Skip to content

deps(backend): bump the backend-minor-patch group in /Servers with 20 updates - #4750

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/Servers/backend-minor-patch-e6ec7e9d0a
Closed

deps(backend): bump the backend-minor-patch group in /Servers with 20 updates#4750
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/Servers/backend-minor-patch-e6ec7e9d0a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the backend-minor-patch group in /Servers with 20 updates:

Package From To
@ai-sdk/anthropic 4.0.52 4.0.56
@ai-sdk/openai 4.0.65 4.0.69
@aws-sdk/client-ses 3.1130.0 3.1135.0
@daytonaio/sdk 0.211.2 0.214.0
ai 7.0.97 7.0.105
bullmq 6.3.4 6.3.6
cron-parser 5.10.0 5.10.1
google-auth-library 11.0.2 11.1.0
jsdom 30.0.1 30.1.0
langfuse 3.38.20 3.39.2
mammoth 1.12.2 1.12.3
multer 2.3.0 2.4.0
nodemailer 10.0.3 10.0.10
resend 6.27.0 6.28.1
xstate 5.32.6 5.33.2
zod 4.6.2 4.6.5
@types/node 26.5.1 26.6.1
@types/nodemailer 8.0.1 8.0.2
jszip 3.10.1 3.10.2
prettier 3.9.6 3.9.8

Updates @ai-sdk/anthropic from 4.0.52 to 4.0.56

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

4.0.56

Patch Changes

  • d4d96bf: Add anthropic.evaluationModel() for experimental Choice, Score, and Boolean evaluations through Messages structured output, with exact labels, validated score bounds, and prompted Boolean P(true) estimates validated to be in [0, 1]. Boolean estimates are not guaranteed to be calibrated; application code chooses thresholds.
  • Updated dependencies [215b25e]
  • Updated dependencies [d4d96bf]
  • Updated dependencies [a7dd893]
  • Updated dependencies [3456e2c]
  • Updated dependencies [c4e76de]
    • @​ai-sdk/provider-utils@​5.0.43
    • @​ai-sdk/provider@​4.0.17

4.0.55

Patch Changes

  • 132bdae: feat(anthropic): add 20260318 web search and web fetch tools with response inclusion controls
  • Updated dependencies [91c2128]
  • Updated dependencies [2cd80b3]
  • Updated dependencies [d06bb2a]
  • Updated dependencies [123d71f]
  • Updated dependencies [2fa5e0e]
    • @​ai-sdk/provider-utils@​5.0.42
    • @​ai-sdk/provider@​4.0.16

4.0.54

Patch Changes

  • Updated dependencies [5c0054d]
  • Updated dependencies [39535af]
    • @​ai-sdk/provider@​4.0.15
    • @​ai-sdk/provider-utils@​5.0.41

4.0.53

Patch Changes

  • 5ec21a6: fix: reject unsupported batch request types
  • 7469a3b: feat: support image generation requests in batches
  • e4292e7: feat(anthropic): expand preserved thinking support to cover prefix_mismatch_behavior: 'error'
  • Updated dependencies [5ec21a6]
  • Updated dependencies [7469a3b]
  • Updated dependencies [813bb36]
  • Updated dependencies [c43e4b7]
    • @​ai-sdk/provider@​4.0.14
    • @​ai-sdk/provider-utils@​5.0.40
Commits
  • 1a82df1 Version Packages (#20860)
  • 215b25e fix(provider-utils): default language-model evaluations to no reasoning (#20868)
  • d4d96bf feat: add experimental evaluation models and shared adapter to openai, google...
  • c60b9d3 Version Packages (#20799)
  • 132bdae feat: add Anthropic 20260318 web search and fetch tools with response inclusi...
  • c83bc67 feat(bedrock,vertex): add Claude Fable 5.1 model IDs to Bedrock and Vertex pr...
  • ccecb2d Version Packages (#20765)
  • 9ed46d2 Version Packages (#20569)
  • e4292e7 feat(anthropic): expand preserved thinking support to cover `prefix_mismatch_...
  • 7469a3b feat: support image generation requests in batches (#20594)
  • Additional commits viewable in compare view

Updates @ai-sdk/openai from 4.0.65 to 4.0.69

Changelog

Sourced from @​ai-sdk/openai's changelog.

