Skip to content

deps: Bump the minor-and-patch group across 1 directory with 16 updates - #26

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-f2ce27aa6d
Closed

deps: Bump the minor-and-patch group across 1 directory with 16 updates#26
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-f2ce27aa6d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 16 updates in the / directory:

Package From To
vitest 5.0.0 5.0.5
@fastify/cookie 11.1.2 11.1.3
@fastify/helmet 13.1.1 13.2.0
@fastify/rate-limit 11.2.0 11.2.1
@fastify/static 10.1.4 10.1.6
@fastify/websocket 11.3.1 11.3.4
fastify 5.12.5 5.12.7
fastify-plugin 6.0.0 6.0.1
pino-pretty 13.1.3 13.2.0
@types/node 26.6.2 26.6.5
@types/ws 8.18.1 8.18.2
@tanstack/react-query 5.103.2 5.104.5
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
@vitejs/plugin-react 6.1.1 6.1.2
vite 8.3.0 8.3.4

Updates vitest from 5.0.0 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates @fastify/cookie from 11.1.2 to 11.1.3

Release notes

Sourced from @​fastify/cookie's releases.

v11.1.3

What's Changed

New Contributors

Full Changelog: fastify/fastify-cookie@v11.1.2...v11.1.3

Commits
  • 576e0dd Bumped v11.1.3
  • 19a1307 ci: enable trusted publishing releases
  • 104aca7 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#368)
  • c838334 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#369)
  • 916538c chore(.npmrc): add min-release-age
  • 0c569e6 docs: fix signed cookie request examples (#366)
  • 56d895f chore: bump c8 from 11.0.0 to 12.0.0 (#365)
  • fb92235 ci: pin actions to commit-hash
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/cookie since your current version.


Updates @fastify/helmet from 13.1.1 to 13.2.0

Release notes

Sourced from @​fastify/helmet's releases.

v13.2.0

What's Changed

  • fix: inherit global enableCSPNonces on routes with custom helmet options by @​TalhaHunter101 in fastify/fastify-helmet#324
    • Note: routes with custom helmet options now inherit the global enableCSPNonces setting. If you relied on nonces being disabled on those routes, set { helmet: { enableCSPNonces: false } } on the route.

New Contributors

Full Changelog: fastify/fastify-helmet@v13.1.2...v13.2.0

v13.1.2

What's Changed

New Contributors

Full Changelog: fastify/fastify-helmet@v13.1.1...v13.1.2

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/helmet since your current version.


Updates @fastify/rate-limit from 11.2.0 to 11.2.1

Release notes

Sourced from @​fastify/rate-limit's releases.

v11.2.1

What's Changed

New Contributors

Full Changelog: fastify/fastify-rate-limit@v11.2.0...v11.2.1

Commits
  • 4cc3d70 Bumped v11.2.1
  • f2dc235 ci: enable trusted publishing releases
  • 78a7d41 chore: Bump ioredis from 5.11.1 to 6.0.0 (#461)
  • a7fbb20 chore: Bump fastify/workflows/.github/workflows/lock-threads.yml (#460)
  • 258e4ae chore: Bump fastify/workflows/.github/workflows/plugins-ci-redis.yml (#459)
  • 25aaf33 chore(.npmrc): add min-release-age
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/rate-limit since your current version.


Updates @fastify/static from 10.1.4 to 10.1.6

Release notes

Sourced from @​fastify/static's releases.

v10.1.6

What's Changed

Full Changelog: fastify/fastify-static@v10.1.5...v10.1.6

v10.1.5

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v10.1.4...v10.1.5

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/static since your current version.


Updates @fastify/websocket from 11.3.1 to 11.3.4

Release notes

Sourced from @​fastify/websocket's releases.

v11.3.4

What's Changed

New Contributors

Full Changelog: fastify/fastify-websocket@v11.3.3...v11.3.4

v11.3.3

What's Changed

Full Changelog: fastify/fastify-websocket@v11.3.2...v11.3.3

v11.3.2

What's Changed

New Contributors

Full Changelog: fastify/fastify-websocket@v11.3.1...v11.3.2

Commits
  • a3e8895 Bumped v11.3.4
  • b939a7e ci: enable trusted publishing releases
  • 8b58c9f Bumped v11.3.3
  • 51a121c fix(types): type handler as websocket handler in route() with websocket: true...
  • 6e034a4 Bumped v11.3.2
  • 5adf931 fix: handle socket errors during upgrade hooks
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/websocket since your current version.


Updates fastify from 5.12.5 to 5.12.7

Release notes

Sourced from fastify's releases.

v5.12.7

Full Changelog: fastify/fastify@v5.12.6...v5.12.7

v5.12.6

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

Commits
  • 9f40003 Bumped v5.12.7
  • 16469b9 Bumped v5.12.6
  • 63496de [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 (#7094)
  • 20b55d4 [Backport 5.x] fix: remove error when HTTP QUERY request has empty body (#7060)
  • 38d2b63 [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of...
  • 3241fbd [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/...
  • 1a46b1b [Backport 5.x] perf: use a FIFO cache for parsed content-types (#7072)
  • 7e06676 [Backport 5.x] fix: resolve reply.mediaType from raw response headers (#7067)
  • 1b0eb32 [Backport 5.x] perf: avoid resetting the level of request child loggers (#7058)
  • a636a10 [Backport 5.x] perf: decode string bodies once instead of per chunk (#7053)
  • Additional commits viewable in compare view

Updates fastify-plugin from 6.0.0 to 6.0.1

Release notes

Sourced from fastify-plugin's releases.

v6.0.1

What's Changed

New Contributors

Full Changelog: fastify/fastify-plugin@v6.0.0...v6.0.1

Commits
  • 881fb92 Bumped v6.0.1
  • 9cd4e50 ci: enable trusted publishing releases
  • 7ba9af5 fix(lib/getpluginname): preserve hyphenated anonymous plugin names (#303)
  • 1471db6 fix(index): type check options.name (#308)
  • 56f07ad perf(index): skip camelCase for auto-named plugins (#307)
  • 9698476 fix(index): do not mutate options object (#305)
  • 2c28ce1 perf(lib/tocamelcase): hoist regex and replacer (#309)
  • af23fc7 style(lib/getpluginname): use upper snakecase for regex consts (#311)
  • 0c4f161 perf(index): hoist Symbol.for lookups to module-level
  • 8bb7751 test: run esm test once
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fastify-plugin since your current version.


Updates pino-pretty from 13.1.3 to 13.2.0

Release notes

Sourced from pino-pretty's releases.

v13.2.0

What's Changed

New Contributors

Full Changelog: pinojs/pino-pretty@v13.1.3...v13.2.0

Commits
  • 6776301 v13.2.0
  • ce57771 fix: support nested keys in the include filter (#677)
  • 0ebe244 build(deps): bump actions/setup-node from 6 to 7 (#673)
  • 5b7c15c docs: add security policy (#670)
  • 253c18b ignore ai
  • 87ed39f fix: strip unsafe terminal control characters (#671)
  • a93ed10 build(deps-dev): bump @​types/node from 25.9.4 to 26.0.1 (#669)
  • 4e11bd7 build(deps): bump actions/cache from 5 to 6 (#666)
  • 7bcb31a build(deps): bump actions/dependency-review-action from 4 to 5 (#661)
  • 6631345 build(deps-dev): bump tstyche from 6.2.0 to 7.1.0 (#659)
  • Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.5

Commits

Updates @types/ws from 8.18.1 to 8.18.2

Commits

Updates @tanstack/react-query from 5.103.2 to 5.104.5

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5
    • @​tanstack/query-devtools@​5.104.5

@​tanstack/react-query-next-experimental@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5

@​tanstack/react-query-persist-client@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5
    • @​tanstack/query-persist-client-core@​5.104.5

@​tanstack/react-query@​5.104.5

Patch Changes

  • #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
  • Updated dependencies [f608f93]:
    • @​tanstack/query-core@​5.104.5

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

  • #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

    • @​tanstack/query-devtools@​5.104.4
    • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-next-experimental@​5.104.4

Patch Changes

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
  • Updated dependencies [c208861, a108398]:
    • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-persist-client@​5.104.4

Patch Changes

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
  • Updated dependencies [c208861, a108398]:
    • @​tanstack/react-query@​5.104.4

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.5

Patch Changes

  • #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation c...

    Description has been truncated

@dependabot
deps: Bump the minor-and-patch group across 1 directory with 16 updates
35e2c41 
Bumps the minor-and-patch group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.0` | `5.0.5` |
| [@fastify/cookie](https://github.com/fastify/fastify-cookie) | `11.1.2` | `11.1.3` |
| [@fastify/helmet](https://github.com/fastify/fastify-helmet) | `13.1.1` | `13.2.0` |
| [@fastify/rate-limit](https://github.com/fastify/fastify-rate-limit) | `11.2.0` | `11.2.1` |
| [@fastify/static](https://github.com/fastify/fastify-static) | `10.1.4` | `10.1.6` |
| [@fastify/websocket](https://github.com/fastify/fastify-websocket) | `11.3.1` | `11.3.4` |
| [fastify](https://github.com/fastify/fastify) | `5.12.5` | `5.12.7` |
| [fastify-plugin](https://github.com/fastify/fastify-plugin) | `6.0.0` | `6.0.1` |
| [pino-pretty](https://github.com/pinojs/pino-pretty) | `13.1.3` | `13.2.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.5` |
| [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.103.2` | `5.104.5` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.1` | `6.1.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.4` |



Updates `vitest` from 5.0.0 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

Updates `@fastify/cookie` from 11.1.2 to 11.1.3
- [Release notes](https://github.com/fastify/fastify-cookie/releases)
- [Commits](fastify/fastify-cookie@v11.1.2...v11.1.3)

Updates `@fastify/helmet` from 13.1.1 to 13.2.0
- [Release notes](https://github.com/fastify/fastify-helmet/releases)
- [Commits](fastify/fastify-helmet@v13.1.1...v13.2.0)

Updates `@fastify/rate-limit` from 11.2.0 to 11.2.1
- [Release notes](https://github.com/fastify/fastify-rate-limit/releases)
- [Commits](fastify/fastify-rate-limit@v11.2.0...v11.2.1)

Updates `@fastify/static` from 10.1.4 to 10.1.6
- [Release notes](https://github.com/fastify/fastify-static/releases)
- [Commits](fastify/fastify-static@v10.1.4...v10.1.6)

Updates `@fastify/websocket` from 11.3.1 to 11.3.4
- [Release notes](https://github.com/fastify/fastify-websocket/releases)
- [Commits](fastify/fastify-websocket@v11.3.1...v11.3.4)

Updates `fastify` from 5.12.5 to 5.12.7
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.12.5...v5.12.7)

Updates `fastify-plugin` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/fastify/fastify-plugin/releases)
- [Commits](fastify/fastify-plugin@v6.0.0...v6.0.1)

Updates `pino-pretty` from 13.1.3 to 13.2.0
- [Release notes](https://github.com/pinojs/pino-pretty/releases)
- [Commits](pinojs/pino-pretty@v13.1.3...v13.2.0)

Updates `@types/node` from 26.6.2 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/ws` from 8.18.1 to 8.18.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws)

Updates `@tanstack/react-query` from 5.103.2 to 5.104.5
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.5/packages/react-query)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@vitejs/plugin-react` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

Updates `vite` from 8.3.0 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@fastify/cookie"
  dependency-version: 11.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@fastify/helmet"
  dependency-version: 13.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@fastify/rate-limit"
  dependency-version: 11.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@fastify/static"
  dependency-version: 10.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@fastify/websocket"
  dependency-version: 11.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fastify
  dependency-version: 5.12.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fastify-plugin
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pino-pretty
  dependency-version: 13.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/ws"
  dependency-version: 8.18.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.104.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 23, 2026
scotCW added a commit that referenced this pull request Oct 27, 2026
@scotCW @claude
deps: consolidate open Dependabot updates + transitive security fixes
0409712 
Rolled the open Dependabot PRs into one tested change instead of nine
that would each conflict on package-lock.json:

- #26 minor-and-patch group (16 updates: fastify 5.12.7 and its
  plugins, react 19.3.1, vite 8.3.4, vitest 5.0.5, ...). Supersedes
  #25 (vite) and #27 (vitest/@vitest/mocker).
- #17 #18 #20 #21 docker/{login,setup-buildx,metadata,build-push}-action
  majors. Breaking changes are a Node 24 action runtime (fine on
  GitHub-hosted runners) and removal of deprecated inputs/env vars this
  workflow never used.
- #16 fast-uri -> 4.2.3 and #22 ip-address -> 10.7.5 (runtime,
  lockfile-only transitive bumps).
- brace-expansion (high, not yet a GitHub alert) via `npm audit fix`.

Resolves Dependabot alerts #1-#10.

Deliberately NOT fixed: zod < 4.6.6 (GHSA-mrhx-c7xc-m3w5, memory
exhaustion on oversized constrained collections). The only fix is zod 4,
and zod is pinned to 3.23.8 on purpose (see AGENTS.md) — that's a
migration, not a bump. Exposure here is bounded: every route validating
an array is behind requireAuth, and Fastify's default 1 MiB body limit
caps the payload before zod ever sees it.

Verified: zod still a single deduped copy (the dual-module hazard the
pin exists for), single React copy, full build, 47/47 shared tests on
vitest 5.0.5, and a live smoke test against Postgres — register, join,
join-lock, config, start, zod still returning 400 not 500, SPA static
serving, WebSocket upgrade, and rate limiting returning 429.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 27, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-f2ce27aa6d branch October 27, 2026 05:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants