chore(deps): bump the npm_and_yarn group across 2 directories with 28 updates by dependabot[bot] · Pull Request #1 · AKNiS/apitable

dependabot · 2025-12-02T06:14:30Z

Bumps the npm_and_yarn group with 10 updates in the /packages/room-server directory:

Package	From	To
@grpc/grpc-js	`1.8.21`	`1.8.22`
@nestjs/common	`8.1.2`	`10.4.16`
axios	`0.21.2`	`0.30.2`
dompurify	`3.0.5`	`3.2.4`
express	`4.18.1`	`4.22.0`
form-data	`3.0.1`	`3.0.4`
js-yaml	`4.1.0`	`4.1.1`
mysql2	`3.9.7`	`3.9.8`
nodemailer	`6.9.5`	`7.0.11`
typeorm	`0.2.45`	`0.3.26`

Bumps the npm_and_yarn group with 20 updates in the / directory:

Package	From	To
@grpc/grpc-js	`1.8.21`	`1.8.22`
@nestjs/common	`8.1.2`	`10.4.16`
axios	`0.21.4`	`0.30.2`
dompurify	`3.0.5`	`3.2.4`
express	`4.18.1`	`4.22.0`
form-data	`3.0.1`	`3.0.4`
js-yaml	`4.1.0`	`4.1.1`
mysql2	`3.9.7`	`3.9.8`
nodemailer	`6.9.5`	`7.0.11`
typeorm	`0.2.45`	`0.3.26`
@sentry/browser	`7.92.0`	`7.119.1`
http-proxy-middleware	`2.0.6`	`2.0.9`
nanoid	`4.0.2`	`5.0.9`
next	`12.3.4`	`14.2.32`
prismjs	`1.29.0`	`1.30.0`
react-pdf	`5.4.0`	`7.7.3`
rollup	`4.1.4`	`4.22.4`
store2	`2.14.2`	`2.14.4`
@75lb/deep-merge	`1.1.1`	`1.1.2`
@babel/helpers	`7.22.15`	`7.28.4`

Updates @grpc/grpc-js from 1.8.21 to 1.8.22

Release notes

Sourced from @grpc/grpc-js's releases.

@grpc/grpc-js 1.8.22

Avoid buffering significantly more than grpc.max_receive_message_size per received message.

Commits

a8a0203 Merge pull request from GHSA-7v5v-9h63-cj86
3b110cd grpc-js: Bump to 1.8.22
8e62222 grpc-js: Avoid buffering significantly more than max_receive_message_size per...
9d83947 Merge pull request #2742 from sergiitk/backport-1.8-psm-interop-common-prod-t...
00f348c Merge pull request #2729 from sergiitk/psm-interop-common-prod-tests
36d105b Merge pull request #2737 from murgatroid99/backport-1.8-grpc-js_linkify-it_fix
969e305 Merge pull request #2735 from murgatroid99/grpc-js_linkify-it_fix
d78216f Merge pull request #2715 from sergiitk/backport-1.8-psm-interop-pkg-dev
f38966a Merge pull request #2712 from sergiitk/psm-interop-pkg-dev
ffefff2 Merge pull request #2640 from XuanWang-Amos/backport-1.8-psm-interop-shared-b...
Additional commits viewable in compare view

Updates @nestjs/common from 8.1.2 to 10.4.16

Release notes

Sourced from @nestjs/common's releases.

v10.4.16

What's Changed

fix(common): introduce magic file type validator to nestjs common by @Chathula in nestjs/nest#14948

Full Changelog: nestjs/nest@v10.4.15...v10.4.16

v10.4.15 (2024-12-09)

Dependencies

platform-express

#14282 fix(deps): update dependency express to v4.21.2 (@renovate[bot])

v10.4.13 (2024-12-03)

Bug fixes

common

#14256 chore(common): Add type declaration for RawBody decorator with pipes (@sapenlei)

Dependencies

#14257 fix(deps): update dependency @fastify/static to v7.0.4 (@renovate[bot])

#14258 fix(deps): update dependency @nestjs/sequelize to v10.0.1 (@renovate[bot])

#14249 chore(deps): bump @apollo/gateway from 2.4.8 to 2.8.5 in /sample/32-graphql-federation-schema-first/users-application (@dependabot[bot])

#14250 chore(deps): update jest monorepo (@renovate[bot])

#14245 chore(deps): update dependency mqtt to v5.10.3 (@renovate[bot])

#14247 fix(deps): update nest monorepo to v10.4.12 (@renovate[bot])

#14251 chore(deps-dev): bump graphql-tools from 9.0.3 to 9.0.5 (@dependabot[bot])

#14246 chore(deps): update nest monorepo (@renovate[bot])

Committers: 3

Kamil Mysliwiec (@kamilmysliwiec)

Micael Levi L. Cavalcante (@micalevisk)

sapenlei (@sapenlei)

v10.4.12 (2024-11-29)

Bug fixes

common

#14241 fix(common): enforce string type in validationpipe (@LhonRafaat)

Dependencies

Other

#14243 chore(deps): update dependency @types/node to v20.17.9 (@renovate[bot])

#14240 chore(deps): update dependency @types/multer to v1.4.12 (@renovate[bot])

#14239 chore(deps): update dependency @types/chai to v4.3.20 (@renovate[bot])

#14237 chore(deps): update confluentinc/cp-zookeeper docker tag to v7.7.2 (@renovate[bot])

#14236 chore(deps): update confluentinc/cp-kafka docker tag to v7.7.2 (@renovate[bot])

#12253 fix(deps): update apollo graphql packages (@renovate[bot])

#14235 chore(deps-dev): bump @commitlint/config-angular from 19.5.0 to 19.6.0 (@dependabot[bot])

#14233 chore(deps): update nest monorepo (@renovate[bot])

... (truncated)

Commits

6c8aec6 chore(@nestjs) publish v10.4.16 release
2b9e132 chore: update outdated tests, make file-type optional
cb0d650 chore: remove duplicate packages
6196ab2 Merge branch 'Chathula-fix-nestjs-common-mime-validator'
0ac7959 chore: minor tweaks
312a54a Update packages/common/pipes/file/file-type.validator.ts
a28fc03 refactor(common): move back file type validator options type
07b4b38 refactor(common): move file-type package to peer dependencies
0b7af8a refactor(common): refactor code to use simple eval
6953b7a fix(common): used eval import
Additional commits viewable in compare view

Updates axios from 0.21.2 to 0.30.2

Release notes

Sourced from axios's releases.

v0.30.2

What's Changed

Backport maxContentLength vulnerability fix to v0.x by @FeBe95 in axios/axios#7034

New Contributors

@FeBe95 made their first contribution in axios/axios#7034

Full Changelog: axios/axios@v0.30.1...v0.30.2

Release v0.30.1

Release notes:

Bug Fixes

chore(deps): bump form-data from 4.0.0 to 4.0.4 for v0.x by @wolandec in axios/axios#6978

Contributors to this release

@wolandec made their first contribution in axios/axios#6978

Full Changelog: axios/axios@v0.30.0...v0.30.1

Release v0.30.0

Release notes:

Bug Fixes

fix: modify log while request is aborted by @mori5321 in axios/axios#4917

fix: update CHANGELOG.md for v0.x by @TehZarathustra in axios/axios#6271

fix: modify upgrade guide for 0.28.1's breaking change by @nafeger in axios/axios#6787

fix: backport allowAbsoluteUrls vulnerability fix to v0.x by @thatguyinabeanie in axios/axios#6829

fix: add allowAbsoluteUrls type by @thatguyinabeanie in axios/axios#6849

Contributors to this release

@mori5321 made their first contribution in axios/axios#4917

@TehZarathustra made their first contribution in axios/axios#6271

@nafeger made their first contribution in axios/axios#6787

@thatguyinabeanie made their first contribution in axios/axios#6829

Full Changelog: axios/axios@v0.29.0...v0.30.0

v0.29.0

Release notes:

Bug Fixes

fix(backport): backport security fixes in commits #6167 and #6163 to v0.x by @Sean-Powell in axios/axios#6402

fix: omit nulls in params by @Willshaw in axios/axios#6394

fix(backport): fix paramsSerializer function validation by @solonzhu in axios/axios#6361

fix: Regular Expression Denial of Service (ReDoS) by @qiongshusheng in axios/axios#6708

Contributors to this release

@Sean-Powell made their first contribution in axios/axios#6402

@Willshaw made their first contribution in axios/axios#6394

@solonzhu made their first contribution in axios/axios#6361

... (truncated)

Commits

2fcb4ec chore: v0.30.2
153f483 chore: preversion
ee548ff fix: tests failing
a1b1d3f fix: backport maxContentLength vulnerability fix to v0.x (#7034)
b17c4de chore: build latest version
ad6b82a chore: build latest version
da447d5 chore(deps): bump form-data from 4.0.0 to 4.0.4 (#6978)
6e922e4 chore: added build artifacts
a06ed1e chore: added pre-release artifacts
c010622 feat: add type for allowAbsoluteUrls (#6849)
Additional commits viewable in compare view

Updates dompurify from 3.0.5 to 3.2.4

Release notes

Sourced from dompurify's releases.

DOMPurify 3.2.4

Fixed a conditional and config dependent mXSS-style bypass reported by @nsysean

Added a new feature to allow specific hook removal, thanks @davecardwell

Added purify.js and purify.min.js to exports, thanks @Aetherinox

Added better logic in case no window object is president, thanks @yehuya

Updated some dependencies called out by dependabot

Updated license files etc to show the correct year

DOMPurify 3.2.3

Fixed two conditional sanitizer bypasses discovered by @parrot409 and @Slonser

Updated the attribute clobbering checks to prevent future bypasses, thanks @parrot409

DOMPurify 3.2.2

Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @yaniv-git

Fixed several minor issues with the type definitions, thanks again @reduckted

Fixed a minor issue with the types reference for trusted types, thanks @reduckted

Fixed a minor problem with the template detection regex on some systems, thanks @svdb99

DOMPurify 3.2.1

Fixed several minor issues with the type definitions, thanks @reduckted @ghiscoding @asamuzaK @MiniDigger

Fixed an issue with non-minified dist files and order of imports, thanks @reduckted

DOMPurify 3.2.0

Added type declarations, thanks @reduckted , @philmayfield, @aloisklink, @ssi02014 and others

Fixed a minor issue with the handling of hooks, thanks @kevin-mizu

DOMPurify 3.1.7

Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @masatokinugawa

Fixed several smaller typos in documentation and test & build files, thanks @christianhg

Added better support for Angular compiler, thanks @jeroen1602

Added several new attributes to HTML and SVG allow-list, thanks @Gigabyte5671 and @Rotzbua

Removed the foreignObject element from the list of HTML entry-points, thanks @masatokinugawa

Bumped several dependencies to be more up to date

DOMPurify 3.1.6

Fixed an issue with the execution logic of attribute hooks to prevent bypasses, thanks @kevin-mizu

Fixed an issue with element removal leading to uncaught errors through DOM Clobbering, thanks @realansgar

Fixed a minor problem with the bower file pointing to the wrong dist path

Fixed several minor typos in docs, comments and comment blocks, thanks @Rotzbua

Updated several development dependencies

DOMPurify 3.1.5

Fixed a minor issue with the dist paths in bower.js, thanks @HakumenNC

Fixed a minor issue with sanitizing HTML coming from copy&paste Word content, thanks @kakao-bishop-cho

DOMPurify 3.1.4

Fixed an issue with the recently implemented isNaN checks, thanks @tulach

Added several new popover attributes to allow-list, thanks @Gigabyte5671

Fixed the tests and adjusted the test runner to cover all branches

... (truncated)

Commits

ec29e65 Merge pull request #1062 from cure53/main
1c1b183 chore: Preparing 3.2.4 release
d18ffcb fix: Changed the template literal regex to avoid a config-dependent bypass
0d64d2b Merge pull request #1060 from yehuya/initializeTestImprovements
9ad7933 tests: DOMPurify custom window tests improvements
72760ca Merge pull request #1059 from yehuya/fixMissingWindowElement
bc72d44 Fix tests
363a89d fix: handle undefined Element in DOMPurify initialization
f41b45d Update LICENSE
b25bf26 Update README.md
Additional commits viewable in compare view

Updates express from 4.18.1 to 4.22.0

Release notes

Sourced from express's releases.

4.22.0

Important: Security

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

Refactor: improve readability by @sazk07 in expressjs/express#6190

ci: add support for Node.js@23.0 by @UlisesGascon in expressjs/express#6080

Method functions with no path should error by @wesleytodd in expressjs/express#5957

ci: updated github actions ci workflow by @Phillip9587 in expressjs/express#6323

ci: reorder npm i steps to fix ci for older node versions by @Phillip9587 in expressjs/express#6336

Backport: ci: add node.js 24 to test matrix by @Phillip9587 in expressjs/express#6506

chore(4.x): wider range for query test skip by @jonchurch in expressjs/express#6513

use tilde notation for certain dependencies by @UlisesGascon in expressjs/express#6905

deps: qs@6.14.0 by @UlisesGascon in expressjs/express#6909

deps: use tilde notation for qs by @Phillip9587 in expressjs/express#6919

Release: 4.22.0 by @UlisesGascon in expressjs/express#6921

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Add funding field (v4) by @bjohansebas in expressjs/express#6065

deps: path-to-regexp@0.1.11 by @blakeembrey in expressjs/express#5956

deps: bump path-to-regexp@0.1.12 by @jonchurch in expressjs/express#6209

Release: 4.21.2 by @UlisesGascon in expressjs/express#6094

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in expressjs/express#6029

Release: 4.21.1 by @UlisesGascon in expressjs/express#6031

Full Changelog: expressjs/express@4.21.0...4.21.1

4.21.0

What's Changed

Deprecate "back" magic string in redirects by @blakeembrey in expressjs/express#5935

finalhandler@1.3.1 by @wesleytodd in expressjs/express#5954

fix(deps): serve-static@1.16.2 by @wesleytodd in expressjs/express#5951

Upgraded dependency qs to 6.13.0 to match qs in body-parser by @agadzinski93 in expressjs/express#5946

New Contributors

@agadzinski93 made their first contribution in expressjs/express#5946

... (truncated)

Changelog

Sourced from express's changelog.

4.22.0 / 2025-12-01

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

deps: use tilde notation for dependencies

deps: qs@6.14.0

4.21.2 / 2024-11-06

deps: path-to-regexp@0.1.12

Fix backtracking protection

deps: path-to-regexp@0.1.11

Throws an error on invalid path values

4.21.1 / 2024-10-08

Backported a fix for CVE-2024-47764

4.21.0 / 2024-09-11

Deprecate res.location("back") and res.redirect("back") magic string

deps: serve-static@1.16.2

includes send@0.19.0

deps: finalhandler@1.3.1

deps: qs@6.13.0

4.20.0 / 2024-09-10

deps: serve-static@0.16.0

Remove link renderization in html while redirecting

deps: send@0.19.0

Remove link renderization in html while redirecting

deps: body-parser@0.6.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

deps: path-to-regexp@0.1.10

Adds support for named matching groups in the routes using a regex

Adds backtracking protection to parameters without regexes defined

deps: encodeurl@~2.0.0

Removes encoding of \, |, and ^ to align better with URL spec

Deprecate passing options.maxAge and options.expires to res.clearCookie

Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

... (truncated)

Commits

49744ab 4.22.0 (#6921)
6e97452 sec: security patch for CVE-2024-51999
6a23d34 deps: use tilde notation for qs (#6919)
8c12cdf deps: qs@6.14.0 (#6909)
7fea74f deps: use tilde notation for certain dependencies (#6905)
dac7a04 chore: wider range for query test skip (#6513)
997919b ci: add node.js 24 to test matrix (#6506)
36fb59c fix(ci): reorder npm i steps to fix ci for older node versions (#6336)
3a5edfa fix(ci): updated github actions ci workflow (#6323)
52d9781 fix(test): add test for method routes without paths #5955
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express since your current version.

Updates form-data from 3.0.1 to 3.0.4

Release notes

Sourced from form-data's releases.

v3.0.2

Fixes

npmignore temporary build files (#532)

move util.isArray to Array.isArray (#564)

Tests

migrate from travis to GHA

Changelog

Sourced from form-data's changelog.

v3.0.4 - 2025-07-16

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] update linting config f5e7eb0

[meta] add auto-changelog d2eb290

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 e8c574c

[Fix] Switch to using crypto random for boundary values c6ced61

[Refactor] use hasown 1a78b5d

[Fix] validate boundary type in setBoundary() method 70bbaa0

[Tests] add tests to check the behavior of getBoundary with non-strings b22a64e

[meta] actually ensure the readme backup isn’t published 0150851

[meta] remove local commit hooks fc42bb9

[Dev Deps] remove unused deps a14d09e

[meta] fix scripts to use prepublishOnly 11d9f73

[meta] fix readme capitalization fc38b48

v3.0.3 - 2025-02-14

Merged

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

Fixed

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

Commits

[Refactor] use Object.prototype.hasOwnProperty.call 7fecefe

[Dev Deps] update @types/node, browserify, coveralls, cross-spawn, eslint, formidable, in-publish, pkgfiles, pre-commit, puppeteer, request, tape, typescript 8261fcb

Only apps should have lockfiles b82f590

[Dev Deps] pin request which via tough-cookie ^2.4 depends on psl e5df7f2

[Deps] update mime-types 5a5bafe

v3.0.2 - 2024-10-10

Merged

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

Commits

[Tests] migrate from travis to GHA 8fdb3bc

[eslint] clean up ignores 3217b3d

fix: move util.isArray to Array.isArray (#564) edb555a

Commits

9c82fcd v3.0.4
e8c574c [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
c6ced61 [Fix] Switch to using crypto random for boundary values
0150851 [meta] actually ensure the readme backup isn’t published
fc38b48 [meta] fix readme capitalization
d2eb290 [meta] add auto-changelog
fc42bb9 [meta] remove local commit hooks
a14d09e [Dev Deps] remove unused deps
002b9b0 [Fix] append: avoid a crash on nullish values
70bbaa0 [Fix] validate boundary type in setBoundary() method
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
See full diff in compare view

Updates mysql2 from 3.9.7 to 3.9.8

Release notes

Sourced from mysql2's releases.

v3.9.8

3.9.8 (2024-05-26)

Bug Fixes

security: sanitize fields and tables when using nestTables (#2702) (efe3db5)

support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2704) (2e03694)

typings: typo from jonServerPublicKey to onServerPublicKey (#2699) (8b5f691)

Changelog

Sourced from mysql2's changelog.

3.9.8 (2024-05-26)

Bug Fixes

security: sanitize fields and tables when using nestTables (#2702) (efe3db5)

support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2704) (2e03694)

typings: typo from jonServerPublicKey to onServerPublicKey (#2699) (8b5f691)

Commits

f637d3f chore(master): release 3.9.8 (#2700)
efe3db5 fix(security): sanitize fields and tables when using nestTables (#2702)
2e03694 fix: support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2...
8b5f691 fix(typings): typo from jonServerPublicKey to onServerPublicKey (#2699)
5c75802 build(deps-dev): bump tsx from 4.10.5 to 4.11.0 in /website (#2695)
179769f build(deps): bump @easyops-cn/docusaurus-search-local in /website (#2696)
56289e2 build(deps-dev): bump poku from 1.12.1 to 1.13.0 (#2698)
b029308 build(deps-dev): bump poku from 1.12.1 to 1.13.0 in /website (#2697)
539acb8 build(deps): bump lucide-react from 0.378.0 to 0.379.0 in /website (#2693)
dc80580 build(deps-dev): bump @typescript-eslint/eslint-plugin from 7.9.0 to 7.10.0 i...
Additional commits viewable in compare view

Updates nodemailer from 6.9.5 to 7.0.11

Release notes

Sourced from nodemailer's releases.

v7.0.11

7.0.11 (2025-11-26)

Bug Fixes

prevent stack overflow DoS in addressparser with deeply nested groups (b61b9c0)

v7.0.10

7.0.10 (2025-10-23)

Bug Fixes

Increase data URI size limit from 100KB to 50MB and preserve content type (28dbf3f)

v7.0.9

7.0.9 (2025-10-07)

Bug Fixes

release: Trying to fix release proecess by upgrading Node version in runner (579fce4)

v7.0.8

7.0.8 (2025-10-07)

Bug Fixes

addressparser: flatten nested groups per RFC 5322 (8f8a77c)

v7.0.7

7.0.7 (2025-10-05)

Bug Fixes

addressparser: Fixed addressparser handling of quoted nested email addresses (1150d99)

dns: add memory leak prevention for DNS cache (0240d67)

linter: Updated eslint and created prettier formatting task (df13b74)

refresh expired DNS cache on error (#1759) (ea0fc5a)

resolve linter errors in DNS cache tests (3b8982c)

v7.0.6

7.0.6 (2025-08-27)

Bug Fixes

... (truncated)

Changelog

Sourced from nodemailer's changelog.

7.0.11 (2025-11-26)

Bug Fixes

prevent stack overflow DoS in addressparser with deeply nested groups (b61b9c0)

7.0.10 (2025-10-23)

Bug Fixes

Increase data URI size limit from 100KB to 50MB and preserve content type (28dbf3f)

7.0.9 (2025-10-07)

Bug Fixes

release: Trying to fix release proecess by upgrading Node version in runner (579fce4)

7.0.8 (2025-10-07)

Bug Fixes

addressparser: flatten nested groups per RFC 5322 (8f8a77c)

7.0.7 (2025-10-05)

Bug Fixes

addressparser: Fixed addressparser handling of quoted nested email addresses (1150d99)

dns: add memory leak prevention for DNS cache (0240d67)

linter: Updated eslint and created prettier formatting task (df13b74)

refresh expired DNS cache on error (#1759) (ea0fc5a)

resolve linter errors in DNS cache tests (3b8982c)

7.0.6 (2025-08-27)

Bug Fixes

encoder: avoid silent data loss by properly flushing trailing base64 (#1747) (01ae76f)

handle multiple XOAUTH2 token requests correctly (#1754) (dbe0028)

ReDoS vulnerability in parseDataURI and _processDataUrl (#1755) (90b3e24)

7.0.5 (2025-07-07)

Bug Fixes

... (truncated)

Commits

3d17dbe chore(master): release 7.0.11 (#1783)
15879f8 Bumped dev dependencies
b61b9c0 fix: prevent stack overflow DoS in addressparser with deeply nested groups
4175e4b chore(master): release 7.0.10 (#1776)
d882ccf Merge branch 'master' of github.com:nodemailer/nodemailer
1d7e4f7 Bumped deps
10bd871 chore: correct typo in variable name (#1773)
28dbf3f fix: Increase data URI size limit from 100KB to 50MB and preserve content type
92ae1c4 chore(master): release 7.0.9 (#1769)
c675d9e Merge branch 'master' of github.com:nodemailer/nodemailer
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for nodemailer since your current version.

Updates typeorm from 0.2.45 to 0.3.26

Release notes

Sourced from typeorm's releases.

0.3.26

Notes:

When using MySQL, TypeORM now connects using stringifyObjects: true, in order to avoid a potential security vulnerability in the mysql/mysql2 client libraries. You can revert to the old behavior by setting connectionOptions.extra.stringifyObjects = false.

When using SAP HANA, TypeORM now uses the built-in pool from the @sap/hana-client library. The deprecated hdb-pool is no longer necessary and can be removed. See https://typeorm.io/docs/drivers/sap/#data-source-options for the new pool options.

Wh...
Description has been truncated

… updates Bumps the npm_and_yarn group with 10 updates in the /packages/room-server directory: | Package | From | To | | --- | --- | --- | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.8.21` | `1.8.22` | | [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `8.1.2` | `10.4.16` | | [axios](https://github.com/axios/axios) | `0.21.2` | `0.30.2` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.0.5` | `3.2.4` | | [express](https://github.com/expressjs/express) | `4.18.1` | `4.22.0` | | [form-data](https://github.com/form-data/form-data) | `3.0.1` | `3.0.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [mysql2](https://github.com/sidorares/node-mysql2) | `3.9.7` | `3.9.8` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.5` | `7.0.11` | | [typeorm](https://github.com/typeorm/typeorm) | `0.2.45` | `0.3.26` | Bumps the npm_and_yarn group with 20 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.8.21` | `1.8.22` | | [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `8.1.2` | `10.4.16` | | [axios](https://github.com/axios/axios) | `0.21.4` | `0.30.2` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.0.5` | `3.2.4` | | [express](https://github.com/expressjs/express) | `4.18.1` | `4.22.0` | | [form-data](https://github.com/form-data/form-data) | `3.0.1` | `3.0.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [mysql2](https://github.com/sidorares/node-mysql2) | `3.9.7` | `3.9.8` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.5` | `7.0.11` | | [typeorm](https://github.com/typeorm/typeorm) | `0.2.45` | `0.3.26` | | [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `7.92.0` | `7.119.1` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `2.0.6` | `2.0.9` | | [nanoid](https://github.com/ai/nanoid) | `4.0.2` | `5.0.9` | | [next](https://github.com/vercel/next.js) | `12.3.4` | `14.2.32` | | [prismjs](https://github.com/PrismJS/prism) | `1.29.0` | `1.30.0` | | [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `5.4.0` | `7.7.3` | | [rollup](https://github.com/rollup/rollup) | `4.1.4` | `4.22.4` | | [store2](https://github.com/nbubna/store) | `2.14.2` | `2.14.4` | | [@75lb/deep-merge](https://github.com/75lb/deep-merge) | `1.1.1` | `1.1.2` | | [@babel/helpers](https://github.com/babel/babel/tree/HEAD/packages/babel-helpers) | `7.22.15` | `7.28.4` | Updates `@grpc/grpc-js` from 1.8.21 to 1.8.22 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.8.21...@grpc/grpc-js@1.8.22) Updates `@nestjs/common` from 8.1.2 to 10.4.16 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v10.4.16/packages/common) Updates `axios` from 0.21.2 to 0.30.2 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.21.2...v0.30.2) Updates `dompurify` from 3.0.5 to 3.2.4 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.0.5...3.2.4) Updates `express` from 4.18.1 to 4.22.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md) - [Commits](expressjs/express@4.18.1...4.22.0) Updates `form-data` from 3.0.1 to 3.0.4 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v3.0.1...v3.0.4) Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `mysql2` from 3.9.7 to 3.9.8 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.9.7...v3.9.8) Updates `nodemailer` from 6.9.5 to 7.0.11 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.5...v7.0.11) Updates `typeorm` from 0.2.45 to 0.3.26 - [Release notes](https://github.com/typeorm/typeorm/releases) - [Changelog](https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md) - [Commits](typeorm/typeorm@0.2.45...0.3.26) Updates `@grpc/grpc-js` from 1.8.21 to 1.8.22 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.8.21...@grpc/grpc-js@1.8.22) Updates `@nestjs/common` from 8.1.2 to 10.4.16 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v10.4.16/packages/common) Updates `axios` from 0.21.4 to 0.30.2 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.21.2...v0.30.2) Updates `dompurify` from 3.0.5 to 3.2.4 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.0.5...3.2.4) Updates `express` from 4.18.1 to 4.22.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md) - [Commits](expressjs/express@4.18.1...4.22.0) Updates `form-data` from 3.0.1 to 3.0.4 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v3.0.1...v3.0.4) Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `mysql2` from 3.9.7 to 3.9.8 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.9.7...v3.9.8) Updates `nodemailer` from 6.9.5 to 7.0.11 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.5...v7.0.11) Updates `typeorm` from 0.2.45 to 0.3.26 - [Release notes](https://github.com/typeorm/typeorm/releases) - [Changelog](https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md) - [Commits](typeorm/typeorm@0.2.45...0.3.26) Updates `@sentry/browser` from 7.92.0 to 7.119.1 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/7.119.1/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@7.92.0...7.119.1) Updates `http-proxy-middleware` from 2.0.6 to 2.0.9 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.9/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.6...v2.0.9) Updates `nanoid` from 4.0.2 to 5.0.9 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@4.0.2...5.0.9) Updates `next` from 12.3.4 to 14.2.32 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v12.3.4...v14.2.32) Updates `prismjs` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/PrismJS/prism/releases) - [Changelog](https://github.com/PrismJS/prism/blob/v2/CHANGELOG.md) - [Commits](PrismJS/prism@v1.29.0...v1.30.0) Updates `react-pdf` from 5.4.0 to 7.7.3 - [Release notes](https://github.com/wojtekmaj/react-pdf/releases) - [Commits](https://github.com/wojtekmaj/react-pdf/commits/v7.7.3/packages/react-pdf) Updates `rollup` from 4.1.4 to 4.22.4 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.1.4...v4.22.4) Updates `store2` from 2.14.2 to 2.14.4 - [Commits](nbubna/store@2.14.2...2.14.4) Updates `@75lb/deep-merge` from 1.1.1 to 1.1.2 - [Commits](75lb/deep-merge@v1.1.1...v1.1.2) Updates `@babel/helpers` from 7.22.15 to 7.28.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.4/packages/babel-helpers) Updates `body-parser` from 1.20.0 to 1.20.4 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/1.20.4/HISTORY.md) - [Commits](expressjs/body-parser@1.20.0...1.20.4) Updates `brace-expansion` from 1.1.11 to 1.1.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12) Updates `cross-spawn` from 6.0.5 to 6.0.6 - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/v6.0.6/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v6.0.5...v6.0.6) Updates `path-to-regexp` from 0.1.7 to 0.1.12 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.12) Updates `pdfjs-dist` from 2.9.359 to 2.16.105 - [Release notes](https://github.com/mozilla/pdf.js/releases) - [Commits](mozilla/pdf.js@v2.9.359...v2.16.105) Updates `serve-static` from 1.15.0 to 1.16.2 - [Release notes](https://github.com/expressjs/serve-static/releases) - [Changelog](https://github.com/expressjs/serve-static/blob/v1.16.2/HISTORY.md) - [Commits](expressjs/serve-static@v1.15.0...v1.16.2) Updates `sha.js` from 2.4.11 to 2.4.12 - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](browserify/sha.js@v2.4.11...v2.4.12) Updates `tar` from 6.2.0 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.2.0...v6.2.1) --- updated-dependencies: - dependency-name: "@grpc/grpc-js" dependency-version: 1.8.22 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@nestjs/common" dependency-version: 10.4.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 0.30.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.2.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: express dependency-version: 4.22.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 3.0.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mysql2 dependency-version: 3.9.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 7.0.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: typeorm dependency-version: 0.3.26 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@grpc/grpc-js" dependency-version: 1.8.22 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@nestjs/common" dependency-version: 10.4.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 0.30.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.2.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: express dependency-version: 4.22.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 3.0.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mysql2 dependency-version: 3.9.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 7.0.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: typeorm dependency-version: 0.3.26 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@sentry/browser" dependency-version: 7.119.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 2.0.9 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 5.0.9 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 14.2.32 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: prismjs dependency-version: 1.30.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: react-pdf dependency-version: 7.7.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.22.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: store2 dependency-version: 2.14.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@75lb/deep-merge" dependency-version: 1.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/helpers" dependency-version: 7.28.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cross-spawn dependency-version: 6.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pdfjs-dist dependency-version: 2.16.105 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serve-static dependency-version: 1.16.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 6.2.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 2, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 2 directories with 28 updates#1

chore(deps): bump the npm_and_yarn group across 2 directories with 28 updates#1
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/npm_and_yarn/packages/room-server/npm_and_yarn-9ca5e48b0e

dependabot bot commented on behalf of github Dec 2, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Dec 2, 2025

@​grpc/grpc-js 1.8.22

v10.4.16

What's Changed

v10.4.15 (2024-12-09)

Dependencies

v10.4.13 (2024-12-03)

Bug fixes

Dependencies

Committers: 3

v10.4.12 (2024-11-29)

Bug fixes

Dependencies

v0.30.2

What's Changed

New Contributors

Release v0.30.1

Release notes:

Bug Fixes

Contributors to this release

Release v0.30.0

Release notes:

Bug Fixes

Contributors to this release

v0.29.0

Release notes:

Bug Fixes

Contributors to this release

DOMPurify 3.2.4

DOMPurify 3.2.3

DOMPurify 3.2.2

DOMPurify 3.2.1

DOMPurify 3.2.0

DOMPurify 3.1.7

DOMPurify 3.1.6

DOMPurify 3.1.5

DOMPurify 3.1.4

4.22.0

Important: Security

What's Changed

4.21.2

What's Changed

4.21.1

What's Changed

4.21.0

What's Changed

New Contributors

4.22.0 / 2025-12-01

4.21.2 / 2024-11-06

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

4.20.0 / 2024-09-10

4.19.2 / 2024-03-25

v3.0.2

Fixes

Tests

v3.0.4 - 2025-07-16

Fixed

Commits

v3.0.3 - 2025-02-14

Merged

Fixed

Commits

v3.0.2 - 2024-10-10

Merged

Commits

[4.1.1] - 2025-11-12

Security

v3.9.8

3.9.8 (2024-05-26)

Bug Fixes

3.9.8 (2024-05-26)

Bug Fixes

v7.0.11

7.0.11 (2025-11-26)

Bug Fixes

v7.0.10

7.0.10 (2025-10-23)

Bug Fixes

`@grpc/grpc-js` 1.8.22

Wh...
Description has been truncated