4.0.69

Patch Changes

  • d4d96bf: Add experimental Choice, Score, and Boolean evaluations through openai.evaluationModel() and a shared structured language-model evaluation adapter in @ai-sdk/provider-utils/experimental-evaluation. Preserve exact labels and metadata, validate score bounds, and return prompted Boolean P(true) estimates validated to be in [0, 1]. Boolean estimates are not guaranteed to be calibrated; application code chooses thresholds.
  • Updated dependencies [215b25e]
  • Updated dependencies [d4d96bf]
  • Updated dependencies [a7dd893]
  • Updated dependencies [3456e2c]
  • Updated dependencies [c4e76de]
    • @​ai-sdk/provider-utils@​5.0.43
    • @​ai-sdk/provider@​4.0.17

4.0.68

Patch Changes

  • Updated dependencies [91c2128]
  • Updated dependencies [2cd80b3]
  • Updated dependencies [d06bb2a]
  • Updated dependencies [123d71f]
  • Updated dependencies [2fa5e0e]
    • @​ai-sdk/provider-utils@​5.0.42
    • @​ai-sdk/provider@​4.0.16

4.0.67

Patch Changes

  • 5c0054d: Add optional browser-direct WebRTC for experimental client-delegated Live conversations alongside the existing WebSocket path. Exchange SDP through an application endpoint with api.session, configure server-owned data-channel permissions, and preserve committed React session ownership. Capture follows the selected sender track, borrowed tracks remain caller-owned, and disconnect recovery and finalization stay bounded. Applications continue to handle client delegation and submit context; Live session updates and Responses delegation remain unsupported.

    Serialize microphone sender changes and close the peer if detachment fails, without stopping borrowed tracks. Validate nonempty SDP setup answers with a bounded response body, and document the same-origin broker authentication contract.

  • 39535af: Add experimental OpenAI Live provider support through the unified openai.experimental_realtime factory for server WebSocket sessions with client delegation. Applications own their agents and tools, receive continuous audio/transcript events and delegation metadata, and return context through validated channels. Support immutable startup options, microphone mute controls, graceful session close, and cumulative voice usage. Responses delegation and Live session updates reject before sending.

    Route known Live model IDs to Live, allow an OpenAI-specific api override for early-access models, and preserve legacy Realtime defaults for unknown IDs. Token minting follows the same selection rules and rejects Live before requesting unsupported credentials. Extend the realtime v4 specification with optional server WebSocket configuration, per-connection raw-event parsers, and model-wide startup/finalization capabilities. This provider layer supplies connection settings and protocol mapping for server adapters; browser lifecycle and UI integration belong to the core runtime and framework hooks.

    Preserve Realtime client event IDs for session updates and audio appends, and correlate server errors with the originating client event.

  • Updated dependencies [5c0054d]

  • Updated dependencies [39535af]

    • @​ai-sdk/provider@​4.0.15
    • @​ai-sdk/provider-utils@​5.0.41

4.0.66

Patch Changes

  • 5ec21a6: fix: reject unsupported batch request types
  • 7469a3b: feat: support image generation requests in batches

... (truncated)

Commits

Updates @aws-sdk/client-ses from 3.1130.0 to 3.1135.0

Release notes

Sourced from @​aws-sdk/client-ses's releases.

v3.1135.0

3.1135.0(2026-09-17)

