Skip to content

build(deps): bump the production-weekly group with 6 updates - #1364

Merged
MBombeck merged 2 commits into
mainfrom
dependabot/npm_and_yarn/production-weekly-c8dd5bd837
Nov 10, 2026
Merged

MBombeck merged 2 commits into
mainfrom
dependabot/npm_and_yarn/production-weekly-c8dd5bd837

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-weekly group with 6 updates:

Package From To
@aws-sdk/client-s3 3.1161.0 3.1162.0
@aws-sdk/lib-storage 3.1161.0 3.1162.0
@tanstack/react-query 5.105.3 5.106.1
lucide-react 1.67.0 1.69.0
pg-boss 12.38.0 12.38.1
undici 8.12.3 8.12.4

Updates @aws-sdk/client-s3 from 3.1161.0 to 3.1162.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1162.0

3.1162.0(2026-11-04)

Documentation Changes
  • fix typos in credential-providers and xhr-http-handler READMEs (#8400) (13b91575)
New Features
  • clients: update client endpoints as of 2026-11-04 (7b30cd35)
  • client-lookoutequipment: Amazon Lookout for Equipment reached end of support on October 7, 2026. All Lookout for Equipment APIs are now marked as deprecated. (9a4a6882)
  • client-rolesanywhere: Adds the crlDpRevocationEnabled field to enable automatic revocation checking using CRL distribution points in X.509 certificates. (5c3071ce)
  • client-marketplace-discovery: GetListing and SearchListings APIs now return G2 and PeerSpot review sources in review summaries. (cb49279d)
  • client-ec2: Add the Unsupported SupportabilityScore to GetCapacityManagerSupportabilityScores. (e8a84dc8)
  • client-elastic-beanstalk: Adds DefaultAmiList to DescribePlatformVersion to return the default AMI for each processor architecture that a platform version supports. (a7dfafce)
  • client-iotsitewise: Adds support for an optional jobName on CreateDatasetExportJob. The jobName is returned by DescribeDatasetExportJob and ListDatasetExportJobs, making dataset export jobs easier to identify and track. If jobName is omitted, a default name is generated automatically. (33a8bf05)
  • client-connect-contact-lens: Rules TBAC GA (Contact Lens V1) - Adds an optional ListFilter (CategoriesAttributeFilter with OrConditions, AndCondition and TagCondition) to ListRealtimeContactAnalysisSegments. This filters matched categories by rule tags. It also adds an optional RuleId to CategoryDetails in the response. (c09702f1)
  • client-taxsettings: Adds Colombia additional information (responsibility codes, taxpayer type code, and RUT issue date) and a rejection reason (statusReason) to tax registration responses, and adds Argentina and Uruguay tax registration types. (582f0ce2)
  • client-s3tables: Amazon S3 Tables now supports migrating AWS Glue Data Catalog tables into S3 Table buckets. This release adds the StartTableMigration, SyncTableMigration, UpdateTableMigration, CompleteTableMigration, GetTableMigration, and ListTableMigrations APIs. (235b2d68)
  • client-mwaa-serverless: Adding support to Environment Variables in MWAA Serverless (0711d44d)
  • client-securityhub: Release Software APIs- GetSoftwareV2, GetSoftwareStatisticsV2 and GetSoftwareResourcesV2 to list software packages with aggregated resource count, get aggregated software statistics, and find the resources that contain a specific software package. (e6a212fd)
  • client-polly: Amazon Polly now supports tagging lexicons. Use the new TagResource, UntagResource and ListTagsForResource APIs, or add tags when creating a lexicon with PutLexicon, to organize lexicons and control access with tag-based (ABAC) IAM policies. (b563b284)
  • client-dynamodb: Adds StartBulkPutItems, DescribeBulkOperation, ListBulkOperations, and CancelBulkOperation for asynchronously loading Amazon S3 datasets into existing DynamoDB tables. (a083a88e)
  • client-workspaces: Add Ubuntu 24.04, Ubuntu 26.04, RHEL 9, RHEL10, Rocky 9 and Rocky 10 to OperatingSystemName and documentation update for WorkspaceProperties Protocols. (f91e0bd8)
  • client-ecs: Amazon ECS Managed Instances now supports the json-file log driver in task definitions. Daemon task definition volumes also support logDriverVolumeConfiguration, letting managed daemons read those logs. (5f4cd8d7)
  • client-rds: Adding support for copying and tagging option groups with cross-Region DB snapshot copies, in the same account or across accounts. (bf1c62aa)
  • client-emr: Added StepAdditionalInfo on DescribeStep and ListSteps to surface YARN application IDs for steps. (03e285ec)
  • client-mgn: This release adds Migration Planning artifacts as a source environment for network migration definitions, and an optional clientToken on CreateNetworkMigrationDefinition so that retried requests don't create duplicate definitions. (79e9a5d6)
  • client-connect: Adds support for retrieving associated cases in contact responses. The Contact object now includes a Cases field containing case IDs and reference numbers linked to the contact. (fb1c3998)
  • codegen: add a default socket timeout per service (#8396) (8f62478c)
Bug Fixes
  • codegen: drop redundant alias from node:stream Readable type import (#8402) (4e5ce5ae)

For list of updated packages, view updated-packages.md in assets-3.1162.0.zip

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1162.0 (2026-11-04)

Bug Fixes

  • codegen: drop redundant alias from node:stream Readable type import (#8402) (4e5ce5a)
Commits

Updates @aws-sdk/lib-storage from 3.1161.0 to 3.1162.0

Release notes

Sourced from @​aws-sdk/lib-storage's releases.

v3.1162.0

3.1162.0(2026-11-04)

Documentation Changes
  • fix typos in credential-providers and xhr-http-handler READMEs (#8400) (13b91575)
New Features
  • clients: update client endpoints as of 2026-11-04 (7b30cd35)
  • client-lookoutequipment: Amazon Lookout for Equipment reached end of support on October 7, 2026. All Lookout for Equipment APIs are now marked as deprecated. (9a4a6882)
  • client-rolesanywhere: Adds the crlDpRevocationEnabled field to enable automatic revocation checking using CRL distribution points in X.509 certificates. (5c3071ce)
  • client-marketplace-discovery: GetListing and SearchListings APIs now return G2 and PeerSpot review sources in review summaries. (cb49279d)
  • client-ec2: Add the Unsupported SupportabilityScore to GetCapacityManagerSupportabilityScores. (e8a84dc8)
  • client-elastic-beanstalk: Adds DefaultAmiList to DescribePlatformVersion to return the default AMI for each processor architecture that a platform version supports. (a7dfafce)
  • client-iotsitewise: Adds support for an optional jobName on CreateDatasetExportJob. The jobName is returned by DescribeDatasetExportJob and ListDatasetExportJobs, making dataset export jobs easier to identify and track. If jobName is omitted, a default name is generated automatically. (33a8bf05)
  • client-connect-contact-lens: Rules TBAC GA (Contact Lens V1) - Adds an optional ListFilter (CategoriesAttributeFilter with OrConditions, AndCondition and TagCondition) to ListRealtimeContactAnalysisSegments. This filters matched categories by rule tags. It also adds an optional RuleId to CategoryDetails in the response. (c09702f1)
  • client-taxsettings: Adds Colombia additional information (responsibility codes, taxpayer type code, and RUT issue date) and a rejection reason (statusReason) to tax registration responses, and adds Argentina and Uruguay tax registration types. (582f0ce2)
  • client-s3tables: Amazon S3 Tables now supports migrating AWS Glue Data Catalog tables into S3 Table buckets. This release adds the StartTableMigration, SyncTableMigration, UpdateTableMigration, CompleteTableMigration, GetTableMigration, and ListTableMigrations APIs. (235b2d68)
  • client-mwaa-serverless: Adding support to Environment Variables in MWAA Serverless (0711d44d)
  • client-securityhub: Release Software APIs- GetSoftwareV2, GetSoftwareStatisticsV2 and GetSoftwareResourcesV2 to list software packages with aggregated resource count, get aggregated software statistics, and find the resources that contain a specific software package. (e6a212fd)
  • client-polly: Amazon Polly now supports tagging lexicons. Use the new TagResource, UntagResource and ListTagsForResource APIs, or add tags when creating a lexicon with PutLexicon, to organize lexicons and control access with tag-based (ABAC) IAM policies. (b563b284)
  • client-dynamodb: Adds StartBulkPutItems, DescribeBulkOperation, ListBulkOperations, and CancelBulkOperation for asynchronously loading Amazon S3 datasets into existing DynamoDB tables. (a083a88e)
  • client-workspaces: Add Ubuntu 24.04, Ubuntu 26.04, RHEL 9, RHEL10, Rocky 9 and Rocky 10 to OperatingSystemName and documentation update for WorkspaceProperties Protocols. (f91e0bd8)
  • client-ecs: Amazon ECS Managed Instances now supports the json-file log driver in task definitions. Daemon task definition volumes also support logDriverVolumeConfiguration, letting managed daemons read those logs. (5f4cd8d7)
  • client-rds: Adding support for copying and tagging option groups with cross-Region DB snapshot copies, in the same account or across accounts. (bf1c62aa)
  • client-emr: Added StepAdditionalInfo on DescribeStep and ListSteps to surface YARN application IDs for steps. (03e285ec)
  • client-mgn: This release adds Migration Planning artifacts as a source environment for network migration definitions, and an optional clientToken on CreateNetworkMigrationDefinition so that retried requests don't create duplicate definitions. (79e9a5d6)
  • client-connect: Adds support for retrieving associated cases in contact responses. The Contact object now includes a Cases field containing case IDs and reference numbers linked to the contact. (fb1c3998)
  • codegen: add a default socket timeout per service (#8396) (8f62478c)
Bug Fixes
  • codegen: drop redundant alias from node:stream Readable type import (#8402) (4e5ce5ae)

For list of updated packages, view updated-packages.md in assets-3.1162.0.zip

Changelog

Sourced from @​aws-sdk/lib-storage's changelog.

3.1162.0 (2026-11-04)

Note: Version bump only for package @​aws-sdk/lib-storage

Commits

Updates @tanstack/react-query from 5.105.3 to 5.106.1

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.106.1

Patch Changes

  • #12528 c4ed956 - fix({query,react-query,preact-query}-devtools): always render the devtools left-to-right regardless of the page direction or browser language
  • Updated dependencies [c4ed956]:
    • @​tanstack/query-devtools@​5.106.1
    • @​tanstack/react-query@​5.106.1

@​tanstack/react-query-next-experimental@​5.106.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.106.1

@​tanstack/react-query-persist-client@​5.106.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.106.1
    • @​tanstack/react-query@​5.106.1

@​tanstack/react-query@​5.106.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.106.1

@​tanstack/react-query-devtools@​5.106.0

Patch Changes

  • #12499 46d0477 - Let inline devtools panels fill their container height while keeping a 500px default height when the container has no set height.
  • Updated dependencies [46d0477, f69b28a, 1176d37, 254350f]:
    • @​tanstack/query-devtools@​5.106.0
    • @​tanstack/react-query@​5.106.0

@​tanstack/react-query-next-experimental@​5.106.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.106.0

@​tanstack/react-query-persist-client@​5.106.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.106.0
    • @​tanstack/react-query@​5.106.0

@​tanstack/react-query@​5.106.0

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.106.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.106.1

5.106.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.106.0
Commits

Updates lucide-react from 1.67.0 to 1.69.0

Release notes

Sourced from lucide-react's releases.

Version 1.69.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Commits

Updates pg-boss from 12.38.0 to 12.38.1

Release notes

Sourced from pg-boss's releases.

12.38.1

Schema version: 46, unchanged from 12.38.0

  • Fix: groupConcurrency could be exceeded when several fetches ran at once. Each one counted a group's active jobs without seeing the jobs the others had just claimed, so a group could go over its limit by up to the number of fetches running at once. A fetch now counts its groups again after its claim commits, and puts the jobs over the limit back to created before any handler sees them. Of two fetches that raced, at least the later one sees both claims. A fetch that puts back every job it claimed tries again after a short random pause, up to three tries.

    A job that the queue's policy refuses to put back, such as a stately key whose created slot filled after the claim, runs over the limit. The rest of the batch still goes back.

    fetch() with db, inside your own transaction, is not covered. Other fetches can't see its claim until that transaction commits, and it doesn't try again, since it would claim the jobs it just put back.

    Thanks to @​shubrt for the report in #976 and to @​shehjaddev for the fix in #983.

  • Fix: a daily or other hour-restricted cron schedule with a tz sent twice on the night the clocks go back, once at each of the repeated local times. It now sends once, which is what cron does and what previewSchedule() lists. A schedule that names every hour, like 0 * * * *, still sends in both repeated hours. The missed: 'once' catch-up follows the same rule. Thanks to @​calpeyser for the fix in #985.

  • Fix: with a TestClock, pg-boss set up each new pool connection from the pool's connect event without waiting, so the first query on that connection queued behind the setup. pg 8 prints a deprecation warning for that ("Calling client.query() when the client is already executing a query"), and pg 9 removes the queue. The setup now runs in pg-pool's onConnect, which finishes before the connection is handed out. If the setup fails, the checkout fails with its error and the connection is closed, instead of the connection being handed out without it. Thanks to @​KyleJune for the report in #986 and to @​efeesrefinal for the fix in #991.

  • Fix: a worker timed its polling round with the clock passed to new PgBoss({ clock }), so setting a TestClock back during a round delayed the next poll by the same amount. Workers now time the round with the system clock. Job timestamps still use the configured clock. Thanks to @​tolborg for the report in #987 and to @​wood0v0 for the fix in #990.

  • Fix: the 12.38.0 type declarations referred to ResolvedConstructorOptions and CompatibilityFlags, which the build had left out, so a project that typechecks its dependencies (skipLibCheck: false) failed with TS2724. The published declarations include both. Thanks to @​TinyQ for the report in #988.

PRs

Full Changelog: timgit/pg-boss@12.38.0...12.38.1

Commits
  • 32fd852 12.38.1
  • 041aea0 fix: a give-back the queue policy refuses keeps only that job past groupConcu...
  • fa2bcce fix: give back jobs claimed past groupConcurrency by concurrent fetches (#983)
  • 18afa70 fix(types): published declarations keep the resolved options type they name (...
  • e000e1e fix(schedule): a daily cron schedule sends once on the night the clocks go ba...
  • a93016a fix(worker): time the polling round with Date.now() (#990)
  • 5a371ff fix: run session statements in pg-pool's onConnect (#991)
  • f4edf6b ci: bump fast-uri from 3.1.8 to 3.1.9 (#979)
  • 0bd43f4 ci: bump undici from 7.30.0 to 7.30.1 in /packages/dashboard (#980)
  • 71ea068 Chore/dashboard 1.13.0 (#978)
  • Additional commits viewable in compare view

Updates undici from 8.12.3 to 8.12.4

Release notes

Sourced from undici's releases.

v8.12.4

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 8.12.2 and 8.12.3 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

A shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

A cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

The redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

A downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

fetch() could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

... (truncated)

Commits
  • 779ee3e Bumped v8.12.4 (#6162)
  • 10fa822 docs: remove security release notes
  • 6228fc5 docs: add security release notes
  • 1dd2657 test(cache): align redirect caching with hop policy
  • 8ea1d61 fix(cache): detect an actual redirect, not a plain revalidation
  • 4257261 test(cache): cover credentialed revalidation refresh
  • aa7ccff fix(cache): treat proxy-authorization as a credential when caching redirects
  • 8cf5ce1 test(cache): cover proxy-authorization credential on same-origin redirect
  • 26c42c2 fix(cache): do not cache credential-bearing same-origin redirects under the a...
  • e958661 test: cover decompress too-many-content-encodings throw on async cache replay
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-weekly group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1161.0` | `3.1162.0` |
| [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.1161.0` | `3.1162.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.105.3` | `5.106.1` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.67.0` | `1.69.0` |
| [pg-boss](https://github.com/timgit/pg-boss) | `12.38.0` | `12.38.1` |
| [undici](https://github.com/nodejs/undici) | `8.12.3` | `8.12.4` |


Updates `@aws-sdk/client-s3` from 3.1161.0 to 3.1162.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1162.0/clients/client-s3)

Updates `@aws-sdk/lib-storage` from 3.1161.0 to 3.1162.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1162.0/lib/lib-storage)

Updates `@tanstack/react-query` from 5.105.3 to 5.106.1
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.106.1/packages/react-query)

Updates `lucide-react` from 1.67.0 to 1.69.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.69.0/packages/lucide-react)

Updates `pg-boss` from 12.38.0 to 12.38.1
- [Release notes](https://github.com/timgit/pg-boss/releases)
- [Commits](timgit/pg-boss@12.38.0...12.38.1)

Updates `undici` from 8.12.3 to 8.12.4
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.12.3...v8.12.4)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1162.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-weekly
- dependency-name: "@aws-sdk/lib-storage"
  dependency-version: 3.1162.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-weekly
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.106.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-weekly
- dependency-name: lucide-react
  dependency-version: 1.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-weekly
- dependency-name: pg-boss
  dependency-version: 12.38.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-weekly
- dependency-name: undici
  dependency-version: 8.12.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-weekly
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 8, 2026
Retention defaults, the job_now() deletion clause and the clock body are unchanged in 12.38.1.
@MBombeck
MBombeck merged commit 22b85ff into main Nov 10, 2026
31 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-weekly-c8dd5bd837 branch November 10, 2026 18:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant