Skip to content

chore(deps): bump the production-deps group with 27 updates#8

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-deps-42effad4ca
Open

chore(deps): bump the production-deps group with 27 updates#8
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-deps-42effad4ca

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production-deps group with 27 updates:

Package From To
@anthropic-ai/sdk 0.52.0 0.112.3
diff 5.2.0 9.0.0
cors 2.8.5 2.8.6
dotenv 16.6.1 17.4.2
express 4.21.2 5.2.1
express-rate-limit 7.5.1 8.6.0
express-validator 7.2.1 7.3.2
helmet 7.2.0 8.3.0
joi 17.13.3 18.2.3
pg 8.16.3 8.22.0
redis 4.7.1 6.1.0
uuid 9.0.1 14.0.1
winston 3.17.0 3.19.0
winston-daily-rotate-file 4.7.1 5.0.0
@grpc/grpc-js 1.13.4 1.14.4
@grpc/proto-loader 0.7.15 0.8.1
ioredis 5.6.1 5.11.1
knex 3.1.0 3.3.0
reflect-metadata 0.1.14 0.2.2
@octokit/app 16.0.1 16.1.2
@octokit/auth-app 6.1.4 8.2.0
@octokit/rest 20.1.2 22.0.1
@octokit/webhooks 12.3.2 14.2.0
convict 6.2.4 6.2.5
dotenv-expand 10.0.0 13.0.0
zod 3.25.76 4.4.3
axios 1.11.0 1.18.1

Updates @anthropic-ai/sdk from 0.52.0 to 0.112.3

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.112.3

0.112.3 (2026-07-17)

Full Changelog: sdk-v0.112.2...sdk-v0.112.3

Chores

sdk: v0.112.2

0.112.2 (2026-07-17)

Full Changelog: sdk-v0.112.1...sdk-v0.112.2

Chores

sdk: v0.112.1

0.112.1 (2026-07-16)

Full Changelog: sdk-v0.112.0...sdk-v0.112.1

sdk: v0.112.0

0.112.0 (2026-07-16)

Full Changelog: sdk-v0.111.0...sdk-v0.112.0

Features

  • api: add support for MCP Tunnels (597ac41)

sdk: v0.111.0

0.111.0 (2026-07-10)

Full Changelog: sdk-v0.110.0...sdk-v0.111.0

Features

  • api: add support for dreaming (77b28a6)
  • tools: gate session tool calls on evaluated_permission; bound idle by server stop_reason (68a6d7b)

Chores

  • docs: small updates to field descriptions (e25b885)
  • docs: update model example (a33f3f0)
  • docs: updates to descriptions and examples (eac4bac)

sdk: v0.110.0

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.112.3 (2026-07-17)

Full Changelog: sdk-v0.112.2...sdk-v0.112.3

Chores

0.112.2 (2026-07-17)

Full Changelog: sdk-v0.112.1...sdk-v0.112.2

Chores

0.112.1 (2026-07-16)

Full Changelog: sdk-v0.112.0...sdk-v0.112.1

0.112.0 (2026-07-16)

Full Changelog: sdk-v0.111.0...sdk-v0.112.0

Features

  • api: add support for MCP Tunnels (597ac41)

0.111.0 (2026-07-10)

Full Changelog: sdk-v0.110.0...sdk-v0.111.0

Features

  • api: add support for dreaming (77b28a6)
  • tools: gate session tool calls on evaluated_permission; bound idle by server stop_reason (68a6d7b)

Chores

  • docs: small updates to field descriptions (e25b885)
  • docs: update model example (a33f3f0)
  • docs: updates to descriptions and examples (eac4bac)

0.110.0 (2026-07-02)

Full Changelog: sdk-v0.109.1...sdk-v0.110.0

Features

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.


Updates diff from 5.2.0 to 9.0.0

Changelog

Sourced from diff's changelog.

9.0.0

(All changes part of PR #672.)