Documentation Changes
  • client-sns: SNS API reference documentation update (0e22e2d7)
New Features
  • client-connect: Made the replicaAlias attribute optional in the ReplicateInstance API to support Global routing for Amazon Connect Global Resiliency (ACGR) instances. This change maintains backward compatibility. When onboarding to ACGR without Global routing, you must specify a custom replicaAlias in your API call (f134c352)
  • client-ec2: Adding support for "Tunnel" VPC Endpoint (cb7c9bc5)
  • client-notifications: Added support for attachments on managed notification events. Added support to access and subscribe sensitive managed notification events. (c8a9cc10)
  • client-guardduty: This change surfaces AI Protection resources on existing public IAM attack sequences. Customers will now see which model was accessed and whether a guardrail intervened as part of the credential-compromise sequence. (854ccbfa)
  • client-sesv2: Added support to query the tenant name for BatchGetMetricData and CreateExportJob APIs to filter metrics and messages at the tenant level. (3beafcbc)
  • client-iot-wireless: Adds Multi-frame GNSS support to the AWS IoT Core Device Location GetPositionEstimate API. The new GnssMultiFrame measurement type improves location accuracy by combining multiple GNSS signal captures (2, 4, 8, 16, or 32) from the same device to estimate its position. (294ad0a3)
  • client-vpc-lattice: Adding support for CIDR Resource Configuration (46656caf)
  • client-socialmessaging: Add support for WhatsApp Calling APIs. (b897c28f)
  • client-bedrock-agentcore: Batch evaluation now supports evaluating specific traces within a session. Each session can specify up to 100 trace IDs to evaluate. (fac9ee4c)

For list of updated packages, view updated-packages.md in assets-3.1135.0.zip

v3.1134.0

3.1134.0(2026-09-16)

Chores
New Features
  • client-customer-profiles: This release introduces the SearchRecommendations API, which retrieves recommendations for a profile identified by a search key. (a0388656)
  • client-marketplace-catalog: This release enhances the ListEntities API to support issuerAccountId and SourceAuthorization filter for ResaleAuthorization entity. (f2379c20)
  • client-ec2: Releasing new EC2 R9g and R9gd memory-optimized instances powered by AWS Graviton5 processors, with up to 25 percent better compute performance than R8g instances, faster DDR5 memory, and up to 100 Gbps network and 72 Gbps EBS bandwidth. R9gd instances additionally provide local NVMe SSD storage. (30aea54d)
  • client-connect: Adds support for ContactAnalysis via ListContactReferences. (983124f4)
  • client-elastic-beanstalk: Adds support to create and manage Elastic Beanstalk Cluster Environments. (fc0ab53f)
  • client-bedrock-agentcore-control: Adds support for a new DELETE FAILED status for Bedrock AgentCore Runtimes and Bedrock AgentCore Runtime Endpoints. (c5d84415)
  • client-resiliencehubv2: Next Gen Resilience Hub now supports dependency insights (LLM-based insights about customer's service dependencies) and organization-level policy sharing (provision to share policy with member accounts for an organization) (4d415b51)
Bug Fixes
  • lib-transfer-manager: update transfer progress events (#8292) (8c690c23)

For list of updated packages, view updated-packages.md in assets-3.1134.0.zip

... (truncated)

Changelog

Sourced from @​aws-sdk/client-ses's changelog.

3.1135.0 (2026-09-17)

Note: Version bump only for package @​aws-sdk/client-ses

3.1134.0 (2026-09-16)

Note: Version bump only for package @​aws-sdk/client-ses

3.1133.0 (2026-09-15)

Note: Version bump only for package @​aws-sdk/client-ses

3.1132.0 (2026-09-14)

Note: Version bump only for package @​aws-sdk/client-ses

3.1131.0 (2026-09-11)

Note: Version bump only for package @​aws-sdk/client-ses

Commits

Updates @daytonaio/sdk from 0.211.2 to 0.214.0

Release notes

Sourced from @​daytonaio/sdk's releases.

v0.214.0

0.214.0 (2026-09-15)

🚀 Features

  • sdk-java: add Image.addLocalFile and addLocalDir with build-context uploads (#251)

🩹 Fixes

  • cli: default ssh --expires to the API default of 60 minutes (#246)
  • sdk-python,sdk-ruby,sdk-typescript: keep COPY sources after backslash-terminated comments and fix Ruby COPY parsing (#259)
  • sdk-python,sdk-typescript: parse Dockerfile COPY instructions correctly in from_dockerfile (#253)
  • sdk-ruby: parse .env files without shell command substitution (#247)
  • sdk-ruby: verify the TLS peer on WebSocket dials (#249)
  • sdk-typescript: apply the ESM require shim to every file that needs it (#248)

Chores

  • sync go.sum for v0.211.2 (#245)
  • fix broken Slack and DCO guideline links in contributor guides (#252)
  • deps: batch dependabot updates 2026-09-14 (#258)

