Skip to content

chore(deps): Bump the minor-and-patch group with 18 updates - #602

Merged
huyplb merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-896bf2d4dc
Nov 9, 2026
Merged

chore(deps): Bump the minor-and-patch group with 18 updates#602
huyplb merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-896bf2d4dc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 18 updates:

Package From To
vitest 5.0.5 5.1.0
@fastify/cors 11.3.1 11.4.1
@fastify/static 10.1.8 10.1.10
fastify 5.12.7 5.12.8
isomorphic-git 1.44.8 1.44.11
cron-parser 5.10.2 5.10.4
playwright 1.64.1 1.65.0
@clickhouse/client 1.24.1 1.25.0
@tailwindcss/vite 4.3.3 4.3.4
@xyflow/react 12.12.0 12.12.1
lucide-react 1.65.0 1.70.0
mssql 12.7.13 12.7.14
tailwindcss 4.3.3 4.3.4
zustand 5.0.16 5.1.0
@vitejs/plugin-react 6.1.2 6.2.1
vite 8.3.5 8.3.6
@aws-sdk/client-secrets-manager 3.1160.0 3.1163.0
@fastify/rate-limit 11.2.1 11.2.2

Updates vitest from 5.0.5 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates @fastify/cors from 11.3.1 to 11.4.1

Release notes

Sourced from @​fastify/cors's releases.

v11.4.1

What's Changed

New Contributors

Full Changelog: fastify/fastify-cors@v11.4.0...v11.4.1

v11.4.0

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-cors@v11.3.1...v11.4.0

Commits
  • 33424f5 Bumped v11.4.1
  • 115ff7c fix: preserve header tokens with whitespace preceding commas in vary parser (...
  • a84d816 Bumped v11.4.0
  • 32cf1c2 Merge commit from fork
  • d1dfe62 docs: clarify that RegExp origins are not anchored (#424)
  • 94eba39 chore: bump fastify/workflows/.github/workflows/reusable-release.yml
  • See full diff in compare view

Updates @fastify/static from 10.1.8 to 10.1.10

Release notes

Sourced from @​fastify/static's releases.

v10.1.10

What's Changed

  • fix: use @​fastify/error for forbidden path errors by @​SkySails in fastify/fastify-static#624 The 403 response for forbidden paths now includes code: "FST_STATIC_FORBIDDEN_PATH"; the error no longer has a status property, use statusCode.

New Contributors

Full Changelog: fastify/fastify-static@v10.1.9...v10.1.10

v10.1.9

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v10.1.8...v10.1.9

Commits
  • a006a4f Bumped v10.1.10
  • 3677646 fix: use @​fastify/error for forbidden path errors (#624)
  • d4e7392 Bumped v10.1.9
  • 44b5a14 fix: try every encoding in a root before falling back to the next root (#629)
  • 55c7bc9 fix: return callNotFound for directories without index file (#626)
  • 2d0c537 build(deps): bump glob from ^13.0.0 to ^14.0.0
  • 8f2bf52 chore: bump fastify/workflows/.github/workflows/reusable-release.yml
  • See full diff in compare view

Updates fastify from 5.12.7 to 5.12.8

Release notes

Sourced from fastify's releases.

v5.12.8

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.12.7...v5.12.8

Commits
  • 0c7413a Bumped v5.12.8
  • 0ffe18f test: make handlerTimeout ended-but-not-finished test deterministic
  • 8e7c2b7 test: restore 100% coverage for handlerTimeout abort paths
  • 15fbadf [Backport 5.x] fix: abort streaming response when handlerTimeout fires after ...
  • 18a7049 docs: fix syntax errors in code examples (#7159)
  • c410867 docs: clarify that maxParamLength does not prevent ReDoS (#7140)
  • 0fa6bc2 [Backport 5.x] fix(decorators): evaluate instance getters once in getDecorato...
  • 0873d55 perf(request): hoist port regex to module level (#7110)
  • 25cd11e [Backport 5.x] docs: remove plugins that do not support Fastify v5 (#7152)
  • d60a57b [Backport 5.x] docs(reply): reorganize Reply reference by properties and meth...
  • Additional commits viewable in compare view

Updates isomorphic-git from 1.44.8 to 1.44.11

Release notes

Sourced from isomorphic-git's releases.

v1.44.11

1.44.11 (2026-11-05)

Bug Fixes

  • use Node's stream module in the Node HTTP client (#2474) (838aee1)

v1.44.10

1.44.10 (2026-11-02)

Bug Fixes

  • read commit tree and parent headers positionally like git (#2477) (22a57b7)

v1.44.9

1.44.9 (2026-11-01)

Bug Fixes

Commits

Updates cron-parser from 5.10.2 to 5.10.4

Release notes

Sourced from cron-parser's releases.

v5.10.4

What's Changed

New Contributors

Full Changelog: harrisiirak/cron-parser@v5.10.3...v5.10.4

v5.10.3

What's Changed

New Contributors

Full Changelog: harrisiirak/cron-parser@v5.10.2...v5.10.3

Changelog

Sourced from cron-parser's changelog.

v5.10.4 - 2026-11-06

What's Changed

New Contributors

Full Changelog: harrisiirak/cron-parser@v5.10.3...v5.10.4

v5.10.3 - 2026-10-31

What's Changed

New Contributors

Full Changelog: harrisiirak/cron-parser@v5.10.2...v5.10.3

Commits
  • 733050d chore: bump version
  • ab3c04a fix: reject a range with more than two parts (#467)
  • f56cfc1 fix: only resolve month names in the month field and weekday names in the day...
  • 3e8c51d fix: treat a timestamp of 0 as the Unix epoch, not as a missing date (#463)
  • 6285eeb fix: only remove the quotes around a crontab variable value (#462)
  • aa2a270 fix(cron): restore initial date on reset (#465)
  • 7b10d41 fix: parse crontab entries that start with a nickname (#460)
  • 236b141 fix: stop treating crontab entries that contain = as variables (#459)
  • e404b91 chore: bump version
  • 8ab5c19 fix: use own keys for crontab entries and predefined expressions (#461)
  • Additional commits viewable in compare view

Updates playwright from 1.64.1 to 1.65.0

Release notes

Sourced from playwright's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

  • There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
  • Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
  • Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
  • Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

  • New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

    test('restart the server', { lock: '-exclusive-' }, async () => {
  // No other test runs while this one is running.
});

  • test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

    test('upload a file', async ({ page }) => {
  test.skip('Not implemented yet');
});

... (truncated)

Commits
  • a1f35e1 chore: mark v1.65.0 (#43925)
  • a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
  • 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
  • daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
  • 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
  • 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
  • 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
  • d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
  • 6e3f5ff docs: release notes for v1.65 (#43874)
  • aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
  • Additional commits viewable in compare view

Updates @clickhouse/client from 1.24.1 to 1.25.0

Release notes

Sourced from @​clickhouse/client's releases.

client-1.25.0

Migration Notes

  • query() now sends its format to the server as the default_format setting, instead of appending FORMAT <format> to the SQL (see Improvements below). No code change is required, but check the following:
    • The query text recorded in system.query_log, in logs and in traces no longer ends with FORMAT <format>. Adjust anything that matches on that suffix.
    • A FORMAT clause in the query itself is no longer a syntax error: the server uses it, and if it differs from the format option, query() throws an error that names both formats. With a tracer configured, that error is recorded on the clickhouse.query.stream span (#1103). Remove the clause, or use exec() if you need full control over the SQL.
    • A user whose profile locks default_format with a <constraints> entry (possible on ClickHouse 26.x) fails every query() with SETTING_CONSTRAINT_VIOLATION. Allow changing default_format for that user. (#1085)

#1085: ClickHouse/clickhouse-js#1085 #1103: ClickHouse/clickhouse-js#1103

Improvements

  • query() now sends the query as written and passes its format to the server as the default_format setting, instead of appending FORMAT <format> to the SQL. This matches the Go, Rust and Java clients, and fixes queries that failed because of the appended clause:

    • a trailing semicolon followed by a comment, such as SELECT 1; -- note, no longer fails with Multi-statements are not allowed (#973);
    • FORMAT is no longer placed after a trailing SETTINGS clause, which some older servers rejected (#970);
    • the short SHOW ROW POLICIES syntax works (#759).

    The format option overrides a default_format set in clickhouse_settings. An X-ClickHouse-Format request header set via http_headers (on the client or on the call) is not sent by query(), as the server would prefer it over default_format; the other methods still send it. (#1085)

  • command() and exec() now also send the query as written, without removing trailing semicolons, as the server accepts them. The one exception is exec() with values: the server reads the data right after the statement and rejects a ; before it, so trailing semicolons are still removed there. (#1085)

  • When the server reports an error in a JSON output format (with http_write_exception_in_output_format enabled, the error that occurs while it writes the result comes back as {"exception": "..."}), ClickHouseError.message no longer keeps the JSON escaping, for example \" instead of ". (#1085)

#759: ClickHouse/clickhouse-js#759 #970: ClickHouse/clickhouse-js#970 #973: ClickHouse/clickhouse-js#973 #1085: ClickHouse/clickhouse-js#1085

Bug fixes

  • (Node.js only) ResultSet.close() no longer throws an uncaught ResultSet has been closed error when the ResultSet wraps a stream that has no error listener. (#1087)

#1087: ClickHouse/clickhouse-js#1087

client-web-1.25.0

Migration Notes

  • query() now sends its format to the server as the default_format setting, instead of appending FORMAT <format> to the SQL (see Improvements below). No code change is required, but check the following:
    • The query text recorded in system.query_log, in logs and in traces no longer ends with FORMAT <format>. Adjust anything that matches on that suffix.
    • A FORMAT clause in the query itself is no longer a syntax error: the server uses it, and if it differs from the format option, query() throws an error that names both formats. With a tracer configured, that error is recorded on the clickhouse.query.stream span (#1103). Remove the clause, or use exec() if you need full control over the SQL.
    • A user whose profile locks default_format with a <constraints> entry (possible on ClickHouse 26.x) fails every query() with SETTING_CONSTRAINT_VIOLATION. Allow changing default_format for that user. (#1085)

#1085: ClickHouse/clickhouse-js#1085 #1103: ClickHouse/clickhouse-js#1103

Improvements

... (truncated)

Commits
  • bfd729c Merge pull request #1102 from ClickHouse/main
  • 1712aa6 fix: end the stream span once and keep its error on a query() format mismatch...
  • 444c882 chore: bump @​clickhouse/client version to 1.25.0 (#1100)
  • edd1b9e docs: merge the unreleased 1.24.2 changelog entry into 1.25.0 (#1101)

@dependabot
chore(deps): Bump the minor-and-patch group with 18 updates
db3e7af 
Bumps the minor-and-patch group with 18 updates:

| Package | From | To |
| --- | --- | --- |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.5` | `5.1.0` |
| [@fastify/cors](https://github.com/fastify/fastify-cors) | `11.3.1` | `11.4.1` |
| [@fastify/static](https://github.com/fastify/fastify-static) | `10.1.8` | `10.1.10` |
| [fastify](https://github.com/fastify/fastify) | `5.12.7` | `5.12.8` |
| [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.44.8` | `1.44.11` |
| [cron-parser](https://github.com/harrisiirak/cron-parser) | `5.10.2` | `5.10.4` |
| [playwright](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` |
| [@clickhouse/client](https://github.com/ClickHouse/clickhouse-js) | `1.24.1` | `1.25.0` |
| [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.3` | `4.3.4` |
| [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.12.0` | `12.12.1` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.65.0` | `1.70.0` |
| [mssql](https://github.com/tediousjs/node-mssql) | `12.7.13` | `12.7.14` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.4` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.16` | `5.1.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.2` | `6.2.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.5` | `8.3.6` |
| [@aws-sdk/client-secrets-manager](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-secrets-manager) | `3.1160.0` | `3.1163.0` |
| [@fastify/rate-limit](https://github.com/fastify/fastify-rate-limit) | `11.2.1` | `11.2.2` |


Updates `vitest` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

Updates `@fastify/cors` from 11.3.1 to 11.4.1
- [Release notes](https://github.com/fastify/fastify-cors/releases)
- [Commits](fastify/fastify-cors@v11.3.1...v11.4.1)

Updates `@fastify/static` from 10.1.8 to 10.1.10
- [Release notes](https://github.com/fastify/fastify-static/releases)
- [Commits](fastify/fastify-static@v10.1.8...v10.1.10)

Updates `fastify` from 5.12.7 to 5.12.8
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.12.7...v5.12.8)

Updates `isomorphic-git` from 1.44.8 to 1.44.11
- [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases)
- [Commits](isomorphic-git/isomorphic-git@v1.44.8...v1.44.11)

Updates `cron-parser` from 5.10.2 to 5.10.4
- [Release notes](https://github.com/harrisiirak/cron-parser/releases)
- [Changelog](https://github.com/harrisiirak/cron-parser/blob/master/CHANGELOG.md)
- [Commits](harrisiirak/cron-parser@v5.10.2...v5.10.4)

Updates `playwright` from 1.64.1 to 1.65.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.1...v1.65.0)

Updates `@clickhouse/client` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/ClickHouse/clickhouse-js/releases)
- [Changelog](https://github.com/ClickHouse/clickhouse-js/blob/main/CHANGELOG.md)
- [Commits](ClickHouse/clickhouse-js@client-1.24.1...client-1.25.0)

Updates `@tailwindcss/vite` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.4/packages/@tailwindcss-vite)

Updates `@xyflow/react` from 12.12.0 to 12.12.1
- [Release notes](https://github.com/xyflow/xyflow/releases)
- [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.12.1/packages/react)

Updates `lucide-react` from 1.65.0 to 1.70.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react)

Updates `mssql` from 12.7.13 to 12.7.14
- [Release notes](https://github.com/tediousjs/node-mssql/releases)
- [Changelog](https://github.com/tediousjs/node-mssql/blob/master/CHANGELOG.txt)
- [Commits](tediousjs/node-mssql@v12.7.13...v12.7.14)

Updates `tailwindcss` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.4/packages/tailwindcss)

Updates `zustand` from 5.0.16 to 5.1.0
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.16...v5.1.0)

Updates `@vitejs/plugin-react` from 6.1.2 to 6.2.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.2.1/packages/plugin-react)

Updates `vite` from 8.3.5 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

Updates `@aws-sdk/client-secrets-manager` from 3.1160.0 to 3.1163.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-secrets-manager/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1163.0/clients/client-secrets-manager)

Updates `@fastify/rate-limit` from 11.2.1 to 11.2.2
- [Release notes](https://github.com/fastify/fastify-rate-limit/releases)
- [Commits](fastify/fastify-rate-limit@v11.2.1...v11.2.2)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@fastify/cors"
  dependency-version: 11.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@fastify/static"
  dependency-version: 10.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fastify
  dependency-version: 5.12.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: isomorphic-git
  dependency-version: 1.44.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: cron-parser
  dependency-version: 5.10.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: playwright
  dependency-version: 1.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@clickhouse/client"
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@xyflow/react"
  dependency-version: 12.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mssql
  dependency-version: 12.7.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tailwindcss
  dependency-version: 4.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: zustand
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-secrets-manager"
  dependency-version: 3.1163.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@fastify/rate-limit"
  dependency-version: 11.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@huyplb
huyplb merged commit afb992e into main Nov 9, 2026
10 checks passed
@huyplb
huyplb deleted the dependabot/npm_and_yarn/minor-and-patch-896bf2d4dc branch November 9, 2026 18:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@huyplb