chore(deps): bump the production-dependencies group across 1 directory with 12 updates by dependabot[bot] · Pull Request #71 · octraban/octraban_backend

dependabot · 2026-09-21T09:22:20Z

Bumps the production-dependencies group with 12 updates in the / directory:

Package	From	To
@aws-sdk/client-s3	`3.1090.0`	`3.1135.0`
@graphql-tools/schema	`10.0.38`	`10.1.1`
@opentelemetry/auto-instrumentations-node	`0.78.0`	`0.80.0`
@opentelemetry/exporter-trace-otlp-http	`0.220.0`	`0.222.0`
@opentelemetry/sdk-node	`0.220.0`	`0.222.0`
axios	`1.18.1`	`1.20.0`
express	`4.22.2`	`4.22.3`
graphql-yoga	`5.21.2`	`5.24.1`
morgan	`1.11.0`	`1.12.1`
multer	`2.2.0`	`2.4.0`
redis	`6.1.0`	`6.2.1`
ws	`8.21.1`	`8.21.3`

Updates @aws-sdk/client-s3 from 3.1090.0 to 3.1135.0

Release notes

Sourced from @aws-sdk/client-s3's releases.

v3.1135.0

3.1135.0(2026-09-17)

Documentation Changes

client-sns: SNS API reference documentation update (0e22e2d7)

New Features

client-connect: Made the replicaAlias attribute optional in the ReplicateInstance API to support Global routing for Amazon Connect Global Resiliency (ACGR) instances. This change maintains backward compatibility. When onboarding to ACGR without Global routing, you must specify a custom replicaAlias in your API call (f134c352)

client-ec2: Adding support for "Tunnel" VPC Endpoint (cb7c9bc5)

client-notifications: Added support for attachments on managed notification events. Added support to access and subscribe sensitive managed notification events. (c8a9cc10)

client-guardduty: This change surfaces AI Protection resources on existing public IAM attack sequences. Customers will now see which model was accessed and whether a guardrail intervened as part of the credential-compromise sequence. (854ccbfa)

client-sesv2: Added support to query the tenant name for BatchGetMetricData and CreateExportJob APIs to filter metrics and messages at the tenant level. (3beafcbc)

client-iot-wireless: Adds Multi-frame GNSS support to the AWS IoT Core Device Location GetPositionEstimate API. The new GnssMultiFrame measurement type improves location accuracy by combining multiple GNSS signal captures (2, 4, 8, 16, or 32) from the same device to estimate its position. (294ad0a3)

client-vpc-lattice: Adding support for CIDR Resource Configuration (46656caf)

client-socialmessaging: Add support for WhatsApp Calling APIs. (b897c28f)

client-bedrock-agentcore: Batch evaluation now supports evaluating specific traces within a session. Each session can specify up to 100 trace IDs to evaluate. (fac9ee4c)

For list of updated packages, view updated-packages.md in assets-3.1135.0.zip

v3.1134.0

3.1134.0(2026-09-16)

Chores

lib-transfer-manager: apply formatting (#8306) (b8f7c4e4)

New Features

client-customer-profiles: This release introduces the SearchRecommendations API, which retrieves recommendations for a profile identified by a search key. (a0388656)

client-marketplace-catalog: This release enhances the ListEntities API to support issuerAccountId and SourceAuthorization filter for ResaleAuthorization entity. (f2379c20)

client-ec2: Releasing new EC2 R9g and R9gd memory-optimized instances powered by AWS Graviton5 processors, with up to 25 percent better compute performance than R8g instances, faster DDR5 memory, and up to 100 Gbps network and 72 Gbps EBS bandwidth. R9gd instances additionally provide local NVMe SSD storage. (30aea54d)

client-connect: Adds support for ContactAnalysis via ListContactReferences. (983124f4)

client-elastic-beanstalk: Adds support to create and manage Elastic Beanstalk Cluster Environments. (fc0ab53f)

client-bedrock-agentcore-control: Adds support for a new DELETE FAILED status for Bedrock AgentCore Runtimes and Bedrock AgentCore Runtime Endpoints. (c5d84415)

client-resiliencehubv2: Next Gen Resilience Hub now supports dependency insights (LLM-based insights about customer's service dependencies) and organization-level policy sharing (provision to share policy with member accounts for an organization) (4d415b51)

Bug Fixes

lib-transfer-manager: update transfer progress events (#8292) (8c690c23)

For list of updated packages, view updated-packages.md in assets-3.1134.0.zip

... (truncated)

Changelog

Sourced from @aws-sdk/client-s3's changelog.

3.1135.0 (2026-09-17)

Note: Version bump only for package @aws-sdk/client-s3

3.1134.0 (2026-09-16)

Note: Version bump only for package @aws-sdk/client-s3

3.1133.0 (2026-09-15)

Note: Version bump only for package @aws-sdk/client-s3

3.1132.0 (2026-09-14)

Note: Version bump only for package @aws-sdk/client-s3

3.1131.0 (2026-09-11)

Note: Version bump only for package @aws-sdk/client-s3

3.1130.0 (2026-09-10)

Note: Version bump only for package @aws-sdk/client-s3

3.1129.0 (2026-09-09)

... (truncated)

Commits

2d5f18d Publish v3.1135.0
0d6310b Publish v3.1134.0
615a1ca Publish v3.1133.0
99b4bd0 Publish v3.1132.0
33f2cc7 Publish v3.1131.0
996d664 docs(client-s3): Updated S3 Object Lock Default Retention documentation.
cd49ceb Publish v3.1130.0
cece980 Publish v3.1129.0
523fff6 Publish v3.1128.0
8b58987 feat(client-s3): Adds support for Amazon S3 Object Lock variable retention. ...
Additional commits viewable in compare view

Updates @graphql-tools/schema from 10.0.38 to 10.1.1

Changelog

Sourced from @graphql-tools/schema's changelog.

10.1.1

Patch Changes

Updated dependencies [2262087, 5523c4b, 60db079, 57e316d, 1c1c5a0, 1c1c5a0, 0b9529f]:

@graphql-tools/merge@9.2.4

@graphql-tools/utils@12.0.1

10.1.0

Minor Changes

#8346 2273c21 Thanks @ardatan! - This release adds GraphQL v17 support and aligns the existing executor implementation with the latest GraphQL v17 API changes. The following changes are included:

getAsyncHelpers is now available on GraphQLResolveInfo. Its track method is used whenever waitUntil is available, as in Yoga's Explicit Resource Management

getAbortSignal is now available on GraphQLResolveInfo, matching behavior that was already available in this executor implementation, as in Yoga's Execution Cancellation

GraphQLResolveInfo automatically aligns variableValues according to the GraphQL version for better compatibility. In GraphQL v17 and above, variableValues follows the wrapped shape ({ coerced, sources }) expected by GraphQL APIs. In GraphQL v16 and below, variableValues remains a flat map as in previous versions.

If your custom scalar resolvers define __serialize and __parseValue, they are automatically mapped to coerceOutputValue and coerceInputValue in GraphQL v17.

BREAKING: @graphql-tools/executor's getVariableValues now returns { variableValues } on success, where variableValues is a VariableValues object ({ coerced, sources }). On failure, it returns { errors }.

BREAKING: collectFields, shouldIncludeNode, getDeferValues, and collectSubFields now need a VariableValues object instead of Record<string, any> for the variableValues argument.

visitResult now internally normalizes ExecutionRequest.variables into a VariableValues-compatible shape ({ coerced, sources }) before traversing selections.

Patch Changes

Updated dependencies [2273c21, 7fe0319]:

@graphql-tools/utils@12.0.0

@graphql-tools/merge@9.2.3

Commits

8b9b7df chore(release): update monorepo packages versions (#8365)
23ca392 chore(deps): update dependency graphql-scalars to v2 (#8385)
ce2470a build(deps): bump the actions-deps group with 8 updates (#8377)
0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
9feabd9 chore(release): update monorepo packages versions (#8327)
2273c21 GraphQL 17 Compatibility (#8346)
See full diff in compare view

Updates @opentelemetry/auto-instrumentations-node from 0.78.0 to 0.80.0

Release notes

Sourced from @opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.80.0

0.80.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.76.0 to ^0.77.0

@opentelemetry/instrumentation-bunyan bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-connect bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-cucumber bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-dataloader bumped from ^0.38.0 to ^0.39.0

@opentelemetry/instrumentation-dns bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-express bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-fs bumped from ^0.40.0 to ^0.41.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-graphql bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-hapi bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.4.0 to ^0.5.0

@opentelemetry/instrumentation-ioredis bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.30.0 to ^0.31.0

@opentelemetry/instrumentation-knex bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-koa bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-memcached bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-mongodb bumped from ^0.74.0 to ^0.75.0

@opentelemetry/instrumentation-mongoose bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-mysql bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-net bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-openai bumped from ^0.19.0 to ^0.20.0

@opentelemetry/instrumentation-oracledb bumped from ^0.46.0 to ^0.47.0

@opentelemetry/instrumentation-pg bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-pino bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-redis bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-restify bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-router bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.34.0 to ^0.35.0

@opentelemetry/instrumentation-socket.io bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-tedious bumped from ^0.40.0 to ^0.41.0

... (truncated)

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.80.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.76.0 to ^0.77.0

@opentelemetry/instrumentation-bunyan bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-connect bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-cucumber bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-dataloader bumped from ^0.38.0 to ^0.39.0

@opentelemetry/instrumentation-dns bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-express bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-fs bumped from ^0.40.0 to ^0.41.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-graphql bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-hapi bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.4.0 to ^0.5.0

@opentelemetry/instrumentation-ioredis bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.30.0 to ^0.31.0

@opentelemetry/instrumentation-knex bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-koa bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-memcached bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-mongodb bumped from ^0.74.0 to ^0.75.0

@opentelemetry/instrumentation-mongoose bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-mysql bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-net bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-openai bumped from ^0.19.0 to ^0.20.0

@opentelemetry/instrumentation-oracledb bumped from ^0.46.0 to ^0.47.0

@opentelemetry/instrumentation-pg bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-pino bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-redis bumped from ^0.69.0 to ^0.70.0

@opentelemetry/instrumentation-restify bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-router bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.34.0 to ^0.35.0

@opentelemetry/instrumentation-socket.io bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-tedious bumped from ^0.40.0 to ^0.41.0

@opentelemetry/instrumentation-undici bumped from ^0.31.0 to ^0.32.0

... (truncated)

Commits

932fc96 chore: release main (#3638)
015582a feat(deps): update deps matching '@opentelemetry/*' (#3716)
27e172a chore: release main (#3596)
466d5de feat(deps): update deps matching '@opentelemetry/*' (#3629)
b7efd7b chore(*): migrate to sdk-trace (#3599)
3ae8a1b fix(auto-instrumentations-node): avoid duplicate diag logger warning in regis...
See full diff in compare view

Updates @opentelemetry/exporter-trace-otlp-http from 0.220.0 to 0.222.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.220.0 to 0.222.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

... (truncated)

Commits

84a9f3b chore(release): prepare release 1.20.0 (#11152)
e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
d19040b fix: harden runtime option handling (#11141)
e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
2c94646 chore(deps): b...
Description has been truncated

…y with 12 updates Bumps the production-dependencies group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1090.0` | `3.1135.0` | | [@graphql-tools/schema](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/schema) | `10.0.38` | `10.1.1` | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.78.0` | `0.80.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.222.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.222.0` | | [axios](https://github.com/axios/axios) | `1.18.1` | `1.20.0` | | [express](https://github.com/expressjs/express) | `4.22.2` | `4.22.3` | | [graphql-yoga](https://github.com/graphql-hive/graphql-yoga/tree/HEAD/packages/graphql-yoga) | `5.21.2` | `5.24.1` | | [morgan](https://github.com/expressjs/morgan) | `1.11.0` | `1.12.1` | | [multer](https://github.com/expressjs/multer) | `2.2.0` | `2.4.0` | | [redis](https://github.com/redis/node-redis) | `6.1.0` | `6.2.1` | | [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` | Updates `@aws-sdk/client-s3` from 3.1090.0 to 3.1135.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1135.0/clients/client-s3) Updates `@graphql-tools/schema` from 10.0.38 to 10.1.1 - [Release notes](https://github.com/ardatan/graphql-tools/releases) - [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/schema/CHANGELOG.md) - [Commits](https://github.com/ardatan/graphql-tools/commits/@graphql-tools/schema@10.1.1/packages/schema) Updates `@opentelemetry/auto-instrumentations-node` from 0.78.0 to 0.80.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.80.0/packages/auto-instrumentations-node) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.220.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.222.0) Updates `@opentelemetry/sdk-node` from 0.220.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.222.0) Updates `axios` from 1.18.1 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.18.1...v1.20.0) Updates `express` from 4.22.2 to 4.22.3 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.3/History.md) - [Commits](expressjs/express@v4.22.2...v4.22.3) Updates `graphql-yoga` from 5.21.2 to 5.24.1 - [Release notes](https://github.com/graphql-hive/graphql-yoga/releases) - [Changelog](https://github.com/graphql-hive/graphql-yoga/blob/main/packages/graphql-yoga/CHANGELOG.md) - [Commits](https://github.com/graphql-hive/graphql-yoga/commits/graphql-yoga@5.24.1/packages/graphql-yoga) Updates `morgan` from 1.11.0 to 1.12.1 - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.11.0...1.12.1) Updates `multer` from 2.2.0 to 2.4.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.2.0...v2.4.0) Updates `redis` from 6.1.0 to 6.2.1 - [Release notes](https://github.com/redis/node-redis/releases) - [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md) - [Commits](https://github.com/redis/node-redis/compare/redis@6.1.0...redis@6.2.1) Updates `ws` from 8.21.1 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.1...8.21.3) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1135.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@graphql-tools/schema" dependency-version: 10.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.80.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.222.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.222.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: express dependency-version: 4.22.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: graphql-yoga dependency-version: 5.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: morgan dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: multer dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: redis dependency-version: 6.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: ws dependency-version: 8.21.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026

Navigation Menu

chore(deps): bump the production-dependencies group across 1 directory with 12 updates - #71

chore(deps): bump the production-dependencies group across 1 directory with 12 updates#71
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-f4a688b412

dependabot Bot commented on behalf of github Sep 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.1135.0

3.1135.0(2026-09-17)

Documentation Changes

New Features

v3.1134.0

3.1134.0(2026-09-16)

Chores

New Features

Bug Fixes

3.1135.0 (2026-09-17)

3.1134.0 (2026-09-16)

3.1133.0 (2026-09-15)

3.1132.0 (2026-09-14)

3.1131.0 (2026-09-11)

3.1130.0 (2026-09-10)

3.1129.0 (2026-09-09)

10.1.1

Patch Changes

10.1.0

Minor Changes

Patch Changes

auto-instrumentations-node: v0.80.0

0.80.0 (2026-08-31)

Features

Dependencies

0.80.0 (2026-08-31)

Features

Dependencies

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

v1.20.0 — August 19, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.19.0 - July 22, 2026

🔒 Security Fixes

Changelog

v1.19.0 — July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 21, 2026 •

edited

Loading