Skip to content

chore(deps-dev): bump the dependencies group with 8 updates - #2482

Merged
alexander-akait merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-909676d2c0
Oct 16, 2026
Merged

chore(deps-dev): bump the dependencies group with 8 updates#2482
alexander-akait merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-909676d2c0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 8 updates:

Package From To
@babel/core 8.0.6 8.0.7
@babel/preset-env 8.0.6 8.0.7
@fastify/express 4.0.7 4.0.8
@hono/node-server 2.1.3 2.1.4
acorn 8.18.0 8.19.0
express 5.2.1 5.3.0
prettier 3.9.9 3.9.10
puppeteer 25.12.0 25.13.0

Updates @babel/core from 8.0.6 to 8.0.7

Release notes

Sourced from @​babel/core's releases.

v8.0.7 (2026-10-07)

Thanks @​brunoborta, @​CINC0S, @​hoobnn, and @​jpradelle for your first PRs!

🐛 Bug Fix

  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
    • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
    • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
  • babel-traverse
    • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
    • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
  • Other
  • babel-core

🏠 Internal

  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3

Committers: 11

Changelog

Sourced from @​babel/core's changelog.

v8.0.7 (2026-10-07)

🐛 Bug Fix

  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
    • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
    • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
  • babel-traverse
    • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
    • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
  • Other
  • babel-core

🏠 Internal

  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
Commits

Updates @babel/preset-env from 8.0.6 to 8.0.7

Release notes

Sourced from @​babel/preset-env's releases.

v8.0.7 (2026-10-07)

Thanks @​brunoborta, @​CINC0S, @​hoobnn, and @​jpradelle for your first PRs!

🐛 Bug Fix

  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
    • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
    • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
  • babel-traverse
    • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
    • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
  • Other
  • babel-core

🏠 Internal

  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3

Committers: 11

Changelog

Sourced from @​babel/preset-env's changelog.

v8.0.7 (2026-10-07)

🐛 Bug Fix

  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
    • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
    • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
  • babel-traverse
    • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
    • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
  • Other
  • babel-core

🏠 Internal

  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
Commits

Updates @fastify/express from 4.0.7 to 4.0.8

Release notes

Sourced from @​fastify/express's releases.

v4.0.8

What's Changed

New Contributors

Full Changelog: fastify/fastify-express@v4.0.7...v4.0.8

Commits
  • f7333e5 Bumped v4.0.8
  • a931ca2 ci: enable trusted publishing releases
  • f267cc8 test: cover cookie parser compatibility
  • 575fe66 chore: bump @​fastify/formbody from 8.0.2 to 9.0.0 (#204)
  • d926419 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#203)
  • 03b2c38 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#202)
  • 8e3d1f3 chore(.npmrc): add min-release-age
  • 629b1ef chore: bump c8 from 11.0.0 to 12.0.0 (#200)
  • 50d8f01 ci: pin actions to commit-hash
  • 195f7cf docs: fix broken links (#198)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/express since your current version.


Updates @hono/node-server from 2.1.3 to 2.1.4

Release notes

Sourced from @​hono/node-server's releases.

v2.1.4

What's Changed

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

Commits

Updates acorn from 8.18.0 to 8.19.0

Commits
  • 0e0ece7 Mark version 8.19.0
  • c912cf2 Disallow additional subscripts before arrow in async arrow functions
  • f180fd7 Add Unicode v18 support (#1458)
  • ab47d42 Update test case for unexpected identifier character (#1456)
  • f53ee5f Add a contributing.md file
  • 5bd50cd Compare expression end instead of identity in parseSubscripts
  • efd7a21 Delete trailing space
  • e79ec9e Adjust dubious handling of doubleProto tracking in parseMaybeAssign
  • 93e8b90 Upgrade some dependencies with known issues
  • f065b20 Upgrade github actions to get rid of warning
  • Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

  • Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits
  • 1172b82 Release 3.9.10
  • d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
  • 953b908 Bump Prettier dependency to 3.9.9
  • ad8a6bf Clean changelog_unreleased
  • See full diff in compare view

Updates puppeteer from 25.12.0 to 25.13.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.13.0

25.13.0 (2026-10-08)

🎉 Features

🛠️ Fixes

  • await browser process termination and run exit hooks after kill (#15522) (a281197)
  • cdp: disconnect the browser when the close callback fails (#15496) (e015f22)
  • cdp: extend emulateMediaFeatures to media features Chrome honors (#15495) (4758830)
  • cdp: settle worker evaluate and close when the script fails to load (#15501) (02c2a3d)
  • connect: preserve browserURL path prefixes (#15435) (8d816de)
  • launcher: remove the temporary profile when Firefox rejects pipes (#15499) (889a6b7)
  • remove injected scripts when clearing custom query handlers (#15507) (909853c)
  • use the shadow host when checking visibility of a text node in a shadow root (#15466) (d08c868)
  • webdriver: close the browser process when the BiDi close command fails (#15469) (9e5fefa)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.2.3 to 3.2.4

puppeteer: v25.13.0

25.13.0 (2026-10-08)

🎉 Features

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.2.3 to 3.2.4
      • puppeteer-core bumped from 25.12.0 to 25.13.0
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the dependencies group with 8 updates
517c49e 
Bumps the dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `8.0.6` | `8.0.7` |
| [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) | `8.0.6` | `8.0.7` |
| [@fastify/express](https://github.com/fastify/fastify-express) | `4.0.7` | `4.0.8` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.3` | `2.1.4` |
| [acorn](https://github.com/acornjs/acorn) | `8.18.0` | `8.19.0` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` |
| [puppeteer](https://github.com/puppeteer/puppeteer) | `25.12.0` | `25.13.0` |


Updates `@babel/core` from 8.0.6 to 8.0.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.7/packages/babel-core)

Updates `@babel/preset-env` from 8.0.6 to 8.0.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.7/packages/babel-preset-env)

Updates `@fastify/express` from 4.0.7 to 4.0.8
- [Release notes](https://github.com/fastify/fastify-express/releases)
- [Commits](fastify/fastify-express@v4.0.7...v4.0.8)

Updates `@hono/node-server` from 2.1.3 to 2.1.4
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.3...v2.1.4)

Updates `acorn` from 8.18.0 to 8.19.0
- [Commits](acornjs/acorn@8.18.0...8.19.0)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `prettier` from 3.9.9 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.9...3.9.10)

Updates `puppeteer` from 25.12.0 to 25.13.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-v25.12.0...puppeteer-v25.13.0)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 8.0.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@babel/preset-env"
  dependency-version: 8.0.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@fastify/express"
  dependency-version: 4.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: acorn
  dependency-version: 8.19.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: puppeteer
  dependency-version: 25.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 14, 2026
@changeset-bot

changeset-bot Bot commented Oct 14, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 517c49e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Oct 14, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​babel/​preset-env@​8.0.6 ⏵ 8.0.7961007595 -1100
Updated@​babel/​core@​8.0.6 ⏵ 8.0.799 +110079 +195 +1100
Updatedacorn@​8.18.0 ⏵ 8.19.0100 +1100100 +189100
Updated@​fastify/​express@​4.0.7 ⏵ 4.0.8100 +110010090 -3100
Updatedpuppeteer@​25.12.0 ⏵ 25.13.0921009397 +2100
Updatedexpress@​5.2.1 ⏵ 5.3.097 +110010094 +1100
Updated@​hono/​node-server@​2.1.3 ⏵ 2.1.410010010095100
Updatedprettier@​3.9.9 ⏵ 3.9.10981009799100

View full report

@webpack
webpack Bot enabled auto-merge (squash) October 14, 2026 20:23
@alexander-akait
alexander-akait merged commit a8d9184 into main Oct 16, 2026
22 checks passed
@alexander-akait
alexander-akait deleted the dependabot/npm_and_yarn/dependencies-909676d2c0 branch October 16, 2026 11:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@webpack webpack[bot] webpack[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@alexander-akait