  • ES5 support is dropped. parsePatch now uses TextDecoder and Uint8Array, which are not available in ES5, and TypeScript is now compiled with the "es6" target. From now on, I intend to freely use any features that are deemed "Widely available" by Baseline. Users who need ES5 support should stick to version 8.

  • C-style quoted strings in filename headers are now properly supported.

    When the name of either the old or new file in a patch contains "special characters", both GNU diff and Git quote the filename in the patch's headers and escape special characters using the same escape sequences that are used in string literals in C, including octal escapes for all non-ASCII characters. Previously, jsdiff had very little support for this; parsePatch would remove the quotes, and unescape any escaped backslashes, but would not unescape other escape sequences. formatPatch, meanwhile, did not quote or escape special characters at all.

    Now, parsePatch parses all the possible escape sequences that GNU diff (or Git) ever output, and formatPatch quotes and escapes filenames containing special characters in the same way GNU diff does.

  • formatPatch now omits file headers when oldFileName or newFileName in the provided patch object are undefined, regardless of the headerOptions parameter. (Previously, it would treat the absence of oldFileName or newFileName as indicating the filename was the word "undefined" and emit headers --- undefined / +++ undefined.)

  • formatPatch no longer outputs trailing tab characters at the end of ---/+++ headers.

    Previously, if formatPatch was passed a patch object to serialize that had empty strings for the oldHeader or newHeader property, it would include a trailing tab character after the filename in the --- and/or +++ file header. Now, this scenario is treated the same as when oldHeader/newHeader is undefined - i.e. the trailing tab is omitted.

  • formatPatch no longer mutates its input when serializing a patch containing a hunk where either the old or new content contained zero lines. (Such a hunk occurs only when the hunk has no context lines and represents a pure insertion or pure deletion, which for instance will occur whenever one of the two files being diffed is completely empty.) Previously formatPatch would provide the correct output but also mutate the oldLines or newLines property on the hunk, changing the meaning of the underlying patch.

  • Git-style patches are now supported by parsePatch, formatPatch, and reversePatch.

    Patches output by git diff can include some features that are unlike those output by GNU diff, and therefore not handled by an ordinary unified diff format parser. An ordinary diff simply describes the differences between the content of two files, but Git diffs can also indicate, via "extended headers", the creation or deletion of (potentially empty) files, indicate that a file was renamed, and contain information about file mode changes. Furthermore, when these changes appear in a diff in the absence of a content change (e.g. when an empty file is created, or a file is renamed without content changes), the patch will contain no associated ---/+++ file headers nor any hunks.

    jsdiff previously did not support parsing Git's extended headers, nor hunkless patches. Now parsePatch parses some of the extended headers, parses hunkless Git patches, and can determine filenames (e.g. from the extended headers) when parsing a patch that includes no --- or +++ file headers. The additional information conveyed by the extended headers we support is recorded on new fields on the result object returned by parsePatch. See isGit and subsequent properties in the docs in the README.md file.

    formatPatch now outputs extended headers based on these new Git-specific properties, and reversePatch respects them as far as possible (with one unavoidable caveat noted in the README.md file).

  • Unpaired file headers now cause parsePatch to throw.

    It remains acceptable to have a patch with no file headers whatsoever (e.g. one that begins with a @@ hunk header on the very first line), but a patch with only a --- header or only a +++ header is now considered an error.

  • parsePatch is now more tolerant of "trailing garbage"

    That is: after a patch, or between files/indexes in a patch, it is now acceptable to have arbitrary lines of "garbage" (so long as they unambiguously have no syntactic meaning - e.g. trailing garbage that leads with a +, -, or and thus is interpretable as part of a hunk still triggers a throw).

    This means we no longer reject patches output by tools that include extra data in "garbage" lines not understood by generic unified diff parsers. (For example, SVN patches can include "Property changes on:" lines that generic unified diff parsers should discard as garbage; jsdiff previously threw errors when encountering them.)

    This change brings jsdiff's behaviour more in line with GNU patch, which is highly permissive of "garbage".

  • The oldFileName and newFileName fields of StructuredPatch are now typed as string | undefined instead of string. This type change reflects the (pre-existing) reality that parsePatch can produce patches without filenames (e.g. when parsing a patch that simply contains hunks with no file headers).

8.0.4

  • #667 - fix another bug in diffWords when used with an Intl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space), diffWords would previously crash. Now this case is handled correctly.

8.0.3

  • #631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).
  • #635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.

... (truncated)

Commits

Updates cors from 2.8.5 to 2.8.6

Release notes

Sourced from cors's releases.

v2.8.6

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from cors's changelog.

2.8.6 / 2026-01-22

  • Improve documentation (API, context, examples...)
  • Remove additional markdown files from tarball
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for cors since your current version.


Updates dotenv from 16.6.1 to 17.4.2

Changelog

Sourced from dotenv's changelog.

17.4.2 (2026-04-12)

Changed

  • Improved skill files - tightened up details (#1009)

17.4.1 (2026-04-05)

Changed

  • Change text injecting to injected (#1005)

17.4.0 (2026-04-01)

Added

  • Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

  • Tighten up logs: ◇ injecting env (14) from .env (#1003)

17.3.1 (2026-02-12)

Changed

  • Fix as2 example command in README and update spanish README

17.3.0 (2026-02-12)

Added

  • Add a new README section on dotenv’s approach to the agentic future.

Changed

  • Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

17.2.4 (2026-02-05)

Changed

  • Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)
  • Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

17.2.3 (2025-09-29)

Changed

  • Fixed typescript error definition (#912)

... (truncated)

Commits

Updates express from 4.21.2 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

5.0.1 / 2024-10-08

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0

... (truncated)

Commits

Updates express-rate-limit from 7.5.1 to 8.6.0

Release notes

Sourced from express-rate-limit's releases.

v8.6.0

You can view the changelog here.

v8.5.2

You can view the changelog here.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

v8.4.1

You can view the changelog here.

v8.4.0

You can view the changelog here.

v8.3.2

You can view the changelog here.

v8.3.1

You can view the changelog here.

v8.3.0

You can view the changelog here.

v8.2.1

You can view the changelog here.

v8.2.0

You can view the changelog here.

v8.1.0

You can view the changelog here.

v8.0.1

You can view the changelog here.

v8.0.0

You can view the changelog here.

Commits
  • fffb3c4 8.6.0
  • f366b2d docs: debugging guide, time constants, & v8.6.0 changelog (#652)
  • 593ddd2 fix: make debug output easier to read (#653)
  • ef8c129 fix: Pin safe version of @​asyncapi/specs dev dep (#659)
  • 7b05e0d feat: add time constants to support more readable values for windowMs (#655)
  • 863e730 chore(deps-dev): bump the development-dependencies group with 3 updates (#657)
  • e0e711e fix: correct wording in usage documentation for express-rate-limit (#656)
  • fcd3aa7 chore(deps-dev): bump the development-dependencies group with 3 updates (#651)
  • 99d4298 feat: use debug for debug logging (#641)
  • 23e4dde feat: Run validations once each (#650)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates express-validator from 7.2.1 to 7.3.2

Release notes

Sourced from express-validator's releases.

v7.3.2

What's Changed

Plus several docs changes.

New Contributors

Full Changelog: express-validator/express-validator@v7.3.1...v7.3.2

v7.3.1

v7.3.0

Commits

Updates helmet from 7.2.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

  • Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
  • Content-Security-Policy: improved error handling for invalid directive names

Fixed

  • Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
  • Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
  • Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

  • Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
  • Improve error message when passing duplicate options

8.1.0 - 2025-03-17

Changed

  • Content-Security-Policy gives a better error when a directive value, like self, should be quoted. See #482

8.0.0 - 2024-09-28

Changed

  • Breaking: Strict-Transport-Security now has a max-age of 365 days, up from 180
  • Breaking: Content-Security-Policy middleware now throws an er...

    Description has been truncated

@dependabot
chore(deps): bump the production-deps group with 27 updates
04c6a9d 
Bumps the production-deps group with 27 updates:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.52.0` | `0.112.3` |
| [diff](https://github.com/kpdecker/jsdiff) | `5.2.0` | `9.0.0` |
| [cors](https://github.com/expressjs/cors) | `2.8.5` | `2.8.6` |
| [dotenv](https://github.com/motdotla/dotenv) | `16.6.1` | `17.4.2` |
| [express](https://github.com/expressjs/express) | `4.21.2` | `5.2.1` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `7.5.1` | `8.6.0` |
| [express-validator](https://github.com/express-validator/express-validator) | `7.2.1` | `7.3.2` |
| [helmet](https://github.com/helmetjs/helmet) | `7.2.0` | `8.3.0` |
| [joi](https://github.com/hapijs/joi) | `17.13.3` | `18.2.3` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.16.3` | `8.22.0` |
| [redis](https://github.com/redis/node-redis) | `4.7.1` | `6.1.0` |
| [uuid](https://github.com/uuidjs/uuid) | `9.0.1` | `14.0.1` |
| [winston](https://github.com/winstonjs/winston) | `3.17.0` | `3.19.0` |
| [winston-daily-rotate-file](https://github.com/winstonjs/winston-daily-rotate-file) | `4.7.1` | `5.0.0` |
| [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.13.4` | `1.14.4` |
| [@grpc/proto-loader](https://github.com/grpc/grpc-node) | `0.7.15` | `0.8.1` |
| [ioredis](https://github.com/luin/ioredis) | `5.6.1` | `5.11.1` |
| [knex](https://github.com/knex/knex) | `3.1.0` | `3.3.0` |
| [reflect-metadata](https://github.com/rbuckton/reflect-metadata) | `0.1.14` | `0.2.2` |
| [@octokit/app](https://github.com/octokit/app.js) | `16.0.1` | `16.1.2` |
| [@octokit/auth-app](https://github.com/octokit/auth-app.js) | `6.1.4` | `8.2.0` |
| [@octokit/rest](https://github.com/octokit/rest.js) | `20.1.2` | `22.0.1` |
| [@octokit/webhooks](https://github.com/octokit/webhooks.js) | `12.3.2` | `14.2.0` |
| [convict](https://github.com/mozilla/node-convict) | `6.2.4` | `6.2.5` |
| [dotenv-expand](https://github.com/motdotla/dotenv-expand) | `10.0.0` | `13.0.0` |
| [zod](https://github.com/colinhacks/zod) | `3.25.76` | `4.4.3` |
| [axios](https://github.com/axios/axios) | `1.11.0` | `1.18.1` |


Updates `@anthropic-ai/sdk` from 0.52.0 to 0.112.3
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.52.0...sdk-v0.112.3)

Updates `diff` from 5.2.0 to 9.0.0
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v5.2.0...v9.0.0)

Updates `cors` from 2.8.5 to 2.8.6
- [Release notes](https://github.com/expressjs/cors/releases)
- [Changelog](https://github.com/expressjs/cors/blob/master/HISTORY.md)
- [Commits](expressjs/cors@v2.8.5...v2.8.6)

Updates `dotenv` from 16.6.1 to 17.4.2
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v16.6.1...v17.4.2)

Updates `express` from 4.21.2 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@4.21.2...v5.2.1)

Updates `express-rate-limit` from 7.5.1 to 8.6.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.6.0)

Updates `express-validator` from 7.2.1 to 7.3.2
- [Release notes](https://github.com/express-validator/express-validator/releases)
- [Commits](express-validator/express-validator@v7.2.1...v7.3.2)

Updates `helmet` from 7.2.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v7.2.0...v8.3.0)

Updates `joi` from 17.13.3 to 18.2.3
- [Commits](hapijs/joi@v17.13.3...v18.2.3)

Updates `pg` from 8.16.3 to 8.22.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.22.0/packages/pg)

Updates `redis` from 4.7.1 to 6.1.0
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@4.7.1...redis@6.1.0)

Updates `uuid` from 9.0.1 to 14.0.1
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v9.0.1...v14.0.1)

Updates `winston` from 3.17.0 to 3.19.0
- [Release notes](https://github.com/winstonjs/winston/releases)
- [Changelog](https://github.com/winstonjs/winston/blob/master/CHANGELOG.md)
- [Commits](winstonjs/winston@v3.17.0...v3.19.0)

Updates `winston-daily-rotate-file` from 4.7.1 to 5.0.0
- [Release notes](https://github.com/winstonjs/winston-daily-rotate-file/releases)
- [Changelog](https://github.com/winstonjs/winston-daily-rotate-file/blob/master/CHANGELOG.md)
- [Commits](winstonjs/winston-daily-rotate-file@v4.7.1...v5.0.0)

Updates `@grpc/grpc-js` from 1.13.4 to 1.14.4
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.13.4...@grpc/grpc-js@1.14.4)

Updates `@grpc/proto-loader` from 0.7.15 to 0.8.1
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/proto-loader@0.7.15...@grpc/proto-loader@0.8.1)

Updates `ioredis` from 5.6.1 to 5.11.1
- [Release notes](https://github.com/luin/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.6.1...v5.11.1)

Updates `knex` from 3.1.0 to 3.3.0
- [Release notes](https://github.com/knex/knex/releases)
- [Changelog](https://github.com/knex/knex/blob/master/CHANGELOG.md)
- [Commits](knex/knex@3.1.0...3.3.0)

Updates `reflect-metadata` from 0.1.14 to 0.2.2
- [Release notes](https://github.com/rbuckton/reflect-metadata/releases)
- [Commits](https://github.com/rbuckton/reflect-metadata/commits)

Updates `@octokit/app` from 16.0.1 to 16.1.2
- [Release notes](https://github.com/octokit/app.js/releases)
- [Commits](octokit/app.js@v16.0.1...v16.1.2)

Updates `@octokit/auth-app` from 6.1.4 to 8.2.0
- [Release notes](https://github.com/octokit/auth-app.js/releases)
- [Commits](octokit/auth-app.js@v6.1.4...v8.2.0)

Updates `@octokit/rest` from 20.1.2 to 22.0.1
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](octokit/rest.js@v20.1.2...v22.0.1)

Updates `@octokit/webhooks` from 12.3.2 to 14.2.0
- [Release notes](https://github.com/octokit/webhooks.js/releases)
- [Commits](octokit/webhooks.js@v12.3.2...v14.2.0)

Updates `convict` from 6.2.4 to 6.2.5
- [Changelog](https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md)
- [Commits](mozilla/node-convict@v6.2.4...v6.2.5)

Updates `dotenv-expand` from 10.0.0 to 13.0.0
- [Changelog](https://github.com/motdotla/dotenv-expand/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv-expand@v10.0.0...v13.0.0)

Updates `zod` from 3.25.76 to 4.4.3
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.25.76...v4.4.3)

Updates `axios` from 1.11.0 to 1.18.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.11.0...v1.18.1)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.112.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: diff
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: cors
  dependency-version: 2.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: dotenv
  dependency-version: 17.4.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: express-rate-limit
  dependency-version: 8.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: express-validator
  dependency-version: 7.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: joi
  dependency-version: 18.2.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: pg
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: redis
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: uuid
  dependency-version: 14.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: winston
  dependency-version: 3.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: winston-daily-rotate-file
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: "@grpc/grpc-js"
  dependency-version: 1.14.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@grpc/proto-loader"
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: ioredis
  dependency-version: 5.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: knex
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: reflect-metadata
  dependency-version: 0.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@octokit/app"
  dependency-version: 16.1.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@octokit/auth-app"
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: "@octokit/rest"
  dependency-version: 22.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: "@octokit/webhooks"
  dependency-version: 14.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: convict
  dependency-version: 6.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: dotenv-expand
  dependency-version: 13.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: zod
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-deps
- dependency-name: axios
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants