fix(deps): update all non-major dependencies#261
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
fix(deps): update all non-major dependencies#261renovate[bot] wants to merge 1 commit intomasterfrom
renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
QA Test EnvironmentVictorWinberg-OneList--renovate-all-minor-patch Environment has been created! deploy 2026-04-01 02:57 |
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
2b2c1fa to
0cb56c0
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
0cb56c0 to
57d2419
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.28.5→7.29.07.28.5→7.28.616.3.1→16.3.21.20.3→1.20.42.1.0→2.1.117.2.3→17.4.14.20.0→4.22.12.0.7→2.0.94.17.21→4.18.1v22.21.1→22.22.28.13.1→8.20.03.6.0→3.8.1GitHub Vulnerability Alerts
CVE-2025-32996
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
CVE-2025-32997
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
Release Notes
babel/babel (@babel/core)
v7.29.0Compare Source
v7.29.0 (2026-01-31)
Thanks @simbahax for your first PR!
🚀 New Feature
babel-typesbabel-standalone🐛 Bug Fix
babel-parserextendsclause (@nicolo-ribaudo)babel-traversebabel-plugin-transform-block-scoping,babel-traverse🏃♀️ Performance
babel-generator,babel-runtime-corejs3Committers: 6
v7.28.6Compare Source
testing-library/react-testing-library (@testing-library/react)
v16.3.2Compare Source
expressjs/body-parser (body-parser)
v1.20.4Compare Source
===================
expressjs/cookie-session (cookie-session)
v2.1.1Compare Source
==========
motdotla/dotenv (dotenv)
v17.4.1Compare Source
Changed
injectingtoinjected(#1005)v17.4.0Compare Source
Added
skills/folder with focused agent skills:skills/dotenv/SKILL.md(core usage) andskills/dotenvx/SKILL.md(encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)Changed
◇ injecting env (14) from .env(#1003)v17.3.1Compare Source
Changed
v17.3.0Compare Source
Added
Changed
v17.2.4Compare Source
Changed
DotenvPopulateInputacceptNodeJS.ProcessEnvtype (#915)expressjs/express (express)
v4.22.1Compare Source
v4.22.0Compare Source
v4.21.2Compare Source
What's Changed
Full Changelog: expressjs/express@4.21.1...4.21.2
v4.21.1Compare Source
What's Changed
Full Changelog: expressjs/express@4.21.0...4.21.1
v4.21.0Compare Source
What's Changed
"back"magic string in redirects by @blakeembrey in #5935New Contributors
Full Changelog: expressjs/express@4.20.0...4.21.0
chimurai/http-proxy-middleware (http-proxy-middleware)
v2.0.9Compare Source
What's Changed
Full Changelog: chimurai/http-proxy-middleware@v2.0.8...v2.0.9
v2.0.8Compare Source
What's Changed
Full Changelog: chimurai/http-proxy-middleware@v2.0.7...v2.0.8
lodash/lodash (lodash)
v4.18.1Compare Source
Bugs
Fixes a
ReferenceErrorissue inlodashlodash-eslodash-amdandlodash.templatewhen using thetemplateandfromPairsfunctions from the modular builds. See #6167 (comment)These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.
There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:
lodash: lodash/lodash@4.18.0-npm...4.18.1-npmlodash-es: lodash/lodash@4.18.0-es...4.18.1-eslodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amdlodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packagesv4.18.0Compare Source
v4.18.0
Full Changelog: lodash/lodash@4.17.23...4.18.0
Security
_.unset/_.omit: Fixed prototype pollution viaconstructor/prototypepath traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Nowconstructorandprototypeare blocked unconditionally as non-terminal path keys, matchingbaseSet. Calls that previously returnedtrueand deleted the property now returnfalseand leave the target untouched._.template: Fixed code injection viaimportskeys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. Thevariableoption was validated againstreForbiddenIdentifierCharsbutimportsKeyswas left unguarded, allowing code injection via the sameFunction()constructor sink.importskeys containing forbidden identifier characters now throw"Invalid imports option passed into _.template".Docs
_.templatein threat model and API docs (#6099)lower > upperbehavior in_.random(#6115)_.compactjsdoc (#6090)lodash.*modular packagesDiff
We have also regenerated and published a select number of the
lodash.*modular packages.These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:
v4.17.23Compare Source
nodejs/node (node)
v22.22.2Compare Source
v22.22.1: 2026-03-05, Version 22.22.1 'Jod' (LTS)Compare Source
Notable Changes
7b93a65f27] - build: test on Python 3.14 (Christian Clauss) #599836063d888fe] - cli: mark--heapsnapshot-near-heap-limitas stable (Joyee Cheung) #60956d950b151a2] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #614194f42f8c428] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741b6ebf2cd53] - doc: add avivkeller to collaborators (Aviv Keller) #6111535854f424d] - doc: add gurgunday to collaborators (Gürgün Dayıoğlu) #610945c6a076e5d] - meta: add Renegade334 to collaborators (Renegade334) #60714Commits
5f773488c2] - assert: use a set instead of an array for faster lookup (Ruben Bridgewater) #61076feecbb0eab] - assert,util: fix deep comparison for sets and maps with mixed types (Ruben Bridgewater) #61388096095b127] - benchmark: add SQLite benchmarks (Guilherme Araújo) #61401b5fe481415] - benchmark: use boolean options in benchmark tests (SeokhunEom) #60129fa9faacacb] - benchmark: allow boolean option values (SeokhunEom) #60129ba8714ac21] - benchmark: fix incorrect base64 input in byteLength benchmark (semimikoh) #6084153596de876] - benchmark: use typescript for import cjs benchmark (Joyee Cheung) #60663e8930e9d7c] - benchmark: focus on import.meta intialization in import-meta benchmark (Joyee Cheung) #606031155e412b1] - benchmark: add per-suite setup option (Joyee Cheung) #60574e01903d304] - benchmark: improve cpu.sh for safety and usability (Nam Yooseong) #60162623a405747] - benchmark: add benchmark for leaf source text modules (Joyee Cheung) #602057f5e7b9f7f] - benchmark: add microbench on isInsideNodeModules (Chengzhong Wu) #60991db132b85a8] - bootstrap: initialize http proxy after user module loader setup (Joyee Cheung) #5893866aab9f987] - buffer: let Buffer.of use heap (Сковорода Никита Андреевич) #60503c3cf00c671] - buffer: speed up concat via TypedArray#set (Gürgün Dayıoğlu) #60399f6fad231e9] - build: skip sscache action on non-main branches (Joyee Cheung) #617902145f91f6b] - build: update android-patches/trap-handler.h.patch (Mo Luo) #603695b49759dd8] - build: update devcontainer.json to use paired nix env (Joyee Cheung) #6141424724cde40] - build: fix misplaced comma in ldflags (hqzing) #61294c57a19934e] - build: fix crate vendor file checksums on windows (Chengzhong Wu) #613298659d7cd07] - build: fix inconsistent quoting inMakefile(Antoine du Hamel) #6051144f339b315] - build: remove temporal updater (Chengzhong Wu) #61151d60a6cebd5] - build: update test-wpt-report to use NODE instead of OUT_NODE (Filip Skokan) #6102434ccf187f5] - build: skip build-ci on actions with a separate test step (Chengzhong Wu) #610737b19e101a2] - build: run embedtest with node_g when BUILDTYPE=Debug (Chengzhong Wu) #608509408c4459f] - build: upgrade Python linter ruff, add rules ASYNC,PERF (Christian Clauss) #599842166ec7f0f] - build: use call command when calling python configure (Jacob Nichols) #6009873ef70145d] - build: remove V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE defs (Joyee Cheung) #602967b93a65f27] - build: test on Python 3.14 (Christian Clauss) #59983508ce6ec6c] - build, src: fix include paths for vtune files (Rahul) #59999c89d3cd570] - build,tools: fix addon build deadlock on errors (Vladimir Morozov) #6132140904a0591] - build,win: update WinGet configurations to Python 3.14 (Mike McCready) #614316d6742e7db] - child_process: treat ipc length header as unsigned uint32 (Ryuhei Shima) #613446063d888fe] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #609563d324a0f88] - cluster: fix port reuse between cluster (Ryuhei Shima) #6014140a58709b4] - console: optimize single-string logging (Gürgün Dayıoğlu) #60422d950b151a2] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #614194f42f8c428] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741a87499ae25] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #606628c65cc11e2] - crypto: update root certificates to NSS 3.116 (Node.js GitHub Bot) #5995691dc00a2c1] - debugger: fix event listener leak in the run command (Joyee Cheung) #604640781bd3764] - deps: V8: backport6a0a25a(Vivian Wang) #616880cf1f9c3e9] - deps: update googletest to8508785(Node.js GitHub Bot) #61417521b4b1f07] - deps: update sqlite to 3.51.2 (Node.js GitHub Bot) #6133958b9d219a3] - deps: update icu to 78.2 (Node.js GitHub Bot) #60523cbc1e4306d] - deps: update zlib to 1.3.1-e00f703 (Node.js GitHub Bot) #61135db59c35ed8] - deps: update cjs-module-lexer to 2.2.0 (Node.js GitHub Bot) #61271c18518ee3c] - deps: update nbytes to 0.1.2 (Node.js GitHub Bot) #61270376df62d63] - deps: update timezone to 2025c (Node.js GitHub Bot) #61138993e905302] - deps: update simdjson to 4.2.4 (Node.js GitHub Bot) #61056b72fd2a5d3] - deps: update googletest to065127f(Node.js GitHub Bot) #61055d765147405] - deps: update sqlite to 3.51.1 (Node.js GitHub Bot) #6089937abe2a7d2] - deps: update zlib to 1.3.1-63d7e16 (Node.js GitHub Bot) #6089897241fcb86] - deps: update sqlite to 3.51.0 (Node.js GitHub Bot) #606143669c7b4f4] - deps: update simdjson to 4.2.2 (Node.js GitHub Bot) #607409a056ec89c] - deps: update googletest to1b96fa1(Node.js GitHub Bot) #60739b5803b3ea0] - deps: update minimatch to 10.1.1 (Node.js GitHub Bot) #605435bf99f3d46] - deps: update cjs-module-lexer to 2.1.1 (Node.js GitHub Bot) #60646801f187357] - deps: update simdjson to 4.2.1 (Node.js GitHub Bot) #6064403c16e5a4c] - deps: update simdjson to 4.1.0 (Node.js GitHub Bot) #605422ebfc2ca56] - deps: update amaro to 1.1.5 (Node.js GitHub Bot) #60541d24ba4fed6] - deps: update simdjson to 4.0.7 (Node.js GitHub Bot) #598839480a139bf] - deps: update googletest to279f847(Node.js GitHub Bot) #60219635e67379e] - deps: update archs files for openssl-3.5.5 (Node.js GitHub Bot) #61547c7b774047d] - deps: upgrade openssl sources to openssl-3.5.5 (Node.js GitHub Bot) #615475b324d7d7f] - deps: update corepack to 0.34.6 (Node.js GitHub Bot) #61510eef8ba0667] - deps: update corepack to 0.34.5 (Node.js GitHub Bot) #60842490f7c7fb1] - deps: update corepack to 0.34.4 (Node.js GitHub Bot) #6064366903ea3b3] - deps: update corepack to 0.34.2 (Node.js GitHub Bot) #60550a2f0b69282] - deps: update corepack to 0.34.1 (Node.js GitHub Bot) #60314c8044a48a6] - deps: V8: backport2e4c5cf(Michaël Zasso) #60654642f518198] - doc: supported toolchain with Visual Studio 2022 only (Mike McCready) #61451625f674487] - doc: move Security-Team from TSC to SECURITY (Rafael Gonzaga) #61495029e32f8ba] - doc: addedrequestOCSPoption totls.connect(ikeyan) #6106468e33dfa89] - doc: restore @ChALkeR to collaborators (Сковорода Никита Андреевич) #61553e016770d62] - doc: update IBM/Red Hat volunteers with dedicated project time (Beth Griggs) #61588ec63954657] - doc: mention constructor comparison in assert.deepStrictEqual (Hamza Kargin) #60253c8e1563a98] - doc: add CVE delay mention (Rafael Gonzaga) #614654b00cf2b54] - doc: include OpenJSF handle for security stewards (Rafael Gonzaga) #614544b73bf5bc8] - doc: clarify process.argv[1] behavior for -e/--eval (Jeevankumar S) #61366d3151df4b3] - doc: remove Windows Dev Home instructions from BUILDING (Mike McCready) #614342323462e35] - doc: clarify TypedArray properties on Buffer (Roman Reiss) #613556c5478c8b2] - doc: note resume build should not be done on node-test-commit (Stewart X Addison) #61373ba4a043103] - doc: refine WebAssembly error documentation (sangwook) #61382cd315ea589] - doc: add deprecation history for url.parse (Eng Zer Jun) #6138942db0c392d] - doc: add marco and rafael in last sec release (Marco Ippolito) #613834c3b680fc7] - doc: packages: example of private import switch to internal (coderaiser) #61343684d15e421] - doc: add esm and cjs examples to node:v8 (Alfredo González) #61328c3f9c7a7d9] - doc: added 'secure' event to tls.TLSSocket (ikeyan) #61066aa9acad5ca] - doc: restore @watilde to collaborators (Daijiro Wachi) #613509cafec084e] - doc: run license-builder (github-actions[bot]) #61348cdb12ccbc6] - doc: document ALPNCallback option for TLSSocket constructor (ikeyan) #61331461c5e65c5] - doc: update MDN links (Livia Medeiros) #61062dde45baeab] - doc: add documentation for process.traceProcessWarnings (Alireza Ebrahimkhani) #5364159a7aeec92] - doc: fix filename typo (Hardanish Singh) #612979a0a40d1ed] - doc: fix typos and grammar inBUILDING.md&onboarding.md(Hardanish Singh) #61267dca7005f9d] - doc: mention --newVersion release script (Rafael Gonzaga) #61255c0dc8ddf85] - doc: correct typo in api contributing doc (Mike McCready) #61260066af38fe1] - doc: add PR-URL requirement for security backports (Rafael Gonzaga) #6125671dd46bd0c] - doc: add reusePort error behavior to net module (mag123c) #61250f6abe3ba33] - doc: note corepack package removal in distribution doc (Mike McCready) #612079059d49d8c] - doc: fix tls.connect() timeout documentation (Azad Gupta) #61079e7b34b76b0] - doc: missingpassed,errorandpassedproperties onTestContext(Xavier Stouder) #611859ae2dcfbb6] - doc: clarify threat model for application-level API exposure (Rafael Gonzaga) #611849902331a7c] - doc: correct options for net.Socket class and socket.connect (Xavier Stouder) #61179a80122d2fe] - doc: document error event on readline InterfaceConstructor (Xavier Stouder) #6117038d73c9cfa] - doc: add a smooth scrolling effect to the sidebar (btea) #5900795c51fa984] - doc: correct invalid collaborator profile (JJ) #61091f5a044763c] - doc: exclude compile-time flag features from security policy (Matteo Collina) #61109b6ebf2cd53] - doc: add @avivkeller to collaborators (Aviv Keller) #6111535854f424d] - doc: add gurgunday to collaborators (Gürgün Dayıoğlu) #610944932322c29] - doc: add File modes cross-references in fs methods (Mohit Raj Saxena) #60286c84904e047] - doc: add missingzstdto mjs example of zlib (Deokjin Kim) #60915e615b9e2f2] - doc: clarify fileURLToPath security considerations (Rafael Gonzaga) #6088799e384e6d4] - doc: replace column with columnNumber in example ofutil.getCallSites(Deokjin Kim) #608819351bb4d02] - doc: correct spelling in BUILDING.md (Rich Trott) #60875e1f6e7fc4d] - doc: update debuglog examples to use 'foo-bar' instead of 'foo' (xiaoyao) #60867ccbb2d7300] - doc: fix typos in changelogs (Rich Trott) #608551cb2fe8b35] - doc: mark module.register as active development (Chengzhong Wu) #60849ceeb4968a6] - doc: add fullName property to SuiteContext (PaulyBearCoding) #6076256155909dd] - doc: keep sidebar module visible when navigating docs (Botato) #604106b637763d5] - doc: correct concurrency wording in test() documentation (Azad Gupta) #607737183e8ffa1] - doc: clarify that CQ only picks up PRs targetingmain(René) #60731d5d94303be] - doc: clarify license section and add contributor note (KaleruMadhu) #60590e0210c8f53] - doc: correct tls ALPNProtocols types (René) #60143eff87b498a] - doc: remove mention of SMS 2FA (Antoine du Hamel) #60707e77ef94a51] - doc:domain.add()does not accept timer objects (René) #606754fe19c95ea] - doc: update Collaborators list to reflect hybrist handle change (Antoine du Hamel) #60650eece59b6ce] - doc: fix linter issues (Antoine du Hamel) #606366e17e596e4] - doc: correct values/references for buffer.kMaxLength (René) #60305ac327ae9a7] - doc: recommend events.once to manage 'close' event (Dan Fabulich) #60017d9b149ea42] - doc: highlight module loading difference between import and require (Ajay A) #59815f6d62cb22c] - doc: fix typo inprocess.unrefdocumentation (우혁) #596986d5078b196] - doc: add some entries toglossary.md(Mohataseem Khan) #59277b0a5820dea] - doc: improve agent.createConnection docs for http and https agents (JaeHo Jang) #58205b5db02fe67] - doc: fix pseudo code in modules.md (chirsz) #57677e9b912d481] - doc: add missing variable in code snippet (Koushil Mankali) #5547844c06c7812] - doc: add missing word insingle-executable-applications.md(Konstantin Tsabolov) #53864482b43f160] - doc: fix typo in http.md (Michael Solomon) #59354cd323bc718] - doc: update devcontainer.json and add documentation (Joyee Cheung) #60472c7c70f3a16] - doc: add haramj as triager (Haram Jeong) #6034804b8c4d14e] - doc: clarify require(esm) description (dynst) #60520de382dc832] - doc: instantiate resolver object (Donghoon Nam) #60476b6845ce460] - doc: clarify --use-system-ca support status (Joyee Cheung) #603400894dae9bc] - doc: add missing CAA type to dns.resolveAny() & dnsPromises.resolveAny() (Jimmy Leung) #58899c86a69f692] - doc: useanyforworker_threads.Worker'error' event argumenterr(Jonas Geiler) #603000c5031e233] - doc: update decorator documentation to reflect actual policy (Muhammad Salman Aziz) #60288b01f710175] - doc: document wildcard supported by tools/test.py (Joyee Cheung) #60265b4524dabcc] - doc: fixblob.bytes()heading level (XTY) #602525df02776e3] - doc: fix not working code example in vm docs (Artur Gawlik) #602246a4359a0b5] - doc: improve code snippet alternative of url.parse() using WHATWG URL (Steven) #60209ad06bee70d] - doc: use markdown when branch-diff major release (Rafael Gonzaga) #60179c0d4b11ed4] - doc: update teams in collaborator-guide.md and add links (Bart Louwers) #6006520b5ffcac3] - doc: update previous version links in BUILDING (Mike McCready) [#61457](https://redirect.github.com/nConfiguration
📅 Schedule: (in timezone Europe/Stockholm)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.