chore(deps): bump the backend-npm group across 1 directory with 11 updates by dependabot[bot] · Pull Request #63 · wilson360-labs/CodeHub

dependabot · 2026-10-14T01:09:07Z

Bumps the backend-npm group with 11 updates in the /backend directory:

Package	From	To
dotenv	`17.4.2`	`18.0.8`
express	`5.2.1`	`5.3.0`
express-rate-limit	`8.7.0`	`8.7.1`
mongoose	`9.10.0`	`9.11.2`
multer	`2.3.0`	`2.4.0`
redis	`6.2.1`	`6.3.0`
ws	`8.21.3`	`8.22.0`
@supabase/supabase-js	`2.116.0`	`2.118.0`
firebase-admin	`14.4.0`	`14.5.0`
eslint	`8.57.1`	`10.13.0`
prettier	`3.9.6`	`3.9.10`

Updates dotenv from 17.4.2 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

Fast parser should strip appended extra quotes (#1073)

Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

Treat undefined settings like quiet: true as null rather than falsey (#1070)

CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

Fix missing typescript module declaration (#1068)

Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

Handle file urls in config logging (#1054)

... (truncated)

Commits

e2fe95e 18.0.8
7aa712a type detail improvement
53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
0b4843a changelog
55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
f757811 fix(types): allow undefined values in populate output
fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
2953207 18.0.7
9944723 make more readable for undefined -> null
d455db0 Merge branch 'master' of github.com:motdotla/dotenv
Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

cf6722b 5.3.0 (#7468)
8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
9efc29e docs: fix pass-through typos (#7509)
2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
9169cbe docs: add missing apostrophe in example (#7483)
7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
98bd4cd deps: proxy-addr@^2.0.8 (#7474)
9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits

c2e30b3 8.7.1
b40a390 v8.7.1 changelog
ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
Additional commits viewable in compare view

Updates mongoose from 9.10.0 to 9.11.2

Release notes

Sourced from mongoose's releases.

9.11.2 / 2026-10-12

perf: avoid applying saveSubdocs and sharding plugins to subdocuments #16585

perf: upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588

fix(model): cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar

fix(schema): allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk

types: make MergeType more efficiently handle MergeType<A, {}> #16581 #16580

docs: fix broken API anchors and a malformed link #16583 SatvikMishra08

9.11.1 / 2026-10-07

fix(document): call recursive toObject() when setting a path to a nested object #16571

fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS

fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml

fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai

fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai

fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny

fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1

fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1

types(schema): treat Int32 paths as number #16565 #16564 lazerg

types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

feat: use MongoDB Node.js driver 7.7.x #16550

feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar

fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411

types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519

docs(guide): use async/await instead of removed callbacks #16566 joi-agent

test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506

9.10.4 / 2026-10-02

fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557

fix(populate): resolve dotted parent path when collecting deferred sub-populate children #16538 jfits

fix(array): compare dates by value in indexOf() so pull() removes them #16535 giaBaoJS

fix(map): register $set when Map#set() replaces an array #16540 #16539 luantaraschi

fix(query): cast case and then expressions in $expr $switch branches #16534 kwy404

docs(guide): fix read preference tag set example #16541 NotAFlightRisk

9.10.3 / 2026-09-29

fix(model): preserve unsaved documents after ordered bulkSave errors #16533 #16532 IbrahimHafez1

fix(model): don't mutate the caller's update object in bulkWrite updateMany #16526 fadiroot

fix(schema): run setters declared on the union path itself #16528 giaBaoJS

fix(collection): open collection if connection was already opened #16527 #16525 #16524

fix(query+model): replace {MODEL} in cast error messages from update and bulkWrite casting #16529 #16502 #16480

9.10.2 / 2026-09-22

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.11.2 / 2026-10-12

perf: avoid applying saveSubdocs and sharding plugins to subdocuments #16585

perf: upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588

fix(model): cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar

fix(schema): allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk

types: make MergeType more efficiently handle MergeType<A, {}> #16581 #16580

docs: fix broken API anchors and a malformed link #16583 SatvikMishra08

9.11.1 / 2026-10-07

fix(document): call recursive toObject() when setting a path to a nested object #16571

fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS

fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml

fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai

fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai

fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny

fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1

fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1

types(schema): treat Int32 paths as number #16565 #16564 lazerg

types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

feat: use MongoDB Node.js driver 7.7.x #16550

feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar

fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411

types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519

docs(guide): use async/await instead of removed callbacks #16566 joi-agent

test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506

9.10.4 / 2026-10-02

fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557

fix(populate): resolve dotted parent path when collecting deferred sub-populate children #16538 jfits

fix(array): compare dates by value in indexOf() so pull() removes them #16535 giaBaoJS

fix(map): register $set when Map#set() replaces an array #16540 #16539 luantaraschi

fix(query): cast case and then expressions in $expr $switch branches #16534 kwy404

docs(guide): fix read preference tag set example #16541 NotAFlightRisk

9.10.3 / 2026-09-29

fix(model): preserve unsaved documents after ordered bulkSave errors #16533 #16532 IbrahimHafez1

fix(model): don't mutate the caller's update object in bulkWrite updateMany #16526 fadiroot

fix(schema): run setters declared on the union path itself #16528 giaBaoJS

fix(collection): open collection if connection was already opened #16527 #16525 #16524

fix(query+model): replace {MODEL} in cast error messages from update and bulkWrite casting #16529 #16502 #16480

9.10.2 / 2026-09-22

... (truncated)

Commits

a477fca chore: release 9.11.2
8111c11 Merge pull request #16574 from OmBhandwaldar/fix/bulkwrite-cast-array-filters
7944871 Merge pull request #16585 from Automattic/vkarpov15/perf-fixup
6b69ea4 Merge pull request #16579 from Automattic/vkarpov15/gh-16572
d8ceee6 fix: address a couple of claude comments
d2ea541 Merge pull request #16581 from Automattic/vkarpov15/query-typescript-perf-master
57b26b9 Merge pull request #16583 from SatvikMishra08/docs/fix-broken-api-anchors
98331b8 Merge pull request #16588 from Automattic/vkarpov15/20261012/upgrade-kareem
d69c1a1 fix: handle skipping built-in plugins for subdocuments at the middleware defi...
d30768b chore: remove min-release-age temporarily for kareem 3.4.1
Additional commits viewable in compare view

Updates multer from 2.3.0 to 2.4.0

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).
const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})
This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)

What's Changed

docs: remove README translations by @UlisesGascon in expressjs/multer#1463

ci: add macOS to the test matrix by @kilisamemarisaaa in expressjs/multer#1464

feat. improve wording for LIMIT_UNEXPECTED_FILE error code by @flashbag in expressjs/multer#426

feat: add filename to file errors by @UjjwalKumar239 in expressjs/multer#1416

refactor: remove concat-stream dependency by @Phillip9587 in expressjs/multer#1356

fix: reject non-integer fileSize limits by @abhu85 in expressjs/multer#1395

fix: allow exactly limits.parts parts by @deepakganesh78 in expressjs/multer#1446

fix: do not consume maxCount for files skipped by fileFilter by @Sagargupta16 in expressjs/multer#1426

fix: validate all limits at construction time by @ShubhamOulkar in expressjs/multer#1335

test: cover storage engine _removeFile invocation semantics by @kilisamemarisaaa in expressjs/multer#1460

feat: accept a function for limits by @hossein-zare in expressjs/multer#1133

fix: add flush option to disk storage to fsync files before completion by @kilisamemarisaaa in expressjs/multer#1458

feat: expose busboy defCharset, highWaterMark and fileHwm options by @UlisesGascon in expressjs/multer#1465

docs: describe the file stream contract for storage engines by @UlisesGascon in expressjs/multer#1468

... (truncated)

Changelog

Sourced from multer's changelog.

