Skip to content

chore(deps): bump the production-minor-patch group across 1 directory with 10 updates#35

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/production-minor-patch-4632990ec0
Open

chore(deps): bump the production-minor-patch group across 1 directory with 10 updates#35
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/production-minor-patch-4632990ec0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 11, 2026

Bumps the production-minor-patch group with 9 updates in the / directory:

Package From To
nanoid 5.1.9 5.1.11
express-rate-limit 8.4.1 8.5.1
fast-xml-parser 5.7.2 5.7.3
ansis 4.2.0 4.3.0
typeorm 0.3.28 0.3.29
next 16.2.4 16.2.6
next-intl 4.11.0 4.11.2
react-dom 19.2.5 19.2.6
joi 18.1.2 18.2.1

Updates nanoid from 5.1.9 to 5.1.11

Release notes

Sourced from nanoid's releases.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

Changelog

Sourced from nanoid's changelog.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

Commits

Updates express-rate-limit from 8.4.1 to 8.5.1

Release notes

Sourced from express-rate-limit's releases.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

Commits

Updates fast-xml-parser from 5.7.2 to 5.7.3

Release notes

Sourced from fast-xml-parser's releases.

fix minor old bugs and update builder

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated
Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

*5.8.0

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

5.7.2 / 2026-04-25

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

  • fix typo in CJS typing file

5.7.0 / 2026-04-17

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to user entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

5.6.0 / 2026-04-15

  • fix: entity replacement for numeric entities
  • use @​nodable/entities to replace entities
    • this may change some error messages related to entities expansion limit or inavlid use
    • post check would be exposed in future version

... (truncated)

Commits
  • d6d8042 update to release
  • d263370 remove dev dependency 'he'
  • f9c9a2c update builder to 1.1.7
  • b65da87 update changelog and mark addEntity deprecated
  • c2ca631 update fxb
  • da75191 fix stop node expression when ns prefix is removed
  • 31bbc99 fix: alwaysCreateTextNode should create text node when attributes are present...
  • dab327a remove unnecessary
  • ab04eeb update docs
  • 383cb3f Revise security information for v6 release
  • See full diff in compare view

Updates ansis from 4.2.0 to 4.3.0

Changelog

Sourced from ansis's changelog.

4.3.0 (2026-05-11)

  • feat: add support for OSC 8 hyperlink: link(url, text)
  • feat: add constructor overload to pass a mock globalThis object for controlled color auto-detection 
    import { Ansis } from 'ansis';
const color = new Ansis({
process: {
env: { FORCE_COLOR: '1' },
argv: ['node', 'app.js'],
stdout: { isTTY: false },
platform: 'linux',
},
});
console.log(color.level); // 1

  • fix(color-support): correctly handle edge cases using ENV variables and CLI flags
Fixed edge case Old behavior (bug) New behavior (correct)
FORCE_COLOR=1, NO_COLOR=1 disable color enable color (FORCE_COLOR takes precedence over NO_COLOR)
NO_COLOR=1, --color disable color enable color (CLI color flags take precedence over NO_COLOR)
FORCE_COLOR=1, --no-color disable color enable color (FORCE_COLOR has the highest priority)
--no-color --color disable color enable color (last flag wins)
--color with no detected colors truecolor 16 colors (auto-detect fallback uses the minimum color level, not truecolor)
Commits

Updates typeorm from 0.3.28 to 0.3.29

Release notes

Sourced from typeorm's releases.

0.3.29

What's Changed

New Contributors

Full Changelog: typeorm/typeorm@0.3.28...0.3.29

Changelog

Sourced from typeorm's changelog.

0.3.29 (2026-05-08)

Bug Fixes

  • add async to the method using setFindOptions() (#10787) (cc07c90)
  • change import for process dependency (#11248) (1c67c3b)
  • cli: init command loading non-existing package.json (#11947) (4d9d1a6)
  • fix up aggregate methods ambiguous column (#11822) (6e34756)
  • fix up limit with joins (#11987) (3657db8)
  • getPendingMigrations unnecessarily creating migrations table (#11672) (1dbc224)
  • postgres: execute queries sequentially to avoid pg 8.19.0 deprecation warning (#12105) (79829a0)
  • prevent columns with select false from being returned (#11944) (6b20831)
  • prevent eager-loaded entities from overwriting manual relations (#11267) (2d8c515)
  • propagate schema and database to closure junction table (#12110) (58b403f)
  • redis: redis cache version detection (#11936) (f22c7a2)
  • release query runner when there is no migration to revert (#11232) (a46eb0a)
  • sap: QueryBuilder parameter of type JS Date not escaped correctly (#11867) (5153436)
  • security: validate limit() in Update/SoftDelete query builders (#12437) (0d7991a)
  • virtual property handling in schema builder (#11000) (5bd3255)

Features

Commits
  • 0ed009a ci: add npm environment to publish job for trusted publishing
  • 6ede38b chore: enable trusted publishing in publish workflow
  • 578d9e9 chore: fix pnpm publish for v0.3
  • 253f060 chore: disable git check on pnpm publish for v0.3
  • 1b5476f chore: set pnpm publish branch for v0.3
  • 17c6ec2 chore(release): release 0.3.29 (#12442)
  • 0ac8092 chore(deps): update all minor (#12443)
  • 0d7991a fix(security): validate limit() in Update/SoftDelete query builders (#12437)
  • c38c754 ci: remove docs indexing (#12435)
  • 1b66c44 Merge commit from fork
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for typeorm since your current version.


Updates next from 16.2.4 to 16.2.6

Release notes

Sourced from next's releases.

v16.2.6

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v16.2.5

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

Commits
  • ee6e79b v16.2.6
  • afa053d Turbopack: Match proxy matchers with webpack implementation (#93594)
  • 97a154e Turbopack: Fix middleware matcher suffix (#93590)
  • 83899bc [backport] Disable build caches for production/staging/force-preview deploys ...
  • 7b222b9 [backport][test] Pin package manager to patch versions (#93595)
  • a8dc24f [backport] Turbopack: more strict vergen setup (#93587)
  • 766148f v16.2.5
  • 0dd9483 fix: add explicit checks for RSC header (#83) (#98)
  • d166096 fix proxy matching for segment prefetch URLs (#89) (#96)
  • 9d50c0b Strip next-resume header from incoming requests (#92)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates next-intl from 4.11.0 to 4.11.2

Release notes

Sourced from next-intl's releases.

v4.11.2

4.11.2 (2026-05-11)

Bug Fixes

v4.11.1

4.11.1 (2026-05-08)

Bug Fixes

Changelog

Sourced from next-intl's changelog.

4.11.2 (2026-05-11)

Bug Fixes

4.11.1 (2026-05-08)

Bug Fixes

Commits

Updates react-dom from 19.2.5 to 19.2.6

Release notes

Sourced from react-dom's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Updates joi from 18.1.2 to 18.2.1

Commits

Updates react from 19.2.5 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-minor-patch group across 1 directory…
674e6eb 
… with 10 updates

Bumps the production-minor-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [nanoid](https://github.com/ai/nanoid) | `5.1.9` | `5.1.11` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.4.1` | `8.5.1` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.7.2` | `5.7.3` |
| [ansis](https://github.com/webdiscus/ansis) | `4.2.0` | `4.3.0` |
| [typeorm](https://github.com/typeorm/typeorm) | `0.3.28` | `0.3.29` |
| [next](https://github.com/vercel/next.js) | `16.2.4` | `16.2.6` |
| [next-intl](https://github.com/amannn/next-intl) | `4.11.0` | `4.11.2` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.6` |
| [joi](https://github.com/hapijs/joi) | `18.1.2` | `18.2.1` |



Updates `nanoid` from 5.1.9 to 5.1.11
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.1.9...5.1.11)

Updates `express-rate-limit` from 8.4.1 to 8.5.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.4.1...v8.5.1)

Updates `fast-xml-parser` from 5.7.2 to 5.7.3
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.7.2...v5.7.3)

Updates `ansis` from 4.2.0 to 4.3.0
- [Release notes](https://github.com/webdiscus/ansis/releases)
- [Changelog](https://github.com/webdiscus/ansis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/webdiscus/ansis/commits)

Updates `typeorm` from 0.3.28 to 0.3.29
- [Release notes](https://github.com/typeorm/typeorm/releases)
- [Changelog](https://github.com/typeorm/typeorm/blob/0.3.29/CHANGELOG.md)
- [Commits](typeorm/typeorm@0.3.28...0.3.29)

Updates `next` from 16.2.4 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.4...v16.2.6)

Updates `next-intl` from 4.11.0 to 4.11.2
- [Release notes](https://github.com/amannn/next-intl/releases)
- [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md)
- [Commits](amannn/next-intl@v4.11.0...v4.11.2)

Updates `react-dom` from 19.2.5 to 19.2.6
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom)

Updates `joi` from 18.1.2 to 18.2.1
- [Commits](hapijs/joi@v18.1.2...v18.2.1)

Updates `react` from 19.2.5 to 19.2.6
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react)

---
updated-dependencies:
- dependency-name: nanoid
  dependency-version: 5.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: express-rate-limit
  dependency-version: 8.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: fast-xml-parser
  dependency-version: 5.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: ansis
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: typeorm
  dependency-version: 0.3.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: next
  dependency-version: 16.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: next-intl
  dependency-version: 4.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: react-dom
  dependency-version: 19.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: joi
  dependency-version: 18.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: react
  dependency-version: 19.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates and security issues label May 11, 2026
@github-actions github-actions Bot added apps Changes to apps/ packages Changes to packages/ labels May 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

apps Changes to apps/ dependencies Dependency updates and security issues packages Changes to packages/

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants