chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates by dependabot[bot] · Pull Request #3050 · whyour/qinglong

dependabot · 2026-08-01T12:16:43Z

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package	From	To
@grpc/grpc-js	`1.14.0`	`1.14.4`
body-parser	`1.20.3`	`1.20.6`
http-proxy-middleware	`3.0.3`	`3.0.7`
js-yaml	`4.1.0`	`4.3.1`
multer	`2.1.1`	`2.2.0`
nodemailer	`8.0.1`	`9.0.1`
undici	`7.9.0`	`7.29.0`
axios	`1.7.8`	`1.18.0`

Updates @grpc/grpc-js from 1.14.0 to 1.14.4

Release notes

Sourced from @grpc/grpc-js's releases.

@grpc/grpc-js 1.14.4

Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)

Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

@grpc/grpc-js 1.14.3

Send halfClose immediately after messages to prevent late halfClose issues with Envoy (#3031 contributed by @serkanerip)

@grpc/grpc-js 1.14.2

Fix server keep alive timeout not properly destroying connections (#3022 contributed by @mattias-wiberg)

@grpc/grpc-js 1.14.1

Fix a regression of the settings used internally for HTTP/2 sessions (#3023)

Commits

a380735 Merge pull request #3052 from murgatroid99/grpc-js_1.14.4
5b8d37b Merge commit from fork
6a97456 Merge commit from fork
e5e0b1d grpc-js: Bump version to 1.14.4
5029a26 Make compression error a static string
2fe55fd Fix crashes when receiving malformed compressed data
234f917 Fix server crash when handling invalid requests
acef8d4 Merge pull request #3043 from murgatroid99/rbac_types_change_fix_1.14
4f3c58f grpc-js-xds: Update RBAC code to handle Node type change, pin @types/node
ccd29b2 Merge pull request #3032 from murgatroid99/grpc-js_retry_half_close_1.14
Additional commits viewable in compare view

Updates body-parser from 1.20.3 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

refactor(json): simplify strict mode error string construction by @jonchurch in expressjs/body-parser#692

fix: correct off-by-one error in parameterCount by @abhu85 in expressjs/body-parser#716

deps(qs): bump qs to 6.15.1 by @jonchurch in expressjs/body-parser#722

Release: 1.20.5 by @jonchurch in expressjs/body-parser#721

New Contributors

@abhu85 made their first contribution in expressjs/body-parser#716

Special thanks to triager @krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

1.20.4

What's Changed

Remove redundant depth check by @blakeembrey in expressjs/body-parser#538

ci: add support for Node.js v23 by @Phillip9587 in expressjs/body-parser#553

ci: restore CI for 1.x branch by @bjohansebas in expressjs/body-parser#665

deps: qs@^6.14.0 by @bjohansebas in expressjs/body-parser#664

deps: use tilde notation and update certain dependencies by @Phillip9587 in expressjs/body-parser#668

chore: remove SECURITY.md by @Phillip9587 in expressjs/body-parser#669

ci: add CodeQL (SAST) by @Phillip9587 in expressjs/body-parser#670

Release: 1.20.4 by @UlisesGascon in expressjs/body-parser#672

Full Changelog: expressjs/body-parser@1.20.3...1.20.4

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

1.20.5 / 2026-04-24

refactor(json): simplify strict mode error string construction

fix: extended urlencoded parsing of arrays with >100 elements (#716)

deps: qs@~6.15.1

1.20.4 / 2025-12-01

deps: qs@~6.14.0

deps: use tilde notation for dependencies

deps: http-errors@~2.0.1

deps: raw-body@~2.5.3

Commits

5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
0defdbe release(patch): 1.20.5
cd0e7a0 deps(qs): bump qs to 6.15.1
6f24d7e fix: correct off-by-one error in parameterCount (#716)
b849bd5 deps: qs@~6.14.1 (#690)
2c55e2f refactor(json): simplify strict mode error string construction (#692)
7db202c 1.20.4 (#672)
d8f8adb ci: add CodeQL (SAST) (#670)
6d133c1 chore: remove SECURITY.md (#669)
Additional commits viewable in compare view

Updates http-proxy-middleware from 3.0.3 to 3.0.7

Release notes

Sourced from http-proxy-middleware's releases.

v3.0.7

What's Changed

fix(fixRequestBody): harden form-data stringification by @chimurai in chimurai/http-proxy-middleware#1259

chore(package.json): v3.0.7 by @chimurai in chimurai/http-proxy-middleware#1261

Full Changelog: chimurai/http-proxy-middleware@v3.0.6...v3.0.7

v3.0.6

What's Changed

fix(types): fix Logger type by @chimurai in chimurai/http-proxy-middleware#1104

fix(fixRequestBody): support text/plain by @knudtty in chimurai/http-proxy-middleware#1103

chore(examples): bump deps by @chimurai in chimurai/http-proxy-middleware#1105

build(prettier): improve prettier setup by @chimurai in chimurai/http-proxy-middleware#1108

chore(deps): fix punycode node deprecation warning by @chimurai in chimurai/http-proxy-middleware#1109

chore(examples): bump deps by @chimurai in chimurai/http-proxy-middleware#1110

build(codespaces): add devcontainer.json by @chimurai in chimurai/http-proxy-middleware#1112

chore(package): bump dev dependencies by @chimurai in chimurai/http-proxy-middleware#1116

ci(github-action): ci.yml add node v24 by @chimurai in chimurai/http-proxy-middleware#1117

chore(package): bump dev dependencies by @chimurai in chimurai/http-proxy-middleware#1118

chore(package): upgrade to jest v30 by @chimurai in chimurai/http-proxy-middleware#1122

chore(examples): upgrade deps by @chimurai in chimurai/http-proxy-middleware#1124

chore(package): update dev deps by @chimurai in chimurai/http-proxy-middleware#1125

test(websocket): fix ws import by @chimurai in chimurai/http-proxy-middleware#1126

chore(refactor): use node: protocol imports by @chimurai in chimurai/http-proxy-middleware#1127

ci(node24): pin node24 due to TLS issue with mockttp by @chimurai in chimurai/http-proxy-middleware#1137

docs(recipes/pathRewrite.md): fix comment by @DEBargha2004 in chimurai/http-proxy-middleware#1135

chore(package): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1138

chore(deps): update actions/checkout action to v5 by @chimurai in chimurai/http-proxy-middleware#1140

fix(error-response-plugin): sanitize input by @chimurai in chimurai/http-proxy-middleware#1141

chore(package.json): update dev deps by @chimurai in chimurai/http-proxy-middleware#1143

chore: add context7.json by @chimurai in chimurai/http-proxy-middleware#1144

build(eslint): update eslint.config.mjs by @chimurai in chimurai/http-proxy-middleware#1145

ci(github workflow): harden github workflows by @chimurai in chimurai/http-proxy-middleware#1146

chore(package): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1147

ci(ci.yml): unpin node 24 by @chimurai in chimurai/http-proxy-middleware#1148

docs(recipes): fix servers.md http.createServer example by @hacklschorsch in chimurai/http-proxy-middleware#1150

ci: publish with oidc by @chimurai in chimurai/http-proxy-middleware#1152

chore(package.json): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1153

chore(package.json): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1155

chore(package.json): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1158

test(types.spec.ts): add type check when req or res are 'any' by @chimurai in chimurai/http-proxy-middleware#1161

chore(package.json): bump deps by @chimurai in chimurai/http-proxy-middleware#1164

chore(package.json): eslint v10 by @chimurai in chimurai/http-proxy-middleware#1165

chore(package.json): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1166

chore(package.json): bump dev-deps by @chimurai in chimurai/http-proxy-middleware#1171

docs(examples): fix websocket example by @chimurai in chimurai/http-proxy-middleware#1170

build(vscode): use workspace version of TypeScript by @chimurai in chimurai/http-proxy-middleware#1173

fix(router): harden proxy-table matching by @chimurai in chimurai/http-proxy-middleware#1254

chore(package.json): v3.0.6 by @chimurai in chimurai/http-proxy-middleware#1256

... (truncated)

Changelog

Sourced from http-proxy-middleware's changelog.

v3.0.7

fix(fixRequestBody): harden form-data stringification

v3.0.6

fix(types): fix Logger type

fix(error-response-plugin): sanitize input

fix(router): harden proxy-table matching (exact host for host+path keys, prefix-only path matching) to prevent routing bypass

v3.0.5

fix(fixRequestBody): check readableLength (#1096)

v3.0.4

fix(fixRequestBody): handle invalid request (#1092)

fix(fixRequestBody): prevent multiple .write() calls (#1089)

fix(websocket): handle errors in handleUpgrade (#823)

ci(package): patch http-proxy (#1084)

fix(fixRequestBody): support multipart/form-data (#896)

feat(types): export Plugin type (#1071)

Commits

8cc4eba chore(package.json): v3.0.7 (#1261)
c13a99c fix(fixRequestBody): harden form-data stringification (#1259)
ea0bb98 chore(package.json): v3.0.6 (#1256)
f377520 fix(router): harden proxy-table matching (#1254)
f6be2c6 chore(yarn.lock): bump to follow-redirects 1.16.0
a36f009 ci(publish.yml): npm stage publish
3471790 ci(github actions): update publish.yml for 3.x branch
bcf1864 build(vscode): use workspace version of TypeScript (#1173)
48ed092 docs(examples): fix websocket example (#1170)
0fe7c24 chore(package.json): bump dev-deps (#1171)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for http-proxy-middleware since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates js-yaml from 4.1.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits

86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released
Additional commits viewable in compare view

Updates multer from 2.1.1 to 2.2.0

Release notes

Sourced from multer's releases.

v2.2.0

Important

Fix CVE-2026-5038 (GHSA-3p4h-7m6x-2hcm)

Fix CVE-2026-5079 (GHSA-72gw-mp4g-v24j)

What's Changed

chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in expressjs/multer#1397

chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 by @dependabot[bot] in expressjs/multer#1409

chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in expressjs/multer#1410

ci: add Node 26 to test matrix by @gameroman in expressjs/multer#1404

Release: 2.2.0 by @UlisesGascon in expressjs/multer#1412

New Contributors

@gameroman made their first contribution in expressjs/multer#1404

Full Changelog: expressjs/multer@v2.1.1...v2.2.0

Changelog

Sourced from multer's changelog.

2.2.0

Fix CVE-2026-5038 (GHSA-3p4h-7m6x-2hcm)

Fix CVE-2026-5079 (GHSA-72gw-mp4g-v24j)

Commits

2e2af08 2.2.0 (#1412)
a192b52 feat: add fieldNestingDepth limit option
9c801c7 fix: clean up in-progress disk writes on abort
0adb21d ci: add Node 26 to test matrix (#1404)
f5e17c3 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1410)
de1fefd chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 (#1409)
67abfc8 chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1397)
See full diff in compare view

Updates nodemailer from 8.0.1 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

Commits

69cf625 chore(master): release 9.0.1 (#1828)
a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
4e58450 chore: update dev dependencies
541f5fd chore(master): release 9.0.0 (#1827)
0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
6a947ac fix!: validate TLS certificates by default when fetching remote content
e3b1bda chore(master): release 8.0.11 (#1826)
4358caf refactor: remove dead checks flagged by Code Quality analysis
cf5195c chore: harden workflow token permissions and update GitHub Actions
067aebe fix: parse Ethereal response props without polynomial regex backtracking
Additional commits viewable in compare view

Updates undici from 7.9.0 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.

GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.

GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

... (truncated)

Commits

9e38fc1 Bumped v7.29.0 (#5590)
d887e34 fix: validate coerced header values for CRLF (#5579)
33928bc fix: validate blob body content type
98011a8 fix(cache): harden cache directive parsing
4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
1b5a531 fix(retry): reject partial content length mismatch
466e99d test: cover crash on mixed unqualified and qualified private cache directives
9f10f1e fix: handle empty qualified private cache directive
3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
f9eba0a Bumped v7.28.0 (#5430)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Updates axios from 1.7.8 to 1.18.0

Release notes

Sourced from axios's releases.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirect...
Description has been truncated

vercel · 2026-08-01T12:16:46Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
qinglong	Error		Aug 29, 2026 10:08am
qinglong-back	Ready	Preview	Aug 29, 2026 10:08am

…pdates Bumps the npm_and_yarn group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.14.0` | `1.14.4` | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.3` | `1.20.6` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `3.0.3` | `3.0.7` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.1` | | [multer](https://github.com/expressjs/multer) | `2.1.1` | `2.2.0` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `8.0.1` | `9.0.1` | | [undici](https://github.com/nodejs/undici) | `7.9.0` | `7.29.0` | | [axios](https://github.com/axios/axios) | `1.7.8` | `1.18.0` | Updates `@grpc/grpc-js` from 1.14.0 to 1.14.4 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.0...@grpc/grpc-js@1.14.4) Updates `body-parser` from 1.20.3 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.3...1.20.6) Updates `http-proxy-middleware` from 3.0.3 to 3.0.7 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v3.0.7/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v3.0.3...v3.0.7) Updates `js-yaml` from 4.1.0 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.3.1) Updates `multer` from 2.1.1 to 2.2.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.1.1...v2.2.0) Updates `nodemailer` from 8.0.1 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v8.0.1...v9.0.1) Updates `undici` from 7.9.0 to 7.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.9.0...v7.29.0) Updates `axios` from 1.7.8 to 1.18.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.8...v1.18.0) Updates `brace-expansion` from 1.1.12 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18) Updates `form-data` from 4.0.1 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.1...v4.0.6) --- updated-dependencies: - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.4 dependency-type: direct:production - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:development - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: direct:production - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect - dependency-name: http-proxy-middleware dependency-version: 3.0.7 dependency-type: direct:production - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: direct:production - dependency-name: multer dependency-version: 2.2.0 dependency-type: direct:production - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production - dependency-name: undici dependency-version: 7.28.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 1, 2026

vercel Bot deployed to Preview – qinglong-back August 1, 2026 12:17 View deployment

vercel Bot had a problem deploying to Preview – qinglong August 1, 2026 12:19 Failure

fix: update file routes and dependency cache status

5c502eb

whyour force-pushed the develop branch from 6e6fb3a to 5c502eb Compare August 29, 2026 09:39

whyour and others added 2 commits August 29, 2026 18:00

chore: upgrade sqlite3 to 1.1.2

c0e5041

dependabot Bot changed the title ~~Bump the npm_and_yarn group across 1 directory with 10 updates~~ chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates Aug 29, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-5a7d7d70e4 branch from aedd958 to b42b977 Compare August 29, 2026 10:05

vercel Bot deployed to Preview – qinglong-back August 29, 2026 10:06 View deployment

vercel Bot had a problem deploying to Preview – qinglong August 29, 2026 10:08 Failure

whyour force-pushed the develop branch from de65d7f to 5f6049d Compare August 29, 2026 11:10

Navigation Menu

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates - #3050

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates#3050
dependabot[bot] wants to merge 3 commits into
developfrom
dependabot/npm_and_yarn/npm_and_yarn-5a7d7d70e4

dependabot Bot commented on behalf of github Aug 1, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	`8cb10f98`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	`04201f89`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	`3805b8f8`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	`85a24055`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	`d0574cc4`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	`d0574cc4`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	`ea8930cf`

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​grpc/grpc-js 1.14.4

@​grpc/grpc-js 1.14.3

@​grpc/grpc-js 1.14.2

@​grpc/grpc-js 1.14.1

1.20.6

Important: Security

What's Changed

v1.20.5

What's Changed

New Contributors

1.20.4

What's Changed

1.20.6 / 2026-07-09

1.20.5 / 2026-04-24

1.20.4 / 2025-12-01

v3.0.7

What's Changed

v3.0.6

What's Changed

v3.0.7

v3.0.6

v3.0.5

v3.0.4

4.3.1 - 2026-07-31

Security

4.3.0 - 2026-06-27

Added

Fixed

Removed

[4.2.0] - 2026-06-01

Added

Changed

Fixed

Security

[3.14.2] - 2025-11-15

Security

v2.2.0

Important

What's Changed

New Contributors

2.2.0

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

9.0.1 (2026-06-17)

Bug Fixes

v7.29.0

⚠️ Security fixes

High severity

Medium severity

v7.28.0

⚠️ Security Release

Summary

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

v1.18.0 — June 13, 2026

🔒 Security Fixes

dependabot Bot commented on behalf of github Aug 1, 2026 •

edited

Loading

`@grpc/grpc-js` 1.14.4

`@grpc/grpc-js` 1.14.3

`@grpc/grpc-js` 1.14.2

`@grpc/grpc-js` 1.14.1

vercel Bot commented Aug 1, 2026 •

edited

Loading