adds support for Spark connect sessions starting with release label emr-7.13.0. (966d4934)
  • client-bedrock-agentcore: Adds support for Amazon Bedrock AgentCore Harness data plane APIs, enabling customers to invoke managed agent loops and execute commands on live agent sessions with streaming responses. (a465bad8)
  • client-s3-control: This release adds support for five additional checksum algorithms for data integrity checking in Amazon S3 - MD5, SHA-512, XXHash3, XXHash64, and XXHash128. (e8c4a764)
  • client-bedrock-agentcore-control: Adds support for Amazon Bedrock AgentCore Harness control plane APIs, enabling customers to create, manage, and configure managed agent loops with customizable models, tools, memory, and isolated execution environments. (ace8fec5)
  • client-ivs: Adds support for Amazon IVS server-side ad insertion (a4a29e9e)
  • client-s3: This release adds five additional checksum algorithms for S3 data integrity (MD5, SHA-512, XXHash3, XXHash64, XXHash128) and support for S3 Inventory on directory buckets (S3 Express One Zone). (41a6a595)
  • client-lambda: Add Ruby 4.0 (ruby4.0) support to AWS Lambda. (ece8ce80)
Bug Fixes
  • client-s3: retry errors with 200 status code (#7945) (7d9d8d17)
  • client-sts: override IDPCommunicationError to be retryable (#7946) (d75e129a)
Tests
  • clients: add snapshot tests for http2-default clients (#7947) (189729bb)
  • client-kinesis: http2 session concurrency tests (#7941) (408d99eb)

For list of updated packages, view updated-packages.md in assets-3.1035.0.zip

v3.1034.0

3.1034.0(2026-04-21)

Chores
  • core/client: retry behavior control flag (#7943) (f8a0e2eb)
  • codegen: sync for http2 session concurrency fixes (#7942) (273ad5be)
New Features
  • client-snowball: This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.1. The SDK will prioritize its most performant protocol. (dc2372c3)
  • client-compute-optimizer: This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.0. The SDK will prioritize its most performant protocol. (bfd1554d)
  • client-cognito-identity-provider: Adding dutch language support for Cognito Managed Login and Terms on Console (dca261d2)
  • client-compute-optimizer-automation: This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.0. The SDK will prioritize its most performant protocol. (1dce21e2)
  • client-network-firewall: Support for new types of partner managed rulegroups for Network Firewall Service (267a4f8e)
  • client-gamelift: This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.1. The SDK will prioritize its most performant protocol. (c1e73830)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1035.0 (2026-04-22)

Bug Fixes

  • client-s3: retry errors with 200 status code (#7945) (7d9d8d1)

Features

  • client-s3: This release adds five additional checksum algorithms for S3 data integrity (MD5, SHA-512, XXHash3, XXHash64, XXHash128) and support for S3 Inventory on directory buckets (S3 Express One Zone). (41a6a59)

3.1034.0 (2026-04-21)

Note: Version bump only for package @​aws-sdk/client-s3

3.1033.0 (2026-04-20)

Features

  • clients: use binary decision diagrams for endpoint resolution (#7931) (ff1b2ba)

3.1032.0 (2026-04-17)

Note: Version bump only for package @​aws-sdk/client-s3

3.1031.0 (2026-04-16)

Note: Version bump only for package @​aws-sdk/client-s3

... (truncated)

Commits
  • d8fbfbc Publish v3.1035.0
  • 41a6a59 feat(client-s3): This release adds five additional checksum algorithms for S3...
  • 7d9d8d1 fix(client-s3): retry errors with 200 status code (#7945)
  • d08b5a7 Publish v3.1034.0
  • 273ad5b chore(codegen): sync for http2 session concurrency fixes (#7942)
  • a62021b Publish v3.1033.0
  • ff1b2ba feat(clients): use binary decision diagrams for endpoint resolution (#7931)
  • c0c0872 Publish v3.1032.0
  • 33a780e Publish v3.1031.0
  • 560d987 chore: upgrade smithy to 1.69.0 (#7932)
  • Additional commits viewable in compare view

Updates @faker-js/faker from 10.3.0 to 10.4.0

Release notes

Sourced from @​faker-js/faker's releases.

v10.4.0

What's Changed

New Contributors

Full Changelog: faker-js/faker@v10.3.0...v10.4.0

Changelog

Sourced from @​faker-js/faker's changelog.

10.4.0 (2026-03-23)

New Locales

  • locale: add Japanese bear definitions (#3720) (2a4b15c)
  • locale: add Japanese bird definitions (#3719) (dc31ff8)
  • locale: add Japanese cat breed definitions (#3716) (54af8a8)
  • locale: add Japanese cattle breed definitions (#3717) (c2c7342)
  • locale: add Japanese fish definitions (#3721) (15fc361)
  • locale: add Japanese horse breed definitions (#3718) (e02536e)
  • locale: add Norwegian (nb_NO) country definition (#3714) (614b4e9)

Features

Changed Locales

  • locale: filter and cleanup PersonEntryDefintions data (#3266) (67defc8)

Bug Fixes

  • locales: correct typos and capitalization in es_MX street names (#3737) (2b32c28)
Commits

Updates @tanstack/react-query from 5.90.21 to 5.99.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.99.2
    • @​tanstack/react-query@​5.99.2

@​tanstack/react-query-next-experimental@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.99.2

@​tanstack/react-query-persist-client@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.99.2
    • @​tanstack/react-query@​5.99.2

@​tanstack/react-query@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.99.2

@​tanstack/react-query-devtools@​5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.99.1
    • @​tanstack/react-query@​5.99.1

@​tanstack/react-query-next-experimental@​5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.99.1

@​tanstack/react-query-persist-client@​5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.99.1
    • @​tanstack/react-query@​5.99.1

@​tanstack/react-query@​5.99.1

Patch Changes

  • Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.99.2

5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.99.1

5.99.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.99.0

5.98.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.98.0

5.97.0

Patch Changes

  • Updated dependencies [2bfb12c]:
    • @​tanstack/query-core@​5.97.0

5.96.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.96.2

5.96.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.96.1

5.96.0

... (truncated)

Commits
  • a3ec7b3 ci: Version Packages (#10520)
  • 69d2757 ci: Version Packages (#10514)
  • 7ffa1ed test({react,preact,solid}-query/useQueries): fix test description from 'useQu...
  • bc83d37 test({react,preact}-query/useMutation): unify destructuring pattern in comple...
  • aad1bd5 test({react,preact}-query/useMutation): add parallel 'mutateAsync' tests with...
  • d7643b5 test({react,preact}-query/useMutation): add optimistic update tests with succ...
  • cd89d6f test({react,preact}-query/useMutation): add conditional handling and retry te...
  • 6e15fe6 test({react,preact}-query/useMutation): add chained 'mutateAsync' tests for s...
  • 792d3a5 test({react,preact}-query/useMutation): add callback tests when 'useMutation'...
  • 1b661b3 test({react,preact}-query/useMutation): add single callback tests for 'mutate...
  • Additional commits viewable in compare view

Updates axios from 1.13.5 to 1.15.2

Release notes

Sourced from axios's releases.

v1.15.2

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.15.2 - April 21, 2026

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1 - April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)

... (truncated)

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates express-rate-limit from 8.3.0 to 8.4.0

Release notes

Sourced from express-rate-limit's releases.

v8.4.0

You can view the changelog here.

v8.3.2

You can view the changelog here.

v8.3.1

You can view the changelog here.

Commits
  • f3b7929 8.4.0
  • 789e4cb docs: logger option & v8.4.0 changelog
  • 86eca43 test: bump request timeout from 10ms to 50ms in flakey skipFailedRequests test
  • 2bb343c resolve Jest timeout for server-based tests (#617)
  • c4dbb42 8.3.2
  • 8f1cc66 v8.3.2 changelog
  • 601b87f Fix skipFailedRequests for for connections that close very early (#611)
  • 014c2f3 chore(deps-dev): bump the development-dependencies group with 6 updates (#612)
  • 4e8b18b Remove Zuplo sponsorship details from README (#613)
  • 31dab19 test: use numeric range for reset timestamp assertion (#610)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.


Updates next-intl from 4.8.3 to 4.9.1

Release notes

Sourced from next-intl's releases.

v4.9.1

4.9.1 (2026-04-10)

Bug Fixes

v4.9.0

4.9.0 (2026-04-01)

Features

v4.8.4

4.8.4 (2026-03-31)

Bug Fixes

Changelog

Sourced from next-intl's changelog.

4.9.1 (2026-04-10)

Bug Fixes

4.9.0 (2026-04-01)

Features

4.8.4 (2026-03-31)

Bug Fixes

Commits
  • b4aa538 v4.9.1
  • 1c80b66 fix: Improve middleware pathname validation (#2304)
  • b65f8c4 v4.9.0
  • 02811f5 feat: Support transitionTypes on Link (#2302)
  • 722785b v4.8.4
  • 5e7bcd7 fix: Remove TypeScript peer dependency and update examples to TypeScript v6 (...
  • c9d6051 fix: Remove TypeScript peer dependency and update examples to TypeScript v6 (...
  • 5be07b6 fix: Remove TypeScript peer dependency and update examples to TypeScript v6 (...
  • 58326e7 docs: Fix typos (#2282)
  • ed19787 docs: Fix typos (#2283)
  • Additional commits viewable in compare view

Updates posthog-node from 5.28.0 to 5.29.6

Release notes

Sourced from posthog-node's releases.

posthog-node@5.29.6

5.29.6

Patch Changes

  • Updated dependencies [1a8b727]:
    • @​posthog/core@​1.27.0

posthog-node@5.29.5

5.29.5

Patch Changes

  • Updated dependencies [922a1c1]:
    • @​posthog/core@​1.26.0

posthog-node@5.29.4

5.29.4

Patch Changes

  • #3407 b26c57c Thanks @​patricio-posthog! - fix(flags): switch local evaluation polling from /api/feature_flag/local_evaluation to /flags/definitions (2026-04-21)

posthog-node@5.29.3

5.29.3

Patch Changes

  • #3426 1a0b58d Thanks @​marandaneto! - Trim surrounding whitespace from user-provided API keys, personal API keys, and host config values before using them. (2026-04-21)
  • Updated dependencies [1a0b58d]:
    • @​posthog/core@​1.25.3

posthog-node@5.29.2

5.29.2

Patch Changes

  • #3351 c735b08 Thanks @​dmarticus! - Send $device_id as a top-level field in /flags requests so the feature flags service can use it for device-based bucketing during remote evaluation (2026-04-09)
  • Updated dependencies [c735b08]:
    • @​posthog/coreDescription has been truncated

@dependabot
Bump the prod-minor-updates group across 1 directory with 11 updates
0002330 
Bumps the prod-minor-updates group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@asteasolutions/zod-to-openapi](https://github.com/asteasolutions/zod-to-openapi) | `8.4.1` | `8.5.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1011.0` | `3.1035.0` |
| [@faker-js/faker](https://github.com/faker-js/faker) | `10.3.0` | `10.4.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.90.21` | `5.99.2` |
| [axios](https://github.com/axios/axios) | `1.13.5` | `1.15.2` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.3.0` | `8.4.0` |
| [next-intl](https://github.com/amannn/next-intl) | `4.8.3` | `4.9.1` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.28.0` | `5.29.6` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.71.2` | `7.73.1` |
| [resend](https://github.com/resend/resend-node) | `6.9.2` | `6.12.2` |
| [ws](https://github.com/websockets/ws) | `8.19.0` | `8.20.0` |



Updates `@asteasolutions/zod-to-openapi` from 8.4.1 to 8.5.0
- [Release notes](https://github.com/asteasolutions/zod-to-openapi/releases)
- [Commits](asteasolutions/zod-to-openapi@v8.4.1...v8.5.0)

Updates `@aws-sdk/client-s3` from 3.1011.0 to 3.1035.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1035.0/clients/client-s3)

Updates `@faker-js/faker` from 10.3.0 to 10.4.0
- [Release notes](https://github.com/faker-js/faker/releases)
- [Changelog](https://github.com/faker-js/faker/blob/next/CHANGELOG.md)
- [Commits](faker-js/faker@v10.3.0...v10.4.0)

Updates `@tanstack/react-query` from 5.90.21 to 5.99.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.99.2/packages/react-query)

Updates `axios` from 1.13.5 to 1.15.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.15.2)

Updates `express-rate-limit` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.3.0...v8.4.0)

Updates `next-intl` from 4.8.3 to 4.9.1
- [Release notes](https://github.com/amannn/next-intl/releases)
- [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md)
- [Commits](amannn/next-intl@v4.8.3...v4.9.1)

Updates `posthog-node` from 5.28.0 to 5.29.6
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.29.6/packages/node)

Updates `react-hook-form` from 7.71.2 to 7.73.1
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.71.2...v7.73.1)

Updates `resend` from 6.9.2 to 6.12.2
- [Release notes](https://github.com/resend/resend-node/releases)
- [Commits](resend/resend-node@v6.9.2...v6.12.2)

Updates `ws` from 8.19.0 to 8.20.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.20.0)

---
updated-dependencies:
- dependency-name: "@asteasolutions/zod-to-openapi"
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1035.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: "@faker-js/faker"
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.99.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: express-rate-limit
  dependency-version: 8.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: next-intl
  dependency-version: 4.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: posthog-node
  dependency-version: 5.29.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: react-hook-form
  dependency-version: 7.73.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: resend
  dependency-version: 6.12.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: ws
  dependency-version: 8.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 23, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 23, 2026

Warning

This image may contain unchecked and breaking changes. Only use on own risk.

👋 Thanks for your PR!
Dev images for this PR are now available on docker hub:

SQLITE Image:

lokowitz75/pangolin:dev-pr627

Postgresql Image:

lokowitz75/pangolin:postgresql-dev-pr627

@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 30, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 30, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/prod-minor-updates-0136700300 branch April 30, 2026 10:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants