Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 9 updates - #1104

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-f4013029b8
Closed

chore(deps): bump the minor-and-patch group across 1 directory with 9 updates#1104
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-f4013029b8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the minor-and-patch group with 9 updates in the / directory:

Package From To
express 5.2.1 5.3.0
express-rate-limit 8.7.0 8.7.1
@googleapis/drive 26.0.1 26.0.2
libphonenumber-js 1.13.14 1.13.15
@electron/rebuild 4.2.0 4.2.1
@formatjs/icu-messageformat-parser 3.5.20 3.5.21
@types/node 26.6.4 26.6.5
electron 44.5.1 44.7.0
js-yaml 5.4.2 5.4.3

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits
  • c2e30b3 8.7.1
  • b40a390 v8.7.1 changelog
  • ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
  • 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
  • 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
  • 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
  • 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
  • 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
  • 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
  • 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
  • Additional commits viewable in compare view

Updates @googleapis/drive from 26.0.1 to 26.0.2

Release notes

Sourced from @​googleapis/drive's releases.

drive: v26.0.2

26.0.2 (2026-10-03)

Bug Fixes

firestore: v26.0.2

26.0.2 (2026-10-07)

Bug Fixes

  • firestore: update the API (ab6fd3e)
Commits
  • 01de2bd chore: release main (#4027)
  • de81ef6 feat: regenerate index files
  • 06d08ca feat(youtube)!: update the API
  • 608bebf fix(workstations): update the API
  • 1c40b99 fix(webcontentpublisher): update the API
  • f37655f feat(threatintelligence): update the API
  • c02e987 fix(sts): update the API
  • 37a914b feat(storagebatchoperations): update the API
  • 36e4ce4 feat(storage): update the API
  • 9978a9b feat(solar): update the API
  • Additional commits viewable in compare view

Updates libphonenumber-js from 1.13.14 to 1.13.15

Changelog

Sourced from libphonenumber-js's changelog.

1.13.15 / 8.10.2026

  • Updated metadata to version 9.0.41:
    • Updated phone metadata for region code(s): CN, IR, NG, US
    • Updated short number metadata for region code(s): CN
    • Updated carrier data for country calling code(s): 27 (en), 30 (en), 60 (en), 98 (en, fa), 234 (en), 852 (en, zh, zh_Hant)
    • Updated / refreshed time zone meta data.
Commits

Updates @electron/rebuild from 4.2.0 to 4.2.1

Release notes

Sourced from @​electron/rebuild's releases.

v4.2.1

4.2.1 (2026-10-06)

Bug Fixes

Commits
  • d62d5a2 ci: set cache-mode on release workflows (#1307)
  • 3e6bfd1 fix: include target platform in .forge-meta rebuild marker (#1319)
  • e355454 chore(deps): bump undici from 6.28.0 to 6.28.1 in /test/fixture/workspace-tes...
  • 90f2542 chore(deps): bump brace-expansion from 5.0.7 to 5.0.12 (#1317)
  • af5c214 ci: add required-ci gate job (#1312)
  • 6a69b7c chore(deps): bump markdown-it from 14.2.0 to 14.3.2 (#1315)
  • 037e7d9 chore(deps): bump azure/login from 3.0.1 to 3.1.0 (#1321)
  • 8b14ce8 chore(deps): bump undici from 6.28.0 to 6.28.1 in /test/fixture/native-app1 (...
  • 7bb45ee chore(deps): bump undici from 6.27.0 to 6.28.1 (#1313)
  • dd050f3 build(deps-dev): upgrade vitest to v5 (#1310)
  • Additional commits viewable in compare view

Updates @formatjs/icu-messageformat-parser from 3.5.20 to 3.5.21

Release notes

Sourced from @​formatjs/icu-messageformat-parser's releases.

@​formatjs/icu-messageformat-parser: 3.5.21

3.5.21 (2026-10-05)

Bug Fixes

  • @​formatjs/icu-messageformat-parser: tolerate MicrosoftAjax startsWith override (#7549) (6b3869a)
Changelog

Sourced from @​formatjs/icu-messageformat-parser's changelog.

3.5.21 (2026-10-05)

Bug Fixes

  • @​formatjs/icu-messageformat-parser: tolerate MicrosoftAjax startsWith override (#7549) (6b3869a)
Commits
  • 2a07f47 chore: release main (#7517)
  • 6b3869a fix(@​formatjs/icu-messageformat-parser): tolerate MicrosoftAjax startsWith ov...
  • See full diff in compare view

Updates @types/node from 26.6.4 to 26.6.5

Commits

Updates electron from 44.5.1 to 44.7.0

Release notes

Sourced from electron's releases.

electron v44.7.0

Release Notes for v44.7.0

Features

  • The macOS autoUpdater now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. #54204

Fixes

  • Fixed an uncatchable TypeError in net.fetch when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. #54672

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. #54666
  • Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. #54657

electron v44.6.0

Release Notes for v44.6.0

Features

  • Added the experimental protocol.registerSource() to serve a custom scheme from directories on disk without a JavaScript handler. #54522 (Also in 45)

Fixes

  • Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. #54596
  • Fixed a crash on navigator.usb.requestDevice() in in-memory sessions. #54616 (Also in 45)
  • Fixed webview.findInPage() hanging when the host page also has an iframe. #54586 (Also in 43, 45)
  • Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. #54623

Documentation

  • Documentation changes: #54589
Commits
  • 61f55c4 test: bound hidden overlay cold-process runs (#54689)
  • a0c11d9 feat: roll Squirrel.Mac for streamed, resumable and delta update downloads (#...
  • 44cac48 test: wait for stable focus before checking openExternal removes focus (#54690)
  • 505edea test: wait for the webview guest to load before navigating it (#54673)
  • fbb54bb test: run WebContentsView focusOnNavigation and shell.openExternal specs seri...
  • 06209a5 fix(net): support non-ASCII headers and multiple cookies in net.fetch (#54672)
  • 74f6399 chore: cherry-pick 47 changes from angle, chromium, dawn, fontconfig, skia, v...
  • 3d7bdb5 test: add mouse-input addon for setIgnoreMouseEvents specs (#54605)
  • 0498bc7 chore: cherry-pick 8 changes from angle, chromium, skia, v8 and webrtc (#54657)
  • d165ab9 test: listen for both singleton exits before either can happen (#54601)
  • Additional commits viewable in compare view

Updates js-yaml from 5.4.2 to 5.4.3

Changelog

Sourced from js-yaml's changelog.

[5.4.3] - 2026-10-06

Fixed

  • Fixed loading a whitespace-only block scalar followed by a less indented line, #802.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 9…
f394996 
… updates

Bumps the minor-and-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.7.0` | `8.7.1` |
| [@googleapis/drive](https://github.com/googleapis/google-api-nodejs-client) | `26.0.1` | `26.0.2` |
| [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) | `1.13.14` | `1.13.15` |
| [@electron/rebuild](https://github.com/electron/rebuild) | `4.2.0` | `4.2.1` |
| [@formatjs/icu-messageformat-parser](https://github.com/formatjs/formatjs/tree/HEAD/packages/icu-messageformat-parser) | `3.5.20` | `3.5.21` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` |
| [electron](https://github.com/electron/electron) | `44.5.1` | `44.7.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.2` | `5.4.3` |



Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `express-rate-limit` from 8.7.0 to 8.7.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.7.0...v8.7.1)

Updates `@googleapis/drive` from 26.0.1 to 26.0.2
- [Release notes](https://github.com/googleapis/google-api-nodejs-client/releases)
- [Commits](googleapis/google-api-nodejs-client@v26.0.1...drive-v26.0.2)

Updates `libphonenumber-js` from 1.13.14 to 1.13.15
- [Changelog](https://gitlab.com/catamphetamine/libphonenumber-js/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/catamphetamine/libphonenumber-js/compare/v1.13.14...v1.13.15)

Updates `@electron/rebuild` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/electron/rebuild/releases)
- [Commits](electron/rebuild@v4.2.0...v4.2.1)

Updates `@formatjs/icu-messageformat-parser` from 3.5.20 to 3.5.21
- [Release notes](https://github.com/formatjs/formatjs/releases)
- [Changelog](https://github.com/formatjs/formatjs/blob/main/packages/icu-messageformat-parser/CHANGELOG.md)
- [Commits](https://github.com/formatjs/formatjs/commits/@formatjs/icu-messageformat-parser@3.5.21/packages/icu-messageformat-parser)

Updates `@types/node` from 26.6.4 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `electron` from 44.5.1 to 44.7.0
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v44.5.1...v44.7.0)

Updates `js-yaml` from 5.4.2 to 5.4.3
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.4.2...5.4.3)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: express-rate-limit
  dependency-version: 8.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@googleapis/drive"
  dependency-version: 26.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: libphonenumber-js
  dependency-version: 1.13.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@electron/rebuild"
  dependency-version: 4.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@formatjs/icu-messageformat-parser"
  dependency-version: 3.5.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: electron
  dependency-version: 44.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: js-yaml
  dependency-version: 5.4.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested review from itsbkm and khaira777 as code owners October 12, 2026 20:19
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 12, 2026
@dependabot
dependabot Bot requested a review from carvalab as a code owner October 12, 2026 20:19
@coderabbitai

coderabbitai Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: FreeOpenSourcePOS/FloCafe/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: d99104ae-2f25-4c28-adb0-467bf14fc3c4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@khaira777 khaira777 mentioned this pull request Oct 13, 2026
Merged
@khaira777

khaira777 commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

Superseded and landed via consolidated dependency PR #1109 (d0c35f3).

@khaira777 khaira777 closed this Oct 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-f4013029b8 branch October 13, 2026 16:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@itsbkm itsbkm Awaiting requested review from itsbkm itsbkm is a code owner
@khaira777 khaira777 Awaiting requested review from khaira777 khaira777 is a code owner
@carvalab carvalab Awaiting requested review from carvalab carvalab is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@khaira777