2.4.0

Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)

Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)

Accept a function for limits, called with the request, to set limits per request (#1133)

Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)

Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)

Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)

Allow multer.diskStorage() to be called without options (#1471)

Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)

Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)

Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)

Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)

Files skipped by fileFilter no longer count towards maxCount (#1426)

Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)

Remove the concat-stream dependency (#1356)

Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)

Docs: add FormData upload examples (#896)

Docs: remove the translated READMEs (#1463)

Internal: run the test suite on macOS (#1464)

Commits

35979e5 2.4.0 (#1469)
b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
e6bcd7d chore(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#1475)
00dec43 chore(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#1476)
8d5c3b7 feat: allow diskStorage without options (#1471)
02f6e82 fix: report the decoded filename on LIMIT_FILE_SIZE (#1478)
bc3f72d fix: decode escaped field names, not just filenames (#1473)
2661325 docs: add JSDoc to the public API (#1467)
53337f9 fix: remove late-completing uploads aborted before the engine names them
7f2c9ab feat: add streamHandler option to feed busboy from pre-consumed bodies (#1466)
Additional commits viewable in compare view

Updates redis from 6.2.1 to 6.3.0

Commits

c8ff8cc Release redis@6.3.0
c3e8b53 Release entraid@6.3.0
c7f6cb5 Release time-series@6.3.0
3843988 Release search@6.3.0
6b63940 Release json@6.3.0
7b732cd Release bloom@6.3.0
badfdf0 Release client@6.3.0
bfdd485 ci: use npm trusted publishing for releases (#3480)
0afa8d8 chore(deps): bump brace-expansion (#3485)
6ee8ca2 chore(deps): bump ip-address from 10.4.0 to 10.7.2 (#3482)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for redis since your current version.

Updates ws from 8.21.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

Introduced the protocols option (8b918b01).

Bug fixes

Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

Commits

297202c [dist] 8.22.0
8b918b0 [feature] Introduce the protocols option
73e03eb [ci] Update actions/setup-node action to v7
d9b8954 [fix] Change the ready state after validating the arguments (#2337)
See full diff in compare view

Updates @supabase/supabase-js from 2.116.0 to 2.118.0

Release notes

Sourced from @supabase/supabase-js's releases.

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

storage: add content-encoding support for uploads (#1949)

🩹 Fixes

ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

Atharv Gaur @Athaxv

Ferhat Elmas

Lukas Klingsbo

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

🩹 Fixes

ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

Lukas Klingsbo

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

deps: bump next to patch RCE in realtime-js example (#2733)

functions: send a Blob or File with its own content type (#2714)

... (truncated)

Changelog

Sourced from @supabase/supabase-js's changelog.

2.118.0 (2026-10-15)

🚀 Features

postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

❤️ Thank You

Lukas Klingsbo

2.117.3 (2026-10-07)

🩹 Fixes

storage: send multipart fields before files (#2736)

❤️ Thank You

Ferhat Elmas

Katerina Skroumpelou @mandarini

2.117.2 (2026-09-25)

This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.

2.117.1 (2026-09-23)

🩹 Fixes

auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

Katerina Skroumpelou @mandarini

2.117.0 (2026-09-22)

🚀 Features

auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

fadymak

Commits

b9753a1 feat(postgrest): leave computed fields out of select('*') and resolve no-argu...
88faa11 fix(ci): patch next and sharp advisories and pin node-browser playwright (#2753)
aac9d32 chore(release): version 2.117.3 changelogs (#2744)
4d23055 fix(...
Description has been truncated

cloudflare-workers-and-pages · 2026-10-14T01:09:09Z

Deploying codehub with Cloudflare Pages

Latest commit:	`3fc9302`
Status:	✅ Deploy successful!
Preview URL:	https://10524ea3.codehub-1fr.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-back-jak9.codehub-1fr.pages.dev

View logs

vercel · 2026-10-14T01:09:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
code-hub	Ready	Preview	Oct 19, 2026 7:08pm UTC

…dates Bumps the backend-npm group with 11 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [dotenv](https://github.com/motdotla/dotenv) | `17.4.2` | `18.0.8` | | [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.7.0` | `8.7.1` | | [mongoose](https://github.com/Automattic/mongoose) | `9.10.0` | `9.11.2` | | [multer](https://github.com/expressjs/multer) | `2.3.0` | `2.4.0` | | [redis](https://github.com/redis/node-redis) | `6.2.1` | `6.3.0` | | [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.116.0` | `2.118.0` | | [firebase-admin](https://github.com/firebase/firebase-admin-node) | `14.4.0` | `14.5.0` | | [eslint](https://github.com/eslint/eslint) | `8.57.1` | `10.13.0` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.10` | Updates `dotenv` from 17.4.2 to 18.0.8 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.4.2...v18.0.8) Updates `express` from 5.2.1 to 5.3.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v5.2.1...v5.3.0) Updates `express-rate-limit` from 8.7.0 to 8.7.1 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.7.0...v8.7.1) Updates `mongoose` from 9.10.0 to 9.11.2 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@9.10.0...9.11.2) Updates `multer` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.3.0...v2.4.0) Updates `redis` from 6.2.1 to 6.3.0 - [Release notes](https://github.com/redis/node-redis/releases) - [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md) - [Commits](https://github.com/redis/node-redis/compare/redis@6.2.1...redis@6.3.0) Updates `ws` from 8.21.3 to 8.22.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.3...8.22.0) Updates `@supabase/supabase-js` from 2.116.0 to 2.118.0 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.118.0/packages/core/supabase-js) Updates `firebase-admin` from 14.4.0 to 14.5.0 - [Release notes](https://github.com/firebase/firebase-admin-node/releases) - [Changelog](https://github.com/firebase/firebase-admin-node/blob/main/CHANGELOG.md) - [Commits](firebase/firebase-admin-node@v14.4.0...v14.5.0) Updates `eslint` from 8.57.1 to 10.13.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v8.57.1...v10.13.0) Updates `prettier` from 3.9.6 to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.10) --- updated-dependencies: - dependency-name: "@supabase/supabase-js" dependency-version: 2.117.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-npm - dependency-name: dotenv dependency-version: 18.0.7 dependency-type: direct:production update-type: version-update:semver-major dependency-group: backend-npm - dependency-name: eslint dependency-version: 10.12.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: backend-npm - dependency-name: express dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-npm - dependency-name: express-rate-limit dependency-version: 8.7.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-npm - dependency-name: firebase-admin dependency-version: 14.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-npm - dependency-name: mongoose dependency-version: 9.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-npm - dependency-name: multer dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-npm - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: backend-npm - dependency-name: redis dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-npm - dependency-name: ws dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-npm ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026

vercel Bot deployed to Preview October 14, 2026 01:09

View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/backend/backend-npm-4653402183 branch from 946f56b to 3fc9302 Compare October 19, 2026 19:08

vercel Bot deployed to Preview October 19, 2026 19:08

View deployment

Navigation Menu

Repository navigation

chore(deps): bump the backend-npm group across 1 directory with 11 updates - #63

chore(deps): bump the backend-npm group across 1 directory with 11 updates#63
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-npm-4653402183

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

18.0.8 (2026-10-14)

Changed

18.0.7 (2026-10-09)

Changed

18.0.6 (2026-10-06)

Changed

18.0.5 (2026-09-30)

Changed

18.0.4 (2026-09-25)

Changed

18.0.3 (2026-09-22)

Changed

18.0.2 (2026-09-21)

Changed

18.0.1 (2026-09-18)

Changed

v5.3.0

Highlights

🐞 Bug fixes

🚀 Improvements

5.3.0

🐞 Bug fixes

🚀 Improvements

v8.7.1

9.11.2 / 2026-10-12

9.11.1 / 2026-10-07

9.11.0 / 2026-10-05

9.10.4 / 2026-10-02

9.10.3 / 2026-09-29

9.10.2 / 2026-09-22

9.11.2 / 2026-10-12

9.11.1 / 2026-10-07

9.11.0 / 2026-10-05

9.10.4 / 2026-10-02

9.10.3 / 2026-09-29

9.10.2 / 2026-09-22

v2.4.0

Highlights

Important: Security

What's Changed

2.4.0

8.22.0

Features

Bug fixes

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

🩹 Fixes

❤️ Thank You

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

🩹 Fixes

❤️ Thank You

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

2.118.0 (2026-10-15)

🚀 Features

❤️ Thank You

2.117.3 (2026-10-07)

🩹 Fixes

❤️ Thank You

2.117.2 (2026-09-25)

2.117.1 (2026-09-23)

🩹 Fixes

❤️ Thank You

2.117.0 (2026-09-22)

🚀 Features

❤️ Thank You

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Oct 14, 2026 •

edited

Loading

vercel Bot commented Oct 14, 2026 •

edited

Loading