Repository navigation
Update all non-major dependencies - #592
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
4.3.2→4.3.311.4.0→11.6.01.16.13→1.16.1824.19.1→24.19.25.2.1→5.3.016.3.8→16.4.014.0.2→14.0.3Release Notes
apollographql/apollo-client (@apollo/client)
v4.3.3Compare Source
Patch Changes
0ab2579Thanks @phryneas! - Fix a memory leak inisDeferredFragment/isStreamFieldgetsentry/sentry-javascript (@sentry/react)
v11.6.0Compare Source
Important Changes
feat(nextjs): Add
@sentry/nextjs/cloudflare(#24998)The new
@sentry/nextjs/cloudflareentry point exportswithSentryfor the Worker entry of a Next.js app on Cloudflare Workers, for example.open-next/worker.jsof OpenNext. It iswithSentryof@sentry/cloudflarewith the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.feat(server-utils): Add instrumentation for pi-durable (#24993)
The new
piDurableIntegrationtraces agents built with pi-durable: each run, with its model requests and tool calls.fix(core): Correct sleep clock drift on telemetry timestamps (#23054)
When a device sleeps, the
performance.now()clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from theperformance.now()duration since the span start, like in OpenTelemetry (#24903).Other Changes
Internal Changes
@sentry/nextjs/cloudflare(#25000)no-unsafe-random-apisrule (#25123)Work in this release was contributed by @zkasuran. Thank you for your contribution!
v11.5.0Compare Source
Important Changes
feat(core): Warn on repeated
Sentry.init()and unbind the client onclose()(#24962)Sentry.init()now warns when it runs while a client is still active. For now, the new client still replaces the active client, but the active client is not closed, so state from both can mix. CallSentry.init()once, or callawait Sentry.close()before you call it again.Sentry.close()now unbinds the client it closes, so afterclose(),getClient()returnsundefined,isInitialized()returnsfalse, and a laterinit()sets up a new client. In@sentry/cloudflare, later requests no longer reuse the isolate's cached client once it is closed or closing. On the server,@sentry/nextjsand@sentry/remixnow return the active client from a repeatedinit()call, notundefined.Other Changes
code.file.pathtouse cachefill spans (#24988)initinside a request of@sentry/cloudflare(#24996)experimental_telemetry.metadataon gen_ai spans (#24721)beforeSendSpannull return warning (#24129)Internal Changes
@sentry/conventionsto 0.26.0 (#25073)isObjectLikefor object guards (#25058)serverSpanHooks.ts(#24997)nuxt/server(#25093)Work in this release was contributed by @minwookshin. Thank you for your contribution!
swc-project/swc (@swc/core)
v1.16.18Compare Source
Bug Fixes
(bindings) Fall back to a safe cache root on Unix (#12500) (2125403)
(es/minifier) Check decl for side effect (#12501) (6841927)
v1.16.17Compare Source
Bug Fixes
(bindings) Fall back to a secure Windows profile cache (#12452) (2c0fb89)
(bindings) Allow opting out of Unix cache root security checks (#12469) (e87fa40)
(ci) Run main CodSpeed benchmarks after policy skips (1b6d869)
(ci) Match Rust's z10 baseline in s390x release builds (#12489) (b96f92f)
(ci) Raise native addon MSRV to Rust 1.85 (#12491) (54a2324)
(ci) Repair empty crate release changeset (#12499) (6bf5f8c)
(cli) Resolve out-dir source map paths relative to output (#12481) (717914f)
(deps) Update cargo (#10278) (fc7a9e2)
(es/compat) Preserve consecutive loop labels (#12472) (28c3370)
(es/estree) Fix AST roundtrip bugs and implement missing conversions (#12440) (898b592)
(es/fixer) Preserve parentheses in JSX sequence expressions (#12485) (7a36735)
(es/preset-env) Lower for-await in native async functions (#12414) (2b3d306)
(react-compiler) Protect long call chains from stack overflow (#12473) (a19b101)
Direct unapproved contributors to open issues (#12479) (3fac5ec)
Features
(ci) Restrict pull requests to trusted contributors (#12463) (ee297d6)
(es/codegen) Support configurable output indentation (#12490) (2058335)
Miscellaneous Tasks
(deps) Replace dependency babel-eslint with @babel/eslint-parser ^7.11.0 (#12456) (a933f98)
(deps) Replace dependency npm-run-all with npm-run-all2 ^5.0.0 (#12457) (98e6c6e)
(deps) Update npm (#12468) (7c75e36)
Performance
(es/compat) Skip empty block-scoping renames (#12478) (952db74)
(es/parser) Scan template literals with byte search (#12474) (3c46139)
Refactor
Ci
expressjs/express (express)
v5.3.0Compare Source
=====
🐞 Bug fixes
Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893
Fixed the behavior of
res.send()to prevent conflicts betweenContent-LengthandTransfer-EncodingHTTP headers in responses. TheContent-Lengthheader inres.send()is now only added when aTransfer-Encodingheader is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of aTransfer-Encodingheader - by @cuishuang in #7459Upgrade
qsto^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx):arrayLimitbypasses in comma parsing and a denial of service via an attacker-controlledisBuffer- by @davetashner in #7057 and #7478, and @cyphercodes in #7305Upgrade
proxy-addrto^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474🚀 Improvements
Allow conditional revalidation for QUERY requests.
req.freshpreviously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366Improve HTML structure in
res.redirect()responses when HTML format is accepted by adding<!DOCTYPE html>,<title>, and<body>tags for better browser compatibility - by @Bernice55231 in #5167When calling
app.renderwith options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903Upgrade
content-typeto^2.0.0, bringing a faster parser (~1.5x quickerContent-Typeparsing/formatting inres.send()) along with a behavior change:res.send()now keeps any existing parameters when adding the charset and no longer throws on aContent-Typethat fails to parse.type-isis upgraded to^2.1.0as part of the same change - by @blakeembrey in #7234The default error handler now logs the full error object instead of only its stack trace, so nested details such as
Error.causeand library-specific properties (e.g. Sequelize'sparent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464Upgrade
content-dispositionto^2.0.1, which changes theContent-Dispositionheader emitted byres.download(),res.attachment(), andres.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233Upgrade
body-parserto^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalidlimitoption value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalidlimitvalues now throw at parser initialization instead of being ignored - by @Mayvis in #7390⚡ Performance
res.send()when sending string responses without an explicit Content-Type header - by @bjohansebas in #6991vercel/next.js (next)
v16.4.0Compare Source
Check out the 16.4 announcement post to get an overview of the changes.
Core Changes
falsevalues forresolveAliasconfig: #93331Misc Changes
exports: #96381exportsafter amodule.exports = {}writes: #96380cbb046ab-20260731to7dfc7ccd-20260803: #965507dfc7ccd-20260803to11eddecd-20260805: #96735loadManifestto return undefined withhandleMissing: #96530nextjs-bot: #96683config.experimental.appNewScrollHandler: #95602type: 'text'in rules, and error on binding imports of non-ESM modules: #96558turbopack/packagesand relocate devlow topackages/: #96860experimental.serverMinification& expandexperimental.turbopackMinify: #96578turbopackChunkingdocumentation page for pages router: #96698next buildinstead: #96746export const dynamic = 'force-static'to Route Handlers example on Static Exports: #96964encodeCacheTagtoencodeHeaderSafe: #96936'use cache'debug logs with the full directive: #97037ScrollAndMaybeFocusHandlertoScrollHandler: #96828var x = module.exports = {}: #97130use-cache-custom-handler-devtests: #97187clustersto chunking heuristics: #95157cache-components-dev-streamingassertions: #97246use-cache-default-profile-expire-zerotests: #97250nccbeforepnpm build: #97234Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.