Skip to content

chore(deps): bump the production group across 1 directory with 12 updates - #26

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-ce9740c31c
Closed

chore(deps): bump the production group across 1 directory with 12 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-ce9740c31c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production group with 12 updates in the / directory:

Package From To
@grpc/proto-loader 0.7.15 0.8.1
@graphql-tools/schema 10.0.32 10.1.0
@openfga/sdk 0.9.1 0.9.7
helmet 8.1.0 8.3.0
ws 8.21.0 8.21.3
@opentelemetry/api 1.9.0 1.9.1
@opentelemetry/exporter-trace-otlp-http 0.219.0 0.221.0
@opentelemetry/sdk-metrics 2.8.0 2.10.0
@opentelemetry/sdk-node 0.219.0 0.221.0
@opentelemetry/sdk-trace-base 2.8.0 2.10.0
jose 6.1.3 6.2.9
pg 8.18.0 8.23.0

Updates @grpc/proto-loader from 0.7.15 to 0.8.1

Release notes

Sourced from @​grpc/proto-loader's releases.

@​grpc/proto-loader 0.8.1

  • Bump dependency on protobufjs to the newest version to pick up security fixes (#3048 contributed by @​tawni-dev)

@​grpc/proto-loader 0.8.0

  • Add serialize and deserialize functions to Message definition objects. See grpc/proposal#503 for more details. (#2970)
Commits
  • a558430 Merge pull request #3049 from murgatroid99/proto-loader_v0.8.1
  • 753fbc1 proto-loader: Bump to version 0.8.1
  • 1589dda Merge pull request #3048 from tawni-dev/fix/protobufjs-7.5.5-security-bump
  • 736a45c fix: bump protobufjs to ^7.5.5 to address GHSA-xq3m-2v4x-88gg
  • 2670b37 Merge pull request #3046 from zarinn3pal/feat/health_check_example
  • 37af6c0 Merge pull request #3045 from hfhchan-plb/patch-1
  • fd67ca6 feat: Added health check example
  • d7dac60 unroll loop and remove unnecessary check
  • 99028d3 Fix lipo extract command for M1 macs
  • 0af3c67 Merge pull request #3044 from zarinn3pal/fix/psm-interop-node
  • Additional commits viewable in compare view

Updates @graphql-tools/schema from 10.0.32 to 10.1.0

Changelog

Sourced from @​graphql-tools/schema's changelog.

10.1.0

Minor Changes

  • #8346 2273c21 Thanks @​ardatan! - This release adds GraphQL v17 support and aligns the existing executor implementation with the latest GraphQL v17 API changes. The following changes are included:

    • getAsyncHelpers is now available on GraphQLResolveInfo. Its track method is used whenever waitUntil is available, as in Yoga's Explicit Resource Management
    • getAbortSignal is now available on GraphQLResolveInfo, matching behavior that was already available in this executor implementation, as in Yoga's Execution Cancellation
    • GraphQLResolveInfo automatically aligns variableValues according to the GraphQL version for better compatibility. In GraphQL v17 and above, variableValues follows the wrapped shape ({ coerced, sources }) expected by GraphQL APIs. In GraphQL v16 and below, variableValues remains a flat map as in previous versions.
    • If your custom scalar resolvers define __serialize and __parseValue, they are automatically mapped to coerceOutputValue and coerceInputValue in GraphQL v17.
    • BREAKING: @graphql-tools/executor's getVariableValues now returns { variableValues } on success, where variableValues is a VariableValues object ({ coerced, sources }). On failure, it returns { errors }.
    • BREAKING: collectFields, shouldIncludeNode, getDeferValues, and collectSubFields now need a VariableValues object instead of Record<string, any> for the variableValues argument.
    • visitResult now internally normalizes ExecutionRequest.variables into a VariableValues-compatible shape ({ coerced, sources }) before traversing selections.

Patch Changes

10.0.38

Patch Changes

  • Updated dependencies [e90719b]:
    • @​graphql-tools/utils@​11.2.2
    • @​graphql-tools/merge@​9.2.2

10.0.37

... (truncated)

Commits

Updates @openfga/sdk from 0.9.1 to 0.9.7

Release notes

Sourced from @​openfga/sdk's releases.

v0.9.7

Changed

  • rework how nock is setup and used to harden tests (#395) (0d20683)

Documentation

What's Changed

Full Changelog: openfga/js-sdk@v0.9.7-beta.1...v0.9.7

v0.9.7-beta.1

⚠ BREAKING CHANGES

  • The $response property type changes from AxiosResponse<T> to FgaResponse<T>. The constructor now accepts an optional HttpClient instead of AxiosInstance. baseOptions.httpAgent/httpsAgent are no longer applicable as fetch handles connection pooling natively.

Changed

What's Changed

... (truncated)

Changelog

Sourced from @​openfga/sdk's changelog.

0.9.7 (2026-08-18)

Changed

  • rework how nock is setup and used to harden tests (#395) (0d20683)

Documentation

0.9.6 (2026-05-11)

Fixed

0.9.5 (2026-04-10)

Fixed

  • Correctly set authorization model id when calling batch checks (#372) (bbc8bde)

v0.9.4

v0.9.4 (2026-03-31)

  • fix(deps): pin axios to 1.14.0 and fix brace-expansion audit vulnerability (#363) - details

v0.9.3

v0.9.3 (2026-02-27)

  • feat: add executeApiRequest and executeStreamedApiRequest methods to OpenFgaClient for calling arbitrary API endpoints with full SDK support (authentication, retries, telemetry, error handling). See documentation for more. (#298, #345) - thanks @​Abishek-Newar!
  • fix: use current SDK version in telemetry meter (#335)
  • fix: disable httprequestduration metric by default to avoid high cardinality (#344)
  • fix: apply expiry buffer before reusing cached tokens (#331)
  • chore!: drop support for Node.js v16 & 18. We recommend updating to a node-runtime that is supported upstream - currently 20 (maintenance), 22 (maintenance), 24 (LTS) and 25 (current). The minimum supported version of Node.js is now v20. This is in line with our stated supported environments

v0.9.2

v0.9.2 (2026-02-10)

... (truncated)

Commits
  • ff0a9f5 release: v0.9.7 (#470)
  • 2978621 chore(deps-dev): bump the dependencies group with 4 updates (#469)
  • 39be98a chore: replace Jest with Node test runner (#466)
  • 8ea3346 docs: update stated node version support (#468)
  • ad7a03d chore(deps): bump the dependencies group across 1 directory with 9 updates (#...
  • 36497d6 fix(ci): resolve npm audit vulnerabilities (#464)
  • 8d4cfdd chore(deps): bump the dependencies group with 5 updates (#463)
  • a301a25 chore(deps): bump the dependencies group across 1 directory with 3 updates (#...
  • acd4913 chore: sync generated code with sdk-generator (#454)
  • 0d20683 refactor: rework how nock is setup and used to harden tests (#395)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​openfga/sdk since your current version.


Updates helmet from 8.1.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

  • Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
  • Content-Security-Policy: improved error handling for invalid directive names

Fixed

  • Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
  • Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
  • Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

  • Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
  • Improve error message when passing duplicate options
Commits
  • 75f1a98 8.3.0
  • f03f70d Update changelog for 8.3.0 release
  • a307fce Fix capitalization in CSP package changelog
  • 5347b43 Format default CSP in README for readability
  • 9afc570 CSP: fix middleware-specific README missing link
  • 266c95c Minor speedups to project setups test
  • 7a4196c CSP: update package-specific changelog
  • 02716b4 CSP: improve performance when there are no dynamic directives
  • 3f511ed CSP: move utility functions to separate file
  • 80338af CSP: disabling defaults with no directives is now an error
  • Additional commits viewable in compare view

Updates ws from 8.21.0 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c0).
  • The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).
Commits
  • c791e70 [dist] 8.21.3
  • e97a20e [fix] Reject offers with client_max_window_bits below config
  • 787ebf2 [dist] 8.21.2
  • b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
  • e4bb883 [security] Use GitHub PVR as main reporting channel
  • 2eb3be0 [test] Skip test on Node.js versions where it does not apply
  • ae1de54 [dist] 8.21.1
  • 8e9511b [ci] Trust Coveralls Homebrew tap
  • f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
  • 8df8265 [ci] Update actions/checkout action to v7
  • Additional commits viewable in compare view

Updates @opentelemetry/api from 1.9.0 to 1.9.1

Release notes

Sourced from @​opentelemetry/api's releases.

api/v1.9.1

1.9.1

🐛 (Bug Fix)

  • fix(api): prioritize esnext export condition as it is more specific #5458
  • fix(api): update diag consoleLogger to use original console methods to prevent infinite loop when a console instrumentation is present #6395
  • fix(api): use Attributes instead of deprecated SpanAttributes in SpanOptions #6478 @​overbalance
  • fix(diag): change types in DiagComponentLogger from any to unknown#5478 @​loganrosen
  • fix(api): re-introduce fallback chain for global utils #6523 @​pichlermarc

🏠 (Internal)

Changelog

Sourced from @​opentelemetry/api's changelog.

1.9.1

🐛 (Bug Fix)

🏠 (Internal)

  • chore: fix cross project links and missing implicitly exported types #3533 @​legendecas
  • feat(sdk-metrics): add exponential histogram mapping functions #3504 @​mwear
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​opentelemetry/api since your current version.


Updates @opentelemetry/exporter-trace-otlp-http from 0.219.0 to 0.221.0

Release notes

Sourced from @​opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

  • feat(sdk-logs)!: configure the force flush timeout per call #6931 @​LarryHu0217
    • (user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.
  • feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @​maryliag
  • feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
  • feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
  • feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @​maryliag

🚀 Features

  • feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @​Babul422
  • feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @​pichlermarc
  • feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @​raphael-theriault-swi

experimental/v0.220.0

0.220.0

💥 Breaking Changes

  • refactor(sdk-logs)!: refactor BatchLogRecordProcessor constructor signature #6817 @​trentm
    • (user-facing): BatchLogRecordProcessor now takes a single options object with all possible properties, instead of two separate arguments. For example, before new BatchLogRecordProcessor(exporter, { maxQueueSize: 1000 }), after new BatchLogRecordProcessor({ exporter, maxQueueSize: 1000 }).
    • interface BufferConfig -> interface BatchLogRecordProcessorOptions, and now includes the exporter property
    • interface BatchLogRecordProcessorBrowserConfig -> interface BatchLogRecordProcessorBrowserOptions
    • (user-facing): SimpleLogRecordProcessor now takes a single options object with all possible properties. For example, before new SimpleLogRecordProcessor(exporter), after new SimpleLogRecordProcessor({ exporter }). #6836
  • refactor(configuration)!: change config file parsing to not add default values, nor merge *_list fields #6765 @​trentm
  • docs(shim-opencensus): Notice: The @opentracing/shim-opencensus package will be removed in SDK 3.x, planned for approximately September 2026.
    • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.
  • chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from declarative config

🚀 Features

  • feat(configuration): bump config schema to v1.1.0; rename without_scope_info → scope_info_enabled and without_target_info/development → target_info_enabled/development on the Prometheus pull exporter (semantics inverted), rename with_resource_constant_labels → resource_constant_labels. Validate file_format per the configuration versioning spec: accept any minor version of major 1 (e.g. 1.0, 1.1), warn when the minor version is newer than supported, and reject other major versions. #6781 @​MikeGoldsmith
  • feat(sdk-node): wire up id_generator from declarative config #6782 @​MikeGoldsmith
  • feat(sdk-node): wire up tracer_provider.sampler from declarative config (always_on, always_off, trace_id_ratio_based, parent_based); unrecognized variants warn and fall back to ParentBased(AlwaysOn) #6506 @​MikeGoldsmith
  • feat(propagator-env-carrier): empty name normalization #6827 @​pellared
  • feat(propagator-env-carrier): make EnvironmentGetter read the current process.env #6853 @​pellared

🐛 Bug Fixes

  • fix(sdk-logs): stop Logger.emit() doing work (record construction, metrics, processor onEmit) after the LoggerProvider has shut down #6826 @​anneheartrecord
  • fix(sdk-node): pass all config properties (endpoint, headers, timeout, TLS, compression, temporality preference, default histogram aggregation) to OTLP metric exporters in declarative config #6814 @​MikeGoldsmith
  • fix(sdk-logs): default BatchLogRecordProcessor scheduleDelayMillis is 1000 #6796 @​trentm
  • fix(configuration): percent-decode keys and values in resource.attributes_list per spec #6787 @​MikeGoldsmith
  • fix(configuration): default log_level to info in env-based config initialization for consistency with file-based config #6788 @​MikeGoldsmith

... (truncated)

Commits
  • 76fa6b5 chore: prepare next release (#6942)
  • 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
  • be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
  • f6d8fbe chore(deps): lock file maintenance (#6559)
  • 9612732 chore: remove examples/dice from workspaces (#6937)
  • 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
  • a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
  • af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
  • b9f57c6 chore(deps): update dependency @​types/webpack-env to v1.18.8 (#6877)
  • cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
  • Additional commits viewable in compare view

Updates @opentelemetry/sdk-metrics from 2.8.0 to 2.10.0

Release notes

Sourced from @​opentelemetry/sdk-metrics's releases.

v2.10.0

2.10.0

🚀 Features

  • feat(sdk-logs): implement log processor metrics #6554 @​anuraaga
  • feat(otlp-exporter): implement exporter metrics #6480 @​anuraaga
  • feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
    • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

  • fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @​LarryHu0217
  • fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @​LarryHu0217

🏠 Internal

v2.9.0

2.9.0

💥 Breaking Changes

  • docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
    • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

  • feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
    • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
  • feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
  • feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
    • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
    • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
    • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
  • feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

  • fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

  • perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
  • chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
  • perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas
Changelog

Sourced from @​opentelemetry/sdk-metrics's changelog.

2.10.0

🚀 Features

  • feat(sdk-logs): implement log processor metrics #6554 @​anuraaga
  • feat(otlp-exporter): implement exporter metrics #6480 @​anuraaga
  • feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
    • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

  • fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @​LarryHu0217
  • fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @​LarryHu0217

🏠 Internal

2.9.0

💥 Breaking Changes

  • docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
    • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

  • feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
    • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
  • feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
  • feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
    • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
    • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
    • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
  • feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

  • fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

  • perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
  • chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
  • perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas
Commits
  • 76fa6b5 chore: prepare next release (#6942)
  • 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
  • be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
  • f6d8fbe chore(deps): lock file maintenance (#6559)
  • 9612732 chore: remove examples/dice from workspaces (#6937)
  • 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
  • a7e5d11 chore(deps): update dependency webpack to v5.108.4 (

@dependabot
chore(deps): bump the production group across 1 directory with 12 upd…
bfb15bf 
…ates

Bumps the production group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@grpc/proto-loader](https://github.com/grpc/grpc-node) | `0.7.15` | `0.8.1` |
| [@graphql-tools/schema](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/schema) | `10.0.32` | `10.1.0` |
| [@openfga/sdk](https://github.com/openfga/js-sdk) | `0.9.1` | `0.9.7` |
| [helmet](https://github.com/helmetjs/helmet) | `8.1.0` | `8.3.0` |
| [ws](https://github.com/websockets/ws) | `8.21.0` | `8.21.3` |
| [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.0` | `1.9.1` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.221.0` |
| [@opentelemetry/sdk-metrics](https://github.com/open-telemetry/opentelemetry-js) | `2.8.0` | `2.10.0` |
| [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.221.0` |
| [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) | `2.8.0` | `2.10.0` |
| [jose](https://github.com/panva/jose) | `6.1.3` | `6.2.9` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.18.0` | `8.23.0` |



Updates `@grpc/proto-loader` from 0.7.15 to 0.8.1
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/proto-loader@0.7.15...@grpc/proto-loader@0.8.1)

Updates `@graphql-tools/schema` from 10.0.32 to 10.1.0
- [Release notes](https://github.com/ardatan/graphql-tools/releases)
- [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/schema/CHANGELOG.md)
- [Commits](https://github.com/ardatan/graphql-tools/commits/@graphql-tools/schema@10.1.0/packages/schema)

Updates `@openfga/sdk` from 0.9.1 to 0.9.7
- [Release notes](https://github.com/openfga/js-sdk/releases)
- [Changelog](https://github.com/openfga/js-sdk/blob/main/CHANGELOG.md)
- [Commits](openfga/js-sdk@v0.9.1...v0.9.7)

Updates `helmet` from 8.1.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v8.1.0...v8.3.0)

Updates `ws` from 8.21.0 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.0...8.21.3)

Updates `@opentelemetry/api` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v1.9.0...v1.9.1)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.219.0 to 0.221.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.221.0)

Updates `@opentelemetry/sdk-metrics` from 2.8.0 to 2.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.8.0...v2.10.0)

Updates `@opentelemetry/sdk-node` from 0.219.0 to 0.221.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.221.0)

Updates `@opentelemetry/sdk-trace-base` from 2.8.0 to 2.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.8.0...v2.10.0)

Updates `jose` from 6.1.3 to 6.2.9
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.1.3...v6.2.9)

Updates `pg` from 8.18.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

---
updated-dependencies:
- dependency-name: "@grpc/proto-loader"
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@graphql-tools/schema"
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@openfga/sdk"
  dependency-version: 0.9.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@opentelemetry/api"
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.221.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@opentelemetry/sdk-metrics"
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.221.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@opentelemetry/sdk-trace-base"
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: jose
  dependency-version: 6.2.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 23, 2026
syzygyhack added a commit that referenced this pull request Aug 23, 2026
@syzygyhack
chore(deps): apply the regenerated minor/patch groups and cel-go
db5d740 
The corrected Dependabot grouping produced reviewable PRs this time (#25, #26),
so these are applied as one batch alongside cel-go.

Go: github.com/google/cel-go 0.27.0 -> 0.29.0.

npm (production): @grpc/proto-loader 0.7.15 -> 0.8.1, @graphql-tools/schema
10.0.32 -> 10.1.0, @openfga/sdk 0.9.1 -> 0.9.7, helmet 8.1.0 -> 8.3.0, ws
8.21.0 -> 8.21.3, jose 6.1.3 -> 6.2.9, pg 8.18.0 -> 8.23.0, and the
OpenTelemetry packages (api 1.9.1, sdk-metrics/sdk-trace-base 2.10.0,
sdk-node/exporter-trace-otlp-http 0.221.0).

npm (dev): @opentelemetry/context-async-hooks and tsx.

One wrinkle worth recording: bumping ws in the manifests left the lockfile out of
step with the `ws` pnpm override, which is a CVE floor rather than a pin. The
floor still admits 8.21.3, so it stays as is; the lockfile was resynced and
`--frozen-lockfile` passes.

Verified: go build and go test pass with cel-go 0.29; frozen lockfile install,
build 15/15, typecheck 29/29, unit tests 32/32 tasks.
@dependabot @github

dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 23, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-ce9740c31c branch August 23, 2026 14:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants