chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates by dependabot[bot] · Pull Request #79 · Karelaking/fack-api

dependabot · 2026-10-29T20:35:56Z

Bumps the npm_and_yarn group with 8 updates in the /.agents/skills/dependency-auditor/test-project directory:

Package	From	To
axios	`1.5.0`	`1.20.0`
mongoose	`6.10.0`	`6.13.10`
multer	`1.4.5-lts.1`	`2.5.0`
sharp	`0.32.1`	`0.35.5`
nodemailer	`6.9.1`	`10.1.4`
moment	`2.29.4`	`2.31.0`
@babel/core	`7.22.1`	`7.29.6`
postcss	`8.4.23`	`8.5.23`

Updates axios from 1.5.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)

UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)

Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)

Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)

URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)

Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)

Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)

Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)

XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)

HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)

TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)

Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)

Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)

Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)

Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)

Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)

Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)

Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

@lazerg (#11194)

@QIU-Guanzong (#11228)

@Iams4kura (#11125)

@vjymisal0 (#11179)

@jarrensj (#11238)

@LineGu (#11132)

@luantaraschi (#11134)

... (truncated)

Commits

84a9f3b chore(release): prepare release 1.20.0 (#11152)
e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
d19040b fix: harden runtime option handling (#11141)
e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
ba98559 docs: add ScrapingBee sponsor (#11137)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates mongoose from 6.10.0 to 6.13.10

Release notes

Sourced from mongoose's releases.

6.13.9 / 2026-02-04

fix: handle other top-level query operators in sanitizeFilter

types(aggregate): add $firstN, $lastN, $bottom, $bottomN, $minN and $maxN operators #15303 #15299

docs(compatibility): add note that Mongoose ^6.5 works with MongoDB server 7.x #15427

Changelog

Sourced from mongoose's changelog.

6.13.10 / 2026-06-22

fix(document): add additional defensive checks for special properties in Document.prototype.get()

fix(schema): avoid returning inherited properties from schema path lookups

6.13.9 / 2026-02-04

fix: handle other top-level query operators in sanitizeFilter

types(aggregate): add $firstN, $lastN, $bottom, $bottomN, $minN and $maxN operators #15303 #15299

docs(compatibility): add note that Mongoose ^6.5 works with MongoDB server 7.x #15427

6.13.8 / 2025-01-20

chore: remove coverage output from bundle

6.13.7 / 2025-01-20

chore: re-release to force npm audit to pick up 6.x fix for CVE-2025-23061

6.13.6 / 2025-01-13

fix: disallow nested $where in populate match CVE-2025-23061

6.13.5 / 2024-11-26

fix: disallow using $where in match

6.13.4 / 2024-11-15

fix: save execution stack in query as string #15043 #15039

docs: clarify strictQuery default will flip-flop in "Migrating to 6.x" #14998 markstos

6.13.3 / 2024-09-23

docs(migrating_to_6): document that Lodash _.isEmpty() with ObjectId() as a parameter returns true in Mongoose 6 #11152

6.13.2 / 2024-09-12

fix(document): make set() respect merge option on deeply nested objects #14870 #14878

6.13.1 / 2024-09-06

fix: remove empty $and, $or, $not that were made empty by scrict mode #14749 #13086 0x0a0d

6.13.0 / 2024-06-06

feat(model): add throwOnValidationError option for opting into getting MongooseBulkWriteError if all valid operations succeed in bulkWrite() and insertMany() #14599 #14587 #14572 #13410

6.12.9 / 2024-05-24

... (truncated)

Commits

424b7d0 downgrade back to mongodb-memory-server@8
4047e14 use mongodb-memory-server 9 for older node version support
743298f use mongodb-memory-server@10.x to avoid bson issue with mongodb/js-bson#884
83039b4 chore: release 6.13.10
65efcb9 fix(document): additional defensive checks in Document.prototype.get()
fab793b fix(schema): only return own properties in schematype lookups
c859ca4 chore: add new tools to npmignore
473a92e style: fix lint
40e1af0 quick fix for no elvis operator in node 12
068ee25 chore: release 6.13.9
Additional commits viewable in compare view

Updates multer from 1.4.5-lts.1 to 2.5.0

Release notes

Sourced from multer's releases.

v2.5.0

Important: Security

Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)

What's Changed

docs: fix typo in .none() and grammar in .any() by @haimingZZ in expressjs/multer#1485

fix: don't add a failed upload to the abort cleanup list by @UlisesGascon in expressjs/multer#1489

fix: allow a field value exactly at the fieldSize limit by @MaxFreedomPollard in expressjs/multer#1481

chore(deps): bump github/codeql-action/init from 4.37.9 to 4.38.2 by @dependabot[bot] in expressjs/multer#1488

chore(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 by @dependabot[bot] in expressjs/multer#1487

chore(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.2 by @dependabot[bot] in expressjs/multer#1486

Release: 2.5.0 by @UlisesGascon in expressjs/multer#1490

New Contributors

@haimingZZ made their first contribution in expressjs/multer#1485

Full Changelog: expressjs/multer@v2.4.0...v2.5.0

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).
const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})
This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

... (truncated)

Changelog

Sourced from multer's changelog.

2.5.0

Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)

Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#1481)

Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#1489)

2.4.0

Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)

Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)

Accept a function for limits, called with the request, to set limits per request (#1133)

Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)

Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)

Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)

Allow multer.diskStorage() to be called without options (#1471)

Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)

Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)

Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)

Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)

Files skipped by fileFilter no longer count towards maxCount (#1426)

Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)

Remove the concat-stream dependency (#1356)

Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)

Docs: add FormData upload examples (#896)

Docs: remove the translated READMEs (#1463)

Internal: run the test suite on macOS (#1464)

2.3.0

Fix CVE-2026-77078 (GHSA-wc9g-mqfw-jrwm)

Fix CVE-2026-77037 (GHSA-qfvm-cv95-jqjf)

Fix CVE-2026-77063 (GHSA-qvfw-j98x-7q72)

Fix CVE-2026-82333 (GHSA-535w-7cp7-47q4)

Add MulterError codes INVALID_FIELD_NAME and STREAM_DESTROYED

Add opt-in limits.fieldArrayIndexLimit to bound numeric array indexes in field names (#1438)

Accept files whose size is exactly limits.fileSize (#1407)

Preserve the caller's async context (AsyncLocalStorage) when calling next() (#1124)

Decode WHATWG-escaped characters (%0A, %0D, %22) in file.originalname (#1421)

Do not crash when fileFilter invokes its callback more than once (#1427)

Use a fallback message for MulterError codes without a mapping (#1448)

Docs: clarify preservePath and parts, use crypto.randomBytes in the DiskStorage example (#1414, #1430, #1436)

Docs: add Indonesian, Japanese and Tamil translations and refresh all translations from the current README (#1431, #1354, #1462)

Internal: run the test suite on Windows (#1334)

2.2.0

Fix CVE-2026-5038 (GHSA-3p4h-7m6x-2hcm)

Fix CVE-2026-5079 (GHSA-72gw-mp4g-v24j)

2.1.1

... (truncated)

Commits

2c380d0 2.5.0 (#1490)
80a2d9d fix: swallow late busboy error after teardown
c901d48 chore(deps): bump github/codeql-action/analyze to 4.38.2 (#1486)
ba3619a chore(deps): bump github/codeql-action/upload-sarif (#1487)
0b72081 chore(deps): bump github/codeql-action/init to 4.38.2 (#1488)
7661ce7 fix: allow a field value exactly at the fieldSize limit (#1481)
6dac92f fix: don't add a failed upload to the abort cleanup list (#1489)
dd9f062 docs: fix typo in .none() and grammar in .any() (#1485)
35979e5 2.4.0 (#1469)
b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.

Updates sharp from 0.32.1 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

Add upper bounds check on length of linear and GIF delay arrays.

Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

TypeScript: Remove non-existent named export. #4604

Increase accepted dimensions when extending an image. #4605

Improve gain map support for extract and rotate operations. #4606

Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

Add upper bounds check on length of linear and GIF delay arrays.

Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

TypeScript: Remove non-existent named export. #4604

Increase accepted dimensions when extending an image. #4605

Improve gain map support for extract operation. #4606

... (truncated)

Commits

51a990f Release v0.35.5
96de105 Upgrade to sharp-libvips v1.3.4
3a61390 CI: Configure Dependabot with all package.json locations
4940c50 Improve gain map support for rotate/flip/flop ops
20654aa Prerelease v0.35.5-rc.1
ef4f934 CI: Upgrade to Ubuntu 26.04
358df95 Upgrade to libvips v8.18.7
49f4903 Improve gain map support for rotate-then-extract #4606
0e2e55e Silence a couple of compiler/static analysis warnings
cef3b8c Improve gain map support for extract operation #4606
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sharp since your current version.

Updates nodemailer from 6.9.1 to 10.1.4

Release notes

Sourced from nodemailer's releases.

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)

addressparser: bound group nesting at ten levels (ce63303)

addressparser: drop the obsolete route from an angle-addr (3dbc730)

addressparser: end a comment only at the ")" that closes the outermost one (0a87617)

addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)

addressparser: never read a mailbox out of a comment (a1538ea)

addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)

addressparser: read the first addr-spec of the display text (038940a)

split a domain literal off at the "@" in front of it (d5983b0)

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

format References and strip URLs in linear time, release any number of streams (2f18641)

v10.1.2

10.1.2 (2026-10-16)

Bug Fixes

bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

v10.1.1

10.1.1 (2026-10-14)

Bug Fixes

fetch: strip credentials on any cross-origin redirect (a15360c)

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.

connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.

Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.

A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.

With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.4 (2026-10-18)

Bug Fixes

addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)

addressparser: bound group nesting at ten levels (ce63303)

addressparser: drop the obsolete route from an angle-addr (3dbc730)

addressparser: end a comment only at the ")" that closes the outermost one (0a87617)

addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)

addressparser: never read a mailbox out of a comment (a1538ea)

addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)

addressparser: read the first addr-spec of the display text (038940a)

split a domain literal off at the "@" in front of it (d5983b0)

10.1.3 (2026-10-18)

Bug Fixes

format References and strip URLs in linear time, release any number of streams (2f18641)

10.1.2 (2026-10-16)

Bug Fixes

bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

10.1.1 (2026-10-14)

Bug Fixes

fetch: strip credentials on any cross-origin redirect (a15360c)

10.1.0 (2026-10-10)

Features

harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

do not read the environment or the interface table on import (094179d)

end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)

keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)

let the proxy handshake and the SMTP connection share one deadline (91ed683)

... (truncated)

Commits

2a7e952 chore(master): release 10.1.4 (#1897)
038940a fix(addressparser): read the first addr-spec of the display text
ce63303 fix(addressparser): bound group nesting at ten levels
a1538ea fix(addressparser): never read a mailbox out of a comment
3dbc730 fix(addressparser): drop the obsolete route from an angle-addr
ba3c095 fix(addressparser): read CFWS beside the "@" of an addr-spec as nothing
d5983b0 fix: split a domain literal off at the "@" in front of it
ee35f57 fix(addressparser): apply the unexpected "<" rule outside quotes and comments
0a87617 fix(addressparser): end a comment only at the ")" that closes the outermost one
1cd57d2 fix(addressparser): honour quoted strings and comments inside an angle-addr a...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nodemailer since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates moment from 2.29.4 to 2.31.0

Release notes

Sourced from moment's releases.

2.31.0

Released Sep 14, 2026

Security fixes

Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

#6376 Prevent object prototype properties from being used as format tokens

#6386 Normalize lazy-loaded locale names

#6404 Fix parsing issue with eHHmm format

#6433 Ignore non-Moment arguments in min and max

#6434 Fix inherited lowercase long date formats

#6436 Reset locale parsing caches after updates

#6437 Fix weekday mismatch when the format only has part of a date

#6442 Fix locale('__proto__') corrupting the global locale

#6443 Avoid Object.assign in duration.humanize

#6446 Validate range when parsing a time zone offset

#6447 Include metadata in all-locales bundle

#6448 Apply postformat to locale relative time methods

#6450 Add stack traces to conditional deprecation warnings

New features

#6451 Add internal date-default hook for Moment Timezone

New locales

#6000: Pash...
Description has been truncated

…dates Bumps the npm_and_yarn group with 8 updates in the /.agents/skills/dependency-auditor/test-project directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.5.0` | `1.20.0` | | [mongoose](https://github.com/Automattic/mongoose) | `6.10.0` | `6.13.10` | | [multer](https://github.com/expressjs/multer) | `1.4.5-lts.1` | `2.5.0` | | [sharp](https://github.com/lovell/sharp) | `0.32.1` | `0.35.5` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.1` | `10.1.4` | | [moment](https://github.com/moment/moment) | `2.29.4` | `2.31.0` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.22.1` | `7.29.6` | | [postcss](https://github.com/postcss/postcss) | `8.4.23` | `8.5.23` | Updates `axios` from 1.5.0 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.5.0...v1.20.0) Updates `mongoose` from 6.10.0 to 6.13.10 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/6.13.10/CHANGELOG.md) - [Commits](Automattic/mongoose@6.10.0...6.13.10) Updates `multer` from 1.4.5-lts.1 to 2.5.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v1.4.5-lts.1...v2.5.0) Updates `sharp` from 0.32.1 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.32.1...v0.35.5) Updates `nodemailer` from 6.9.1 to 10.1.4 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.1...v10.1.4) Updates `moment` from 2.29.4 to 2.31.0 - [Release notes](https://github.com/moment/moment/releases) - [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md) - [Commits](moment/moment@2.29.4...2.31.0) Updates `@babel/core` from 7.22.1 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `postcss` from 8.4.23 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.23...8.5.23) --- updated-dependencies: - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mongoose dependency-version: 6.13.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: multer dependency-version: 2.5.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 10.1.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: moment dependency-version: 2.31.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-10-29T20:35:59Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
fack-api	Ready	Preview	Oct 29, 2026 8:38pm UTC

codecov-commenter · 2026-10-29T20:37:51Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

dependabot Bot added dependencies javascript Pull requests that update javascript code labels Oct 29, 2026

github-actions Bot removed the dependencies label Oct 29, 2026

vercel Bot deployed to Preview October 29, 2026 20:38

View deployment

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates - #79

chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates#79
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dot-agents/skills/dependency-auditor/test-project/npm_and_yarn-625243a112

dependabot Bot commented on behalf of github Oct 29, 2026

Uh oh!

vercel Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Oct 29, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 29, 2026

v1.20.0 — August 19, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.19.0 - July 22, 2026

🔒 Security Fixes

Changelog

v1.21.0 — October 21, 2026

⚠️ Breaking Changes & Deprecations

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

6.13.9 / 2026-02-04

6.13.10 / 2026-06-22

6.13.9 / 2026-02-04

6.13.8 / 2025-01-20

6.13.7 / 2025-01-20

6.13.6 / 2025-01-13

6.13.5 / 2024-11-26

6.13.4 / 2024-11-15

6.13.3 / 2024-09-23

6.13.2 / 2024-09-12

6.13.1 / 2024-09-06

6.13.0 / 2024-06-06

6.12.9 / 2024-05-24

v2.5.0

Important: Security

What's Changed

New Contributors

v2.4.0

Highlights

2.5.0

2.4.0

2.3.0

2.2.0

2.1.1

v0.35.5

v0.35.5-rc.1

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

v10.1.2

10.1.2 (2026-10-16)

Bug Fixes

v10.1.1

10.1.1 (2026-10-14)

Bug Fixes

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

10.1.4 (2026-10-18)

Bug Fixes

10.1.3 (2026-10-18)

Bug Fixes

10.1.2 (2026-10-16)

Bug Fixes

10.1.1 (2026-10-14)

Bug Fixes

10.1.0 (2026-10-10)

Features

Bug Fixes

2.31.0

Security fixes

Bug fixes

New features

New locales

Uh oh!

vercel Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov-commenter commented Oct 29, 2026

Codecov Report

vercel Bot commented Oct 29, 2026 •

edited

Loading