❤️ Thank You

Commits
  • 202ffd2 chore(deps): batch dependabot updates 2026-09-14 (#258)
  • c47b215 fix(sdk-python,sdk-ruby,sdk-typescript): keep COPY sources after backslash-te...
  • 589ae81 fix(sdk-python,sdk-typescript): parse Dockerfile COPY instructions correctly ...
  • 4f6db56 chore: fix broken Slack and DCO guideline links in contributor guides (#252)
  • 11dadab feat(sdk-java): add Image.addLocalFile and addLocalDir with build-context upl...
  • 80bce48 fix(sdk-typescript): apply the ESM require shim to every file that needs it (...
  • 7f00db1 fix(sdk-ruby): verify the TLS peer on WebSocket dials (#249)
  • 246056d fix(sdk-ruby): parse .env files without shell command substitution (#247)
  • 24b8511 fix(cli): default ssh --expires to the API default of 60 minutes (#246)
  • 4e2d4fe chore: sync go.sum for v0.211.2 (#245)
  • See full diff in compare view

Updates ai from 7.0.97 to 7.0.105

Changelog

Sourced from ai's changelog.

7.0.105

Patch Changes

  • 6982e9d: Resolve evaluation model IDs through AI Gateway when no default provider is configured, including string aliases in custom providers.
  • Updated dependencies [6982e9d]
  • Updated dependencies [6982e9d]
    • @​ai-sdk/gateway@​4.0.85

7.0.104

Patch Changes

  • a7dd893: Add experimental evaluation model aliases and registry resolution. customProvider accepts evaluationModels, registries expose evaluationModel, and experimental_evaluate accepts string IDs when an evaluation-capable default provider is explicitly configured. Evaluation never implicitly falls back to Gateway. Model-resolution errors now identify evaluationModel while stable provider contracts remain unchanged.
  • 227f3b0: fix(ai): report abnormal realtime WebSocket close diagnostics through onError
  • 3456e2c: feat(ai): support tool search with direct tool calling
  • c4e76de: feat(ai): add native tool search tool
  • Updated dependencies [215b25e]
  • Updated dependencies [d4d96bf]
  • Updated dependencies [a7dd893]
  • Updated dependencies [3456e2c]
  • Updated dependencies [c4e76de]
    • @​ai-sdk/provider-utils@​5.0.43
    • @​ai-sdk/provider@​4.0.17
    • @​ai-sdk/gateway@​4.0.84

7.0.103

Patch Changes

  • 91c2128: feat(ai): add mid conversation tool discovery/updates for code-mode
  • 25a0447: feat(ai): deprecate rawInput in output-error UI message parts
  • 2cd80b3: Keep default Node.js downloads protected by DNS validation and connection pinning when frameworks or instrumentation wrap global fetch before or after the SDK loads.
  • 123d71f: Add experimental_evaluate and the isolated experimental v4 evaluation model specification for Choice, Score, and Boolean questions against shared state. Includes typed answers, optional Choice/Score distributions, required Boolean probabilities, validation, retries, cancellation, and Experimental_EvaluationUnsupportedQuestionTypeError for unsupported questions.
  • Updated dependencies [91c2128]
  • Updated dependencies [0c9ab5a]
  • Updated dependencies [2cd80b3]
  • Updated dependencies [d06bb2a]
  • Updated dependencies [123d71f]
  • Updated dependencies [2fa5e0e]
  • Updated dependencies [2cce7da]
    • @​ai-sdk/provider-utils@​5.0.42
    • @​ai-sdk/gateway@​4.0.83
    • @​ai-sdk/provider@​4.0.16

7.0.102

Patch Changes

  • 5c0054d: Add optional browser-direct WebRTC for experimental client-delegated Live conversations alongside the existing WebSocket path. Exchange SDP through an application endpoint with api.session, configure server-owned data-channel permissions, and preserve committed React session ownership. Capture follows the selected sender track, borrowed tracks remain caller-owned, and disconnect recovery and finalization stay bounded. Applications continue to handle client delegation and submit context; Live session updates and Responses delegation remain unsupported.

... (truncated)

Commits

Updates bullmq from 6.3.4 to 6.3.6

Release notes

Sourced from bullmq's releases.

v6.3.6

6.3.6 (2026-09-14)

Bug Fixes

  • bun: allow nested duplicate() on lazy Bun adapter (#4723) (438a1d8)

v6.3.5

6.3.5 (2026-09-14)

Bug Fixes

  • deps: update dependency cron-parser to v5.10.1 (#4738) (d4b0414)
Commits

Updates cron-parser from 5.10.0 to 5.10.1

Release notes

Sourced from cron-parser's releases.

v5.10.1

What's Changed

Full Changelog: harrisiirak/cron-parser@v5.10.0...v5.10.1

Changelog

Sourced from cron-parser's changelog.

v5.10.1 - 2026-09-12

What's Changed

Full Changelog: harrisiirak/cron-parser@v5.10.0...v5.10.1

Commits
  • 5b08cdf chore: bump version
  • 1d5867c chore: update dev deps
  • 95bac55 fix: bound field value expansion at parse time (#450)
  • 7b3a0ad chore: add more funding sources to FUNDING.yml
  • fc5ca7b chore: add Patreon username for funding support
  • 03444a8 chore: update dev deps
  • 4fd8809 fix: reject duplicate zero values in field validation (#445)
  • See full diff in compare view

Updates google-auth-library from 11.0.2 to 11.1.0

Release notes

Sourced from google-auth-library's releases.

google-auth-library: v11.1.0

11.1.0 (2026-09-15)

Features

Changelog

Sourced from google-auth-library's changelog.

11.1.0 (2026-09-15)

Features

Commits

Updates jsdom from 30.0.1 to 30.1.0

Release notes

Sourced from jsdom's releases.

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

  • Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
  • Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
  • Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
  • Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
  • Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
  • Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
  • Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
  • Changed window.close() to preserve access to the document and its DOM through retained references.
  • Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
  • Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
  • Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
  • Fixed :focus matching in shadow trees. (@​asamuzaK)
  • Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
  • Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
  • Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
  • Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
  • Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
  • Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
  • Fixed successful cached resource loads being treated as aborted.
  • Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
  • Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
  • Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
  • Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
  • Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
  • Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
  • Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)
  • Fixed serialization of min() and max() containing nested calc(), which regressed in v30.0.0. (@​asamuzaK)
  • Fixed CSS values mixing lengths or percentages with math functions, such as 'grid-template-columns' values containing both 100px and calc(). (@​rome-xi)
  • Fixed parsing of 'background' and 'border' shorthands with adjacent components, such as url(a.png)no-repeat, including a crash when parsing inline styles. Also fixed handling of invalid shorthand assignments and escaped or unusual characters in CSS declarations. (@​asamuzaK)
  • Fixed parsing of unitless zero values in 'flex' shorthands, such as 35 1 0, and rejection of negative 'flex-basis' lengths and percentages. (@​asamuzaK)
  • Fixed shorthand style assignments producing extra mutation records and custom element callbacks for intermediate values. (@​scttcper)
  • Fixed Range and Selection handling of CDATA sections, including boundary offsets and range cloning, extraction, deletion, insertion, and stringification. (@​scttcper)
  • Fixed text.normalize() incorrectly removing the text node or merging its siblings. (@​scttcper)
  • Fixed cloning and importing CDATA sections and processing instructions whose contents have been modified, and serialization of CDATA sections adopted into HTML documents.
  • Fixed stale named-property collections on window, and incorrect named access from empty or namespaced id="" and name="" values. (@​scttcper)
  • Fixed elements in documents created with DOMParser or document.implementation.createHTMLDocument() appearing as named properties on window and being retained in memory. (@​Iaotle)
  • Fixed memory leaks from mutation observers retaining observed nodes, abort signals retaining removed event listeners, and storage event tracking retaining closed windows. (@​scttcper)
  • Fixed storage events being sent to windows created after the storage change, and ensured surviving recipients still receive events when the source document is destroyed.
  • Fixed attribute lookups after namespace prefix changes, and namespaced attributes incorrectly affecting ID lookups and element behavior. (@​scttcper)
  • Fixed input.list in detached element trees. (@​scttcper)
  • Fixed attr.ownerDocument after setting an attribute node on an element in another document or adopting its element. (@​Kjubikstronk)

... (truncated)

Commits
  • 556b11f 30.1.0
  • 9547fbf Tie queued tasks to document lifetime
  • 3be65d9 Disable unused HTML reports in the WPT runner
  • d555e61 Replace SymbolTree with a DOM-specific tree
  • f28983d Clone CDATA and processing instructions without revalidation
  • 33e4fa7 Invalidate computed styles after CSS imports load
  • ec6fd5b Select storage event recipients at mutation time
  • bcc037a Honor script type and legacy event attributes
  • faa5c4f Preserve currentScript across nested scripts
  • 8d7a37f Avoid quadratic HTML collection iteration
  • Additional commits viewable in compare view

Updates langfuse from 3.38.20 to 3.39.2

Commits
  • 9ec3a77 v3.39.2
  • cf95870 docs: strengthen agent-facing deprecation banners on legacy v3 packages (#951)
  • ac2fda4 v3.39.1
  • 2044d0c v3.39.0
  • 79271c7 chore(deprecation): route legacy v3 packages to the current @langfuse/* SDK (...
  • See full diff in compare view

Updates mammoth from 1.12.2 to 1.12.3

Changelog

Sourced from mammoth's changelog.

1.12.3

  • Avoid excessive backtracking when parsing an unterminated string with many escape sequences. The previous behaviour would allow maliciously crafted documents to cause a denial of service.

    Note that it is still strongly recommended to process untrusted documents in a separate thread with a timeout to avoid potential similar issues.

  • Handle complex field separator and end characters without corresponding start characters.

Commits
  • 71fe5da Bump version to 1.12.3
  • 5fe085d Update node to 26.8.2
  • f1fc26f Start warning with capital letter
  • 62d4d33 Handle missing complex field start characters
  • dc49225 Avoid excessive backtracking when parsing unterminated strings
  • See full diff in compare view

Updates multer from 2.3.0 to 2.4.0

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from multer's changelog.

2.4.0

  • Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
  • Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
  • Accept a function for limits, called with the request, to set limits per request (#1133)
  • Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
  • Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
  • Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
  • Allow multer.diskStorage() to be called without options (#1471)
  • Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.bodyDescription has been truncated

@dependabot
deps(backend): bump the backend-minor-patch group
d31a1c7 
Bumps the backend-minor-patch group in /Servers with 20 updates:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `4.0.52` | `4.0.56` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `4.0.65` | `4.0.69` |
| [@aws-sdk/client-ses](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ses) | `3.1130.0` | `3.1135.0` |
| [@daytonaio/sdk](https://github.com/daytona/clients) | `0.211.2` | `0.214.0` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.97` | `7.0.105` |
| [bullmq](https://github.com/taskforcesh/bullmq) | `6.3.4` | `6.3.6` |
| [cron-parser](https://github.com/harrisiirak/cron-parser) | `5.10.0` | `5.10.1` |
| [google-auth-library](https://github.com/googleapis/google-cloud-node/tree/HEAD/core/packages/google-auth-library-nodejs) | `11.0.2` | `11.1.0` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.0.1` | `30.1.0` |
| [langfuse](https://github.com/langfuse/langfuse-js/tree/HEAD/langfuse) | `3.38.20` | `3.39.2` |
| [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.12.2` | `1.12.3` |
| [multer](https://github.com/expressjs/multer) | `2.3.0` | `2.4.0` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `10.0.3` | `10.0.10` |
| [resend](https://github.com/resend/resend-node) | `6.27.0` | `6.28.1` |
| [xstate](https://github.com/statelyai/xstate) | `5.32.6` | `5.33.2` |
| [zod](https://github.com/colinhacks/zod) | `4.6.2` | `4.6.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.1` | `26.6.1` |
| [@types/nodemailer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/nodemailer) | `8.0.1` | `8.0.2` |
| [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` |


Updates `@ai-sdk/anthropic` from 4.0.52 to 4.0.56
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@4.0.56/packages/anthropic)

Updates `@ai-sdk/openai` from 4.0.65 to 4.0.69
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.69/packages/openai)

Updates `@aws-sdk/client-ses` from 3.1130.0 to 3.1135.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ses/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1135.0/clients/client-ses)

Updates `@daytonaio/sdk` from 0.211.2 to 0.214.0
- [Release notes](https://github.com/daytona/clients/releases)
- [Commits](daytona/clients@v0.211.2...v0.214.0)

Updates `ai` from 7.0.97 to 7.0.105
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.105/packages/ai)

Updates `bullmq` from 6.3.4 to 6.3.6
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v6.3.4...v6.3.6)

Updates `cron-parser` from 5.10.0 to 5.10.1
- [Release notes](https://github.com/harrisiirak/cron-parser/releases)
- [Changelog](https://github.com/harrisiirak/cron-parser/blob/master/CHANGELOG.md)
- [Commits](harrisiirak/cron-parser@v5.10.0...v5.10.1)

Updates `google-auth-library` from 11.0.2 to 11.1.0
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/core/packages/google-auth-library-nodejs/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/google-auth-library-v11.1.0/core/packages/google-auth-library-nodejs)

Updates `jsdom` from 30.0.1 to 30.1.0
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.0.1...v30.1.0)

Updates `langfuse` from 3.38.20 to 3.39.2
- [Release notes](https://github.com/langfuse/langfuse-js/releases)
- [Commits](https://github.com/langfuse/langfuse-js/commits/v3.39.2/langfuse)

Updates `mammoth` from 1.12.2 to 1.12.3
- [Release notes](https://github.com/mwilliamson/mammoth.js/releases)
- [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS)
- [Commits](mwilliamson/mammoth.js@1.12.2...1.12.3)

Updates `multer` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.3.0...v2.4.0)

Updates `nodemailer` from 10.0.3 to 10.0.10
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.0.3...v10.0.10)

Updates `resend` from 6.27.0 to 6.28.1
- [Release notes](https://github.com/resend/resend-node/releases)
- [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md)
- [Commits](resend/resend-node@v6.27.0...v6.28.1)

Updates `xstate` from 5.32.6 to 5.33.2
- [Release notes](https://github.com/statelyai/xstate/releases)
- [Commits](https://github.com/statelyai/xstate/compare/xstate@5.32.6...xstate@5.33.2)

Updates `zod` from 4.6.2 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.2...v4.6.5)

Updates `@types/node` from 26.5.1 to 26.6.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/nodemailer` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/nodemailer)

Updates `jszip` from 3.10.1 to 3.10.2
- [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md)
- [Commits](Stuk/jszip@v3.10.1...v3.10.2)

Updates `prettier` from 3.9.6 to 3.9.8
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.6...3.9.8)

---
updated-dependencies:
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 4.0.56
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: "@ai-sdk/openai"
  dependency-version: 4.0.69
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: "@aws-sdk/client-ses"
  dependency-version: 3.1135.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: "@daytonaio/sdk"
  dependency-version: 0.214.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: ai
  dependency-version: 7.0.105
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: bullmq
  dependency-version: 6.3.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: cron-parser
  dependency-version: 5.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: google-auth-library
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: jsdom
  dependency-version: 30.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: langfuse
  dependency-version: 3.39.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: mammoth
  dependency-version: 1.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: multer
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: nodemailer
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: resend
  dependency-version: 6.28.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: xstate
  dependency-version: 5.33.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: "@types/nodemailer"
  dependency-version: 8.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: jszip
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: prettier
  dependency-version: 3.9.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file Minor security labels Sep 21, 2026
MuhammadKhalilzadeh added a commit that referenced this pull request Sep 23, 2026
@MuhammadKhalilzadeh
deps(backend): combine 21 dependabot bumps (group + dotenv + msal-nod…
38140c6 
…e 6)

Combines dependabot PRs #4750 (backend-minor-patch group, 20 updates),
#4751 (dotenv 18) and #4752 (@azure/msal-node 6). Lockfile regenerated
via npm install; 0 vulnerabilities. Verified: tsc clean, 316 suites /
4583 unit tests pass (msal usage is a single ConfidentialClientApplication
import in user.ctrl.ts).
@MuhammadKhalilzadeh MuhammadKhalilzadeh mentioned this pull request Sep 23, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/Servers/backend-minor-patch-e6ec7e9d0a branch September 23, 2026 18:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file Minor security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants