Skip to content

Bump the backend-patch-and-minor group across 1 directory with 8 updates - #54

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-patch-and-minor-fab308aafa
Open

Bump the backend-patch-and-minor group across 1 directory with 8 updates#54
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-patch-and-minor-fab308aafa

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown

Bumps the backend-patch-and-minor group with 8 updates in the /backend directory:

Package From To
@anthropic-ai/sdk 0.100.1 0.112.4
docx 9.6.1 9.7.1
express-rate-limit 8.5.2 8.6.0
helmet 8.1.0 8.3.0
jsonrepair 3.14.0 3.15.0
nanoid 3.3.11 3.3.16
pdfkit 0.18.0 0.19.1
zod 4.3.6 4.4.3

Updates @anthropic-ai/sdk from 0.100.1 to 0.112.4

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.112.4

0.112.4 (2026-07-20)

Full Changelog: sdk-v0.112.3...sdk-v0.112.4

Bug Fixes

  • aws: preserve AWS options and auth mode across withOptions() (#214) (3f7665c)

Chores

sdk: v0.112.3

0.112.3 (2026-07-17)

Full Changelog: sdk-v0.112.2...sdk-v0.112.3

Chores

sdk: v0.112.2

0.112.2 (2026-07-17)

Full Changelog: sdk-v0.112.1...sdk-v0.112.2

Chores

sdk: v0.112.1

0.112.1 (2026-07-16)

Full Changelog: sdk-v0.112.0...sdk-v0.112.1

sdk: v0.112.0

0.112.0 (2026-07-16)

Full Changelog: sdk-v0.111.0...sdk-v0.112.0

Features

  • api: add support for MCP Tunnels (597ac41)

sdk: v0.111.0

0.111.0 (2026-07-10)

Full Changelog: sdk-v0.110.0...sdk-v0.111.0

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.112.4 (2026-07-20)

Full Changelog: sdk-v0.112.3...sdk-v0.112.4

Bug Fixes

  • aws: preserve AWS options and auth mode across withOptions() (#214) (3f7665c)

Chores

0.112.3 (2026-07-17)

Full Changelog: sdk-v0.112.2...sdk-v0.112.3

Chores

0.112.2 (2026-07-17)

Full Changelog: sdk-v0.112.1...sdk-v0.112.2

Chores

0.112.1 (2026-07-16)

Full Changelog: sdk-v0.112.0...sdk-v0.112.1

0.112.0 (2026-07-16)

Full Changelog: sdk-v0.111.0...sdk-v0.112.0

Features

  • api: add support for MCP Tunnels (597ac41)

0.111.0 (2026-07-10)

Full Changelog: sdk-v0.110.0...sdk-v0.111.0

Features

  • api: add support for dreaming (77b28a6)
  • tools: gate session tool calls on evaluated_permission; bound idle by server stop_reason (68a6d7b)

... (truncated)

Commits
  • 3e9a2e1 chore(aws): raise minimum @​anthropic-ai/sdk version to 0.112.4
  • 1cdfa7f chore: release main
  • 0cd535b fix(aws): remove duplicate loggerFor import breaking the build (#235)
  • ff7d620 fix(aws): preserve AWS options and auth mode across withOptions() (#214)
  • 0b39044 chore(docs): small updates
  • f84e863 chore: release main
  • 373cf7e chore(docs): small updates
  • 4d3022d chore(internal): tidy changelog
  • 5019578 chore: release main
  • 01e74ee fix(google-cloud): bump google-auth-library to ^10.2.0 (#230)
  • Additional commits viewable in compare view

Updates docx from 9.6.1 to 9.7.1

Release notes

Sourced from docx's releases.

9.7.1

What's Changed

Full Changelog: dolanmiu/docx@9.7.0...9.7.1

9.7.0

What's Changed

... (truncated)

Commits
  • 4934d31 chore: Upgrade node-version in GitHub Actions workflow (#3457)
  • a17c867 build(deps-dev): bump typescript-eslint from 8.59.4 to 8.60.0 (#3455)
  • 28ae793 Fix/bundle types issue (#3456)
  • 12347dd build(deps-dev): bump @​typescript-eslint/parser from 8.59.4 to 8.60.0 (#3454)
  • 7797f50 build(deps-dev): bump @​typescript-eslint/eslint-plugin (#3450)
  • e61edc0 build(deps-dev): bump typedoc from 0.28.18 to 0.28.19 (#3452)
  • 0d185a1 build(deps-dev): bump inquirer from 13.4.3 to 14.0.0 (#3451)
  • e757cff build(deps-dev): bump jsdom from 29.0.1 to 29.1.1 (#3449)
  • 3958b5a build(deps-dev): bump eslint-plugin-unicorn from 63.0.0 to 64.0.0 (#3448)
  • 1be2d51 build(deps-dev): bump pre-commit from 1.2.2 to 2.0.0 (#3447)
  • Additional commits viewable in compare view

Updates express-rate-limit from 8.5.2 to 8.6.0

Release notes

Sourced from express-rate-limit's releases.

v8.6.0

You can view the changelog here.

Commits
  • fffb3c4 8.6.0
  • f366b2d docs: debugging guide, time constants, & v8.6.0 changelog (#652)
  • 593ddd2 fix: make debug output easier to read (#653)
  • ef8c129 fix: Pin safe version of @​asyncapi/specs dev dep (#659)
  • 7b05e0d feat: add time constants to support more readable values for windowMs (#655)
  • 863e730 chore(deps-dev): bump the development-dependencies group with 3 updates (#657)
  • e0e711e fix: correct wording in usage documentation for express-rate-limit (#656)
  • fcd3aa7 chore(deps-dev): bump the development-dependencies group with 3 updates (#651)
  • 99d4298 feat: use debug for debug logging (#641)
  • 23e4dde feat: Run validations once each (#650)
  • Additional commits viewable in compare view

Updates helmet from 8.1.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

  • Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
  • Content-Security-Policy: improved error handling for invalid directive names

Fixed

  • Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
  • Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
  • Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

  • Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
  • Improve error message when passing duplicate options
Commits
  • 75f1a98 8.3.0
  • f03f70d Update changelog for 8.3.0 release
  • a307fce Fix capitalization in CSP package changelog
  • 5347b43 Format default CSP in README for readability
  • 9afc570 CSP: fix middleware-specific README missing link
  • 266c95c Minor speedups to project setups test
  • 7a4196c CSP: update package-specific changelog
  • 02716b4 CSP: improve performance when there are no dynamic directives
  • 3f511ed CSP: move utility functions to separate file
  • 80338af CSP: disabling defaults with no directives is now an error
  • Additional commits viewable in compare view

Updates jsonrepair from 3.14.0 to 3.15.0

Changelog

Sourced from jsonrepair's changelog.

3.15.0 (2026-07-03)

Features

Bug Fixes

  • infinite recursion when a string is followed by a backslash (#175) (f213160)

3.14.1 (2026-06-25)

Bug Fixes

  • improve repairing of numbers (#172) (aedd5a9)
  • repair unquoted strings starting with a keyword (#173) (1bbc1da)
  • trailing-comma repair strips the parents containers comma (#174) (8d1754c)
  • unescaped quotes before special characters like ) or the end of the string (#169) (5cbc9ba)
Commits
  • 4a80ed8 chore(release): 3.15.0
  • b3bbf58 chore: update package-lock.json
  • f213160 Fix: infinite recursion when a string is followed by a backslash (#175)
  • 1ca4041 feat: #157 repair JSON with HTML-encoded entities (#168)
  • 72ccb43 chore(release): 3.14.1
  • 8d1754c fix: trailing-comma repair strips the parents containers comma (#174)
  • 1bbc1da fix: repair unquoted strings starting with a keyword (#173)
  • aedd5a9 fix: improve repairing of numbers (#172)
  • 5cbc9ba fix: unescaped quotes before special characters like ) or the end of the st...
  • See full diff in compare view

Updates nanoid from 3.3.11 to 3.3.16

Release notes

Sourced from nanoid's releases.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.

3.3.12

  • Fixed breaking Nano ID by requesting big ID.
Changelog

Sourced from nanoid's changelog.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.

3.3.12

  • Fixed breaking Nano ID by requesting big ID.
Commits
  • 9760e11 Release 3.3.16 version
  • e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
  • 96dd086 Update CI action
  • ba0bc3b Do not create latest release for v3
  • 6819724 Release 3.3.15 version
  • fb0b137 Fix tag for v3
  • e084bc9 Back-port new release system and fix pre-commit hook
  • 7e32945 Release 3.3.14 version
  • 6bd27b8 Another way to deal with pool damage
  • 41ad2ac Reduce ID size
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates pdfkit from 0.18.0 to 0.19.1

Release notes

Sourced from pdfkit's releases.

0.19.1

  • Fix RGB JPEG embedded as DeviceGray (0.19.0 regression) (#1734)

0.19.0

Highlights in this release are the bump in minimum supported environments (quite conservative), reduce of Node js specific dependencies (EventEmitter, Buffer), more granular image transparency and roundedRect options and the usual quality of life fixes

  • [BREAKING] Bump node version requirement to 20+
  • [BREAKING] Bump minimum supported browsers to Firefox 115, iOS/Safari 16
  • Fix text with input x as null
  • Add opacity option to doc.image() to control image transparency
  • Fix corrupted PDF when mixing standard and embedded fonts that share postscript name
  • Fix PDF/UA compliance issues in kitchen-sink-accessible example
  • Add bbox and placement options to PDFStructureElement for PDF/UA compliance
  • Extend roundedRect with borderRadius as number for all corners or per-corner array (CSS order)
  • Fix accessibility: scope in TH element
  • Fix PDF Name escaping for spot colors with spaces (#1644)
Changelog

Sourced from pdfkit's changelog.

[v0.19.1] - 2026-06-10

  • Fix RGB JPEG embedded as DeviceGray (0.19.0 regression) (#1734)

[v0.19.0] - 2026-06-07

  • Bump node version requirement to 20+
  • Bump minimum supported browsers to Firefox 115, iOS/Safari 16
  • Fix text with input x as null
  • Add opacity option to doc.image() to control image transparency
  • Fix corrupted PDF when mixing standard and embedded fonts that share postscript name
  • Fix PDF/UA compliance issues in kitchen-sink-accessible example
  • Add bbox and placement options to PDFStructureElement for PDF/UA compliance
  • Extend roundedRect with borderRadius as number for all corners or per-corner array (CSS order)
  • Fix accessibility: scope in TH element
  • Fix PDF Name escaping for spot colors with spaces (#1644)
Commits

Updates zod from 4.3.6 to 4.4.3

Release notes

Sourced from zod's releases.

v4.4.3

Commits:

  • 4c2fa95ce3f3390fbc522324e406b4e9e89b88f9 docs: use Zernio primary wordmark for gold sponsor logo
  • 2aeec83eb135e3a83756e973ef44845fc5a455d2 docs: prune lapsed gold sponsors and rebalance logo sizing
  • 7391be88ac1ee5cd02057f5ccc012a1f5df4efd0 docs: prune lapsed silver/bronze sponsors and add active ones
  • 2c703322a21b4e2b12f33f49ea8430c451a68b4f docs: normalize bronze sponsor logos to github avatar pattern
  • 9195250cab0e7950efe39c3926d6c203b4b0a170 docs: remove Mintlify from bronze sponsors (churned)
  • b8dffe9e62f17e6571e6249d05cc5102b54d94e4 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
  • 1cab69383fcdeae2a366d5e2a2fc4d8fc765d168 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
  • c2be4f819064eed62c7c350a2d399b5faecd15f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (#5941)
  • f3c9ec03ba7a28ae72d25cc295f38674bee0f559 4.4.3
  • 1fb56a5c18c27102dbc92260a4007c7732a0ccca docs: document release procedure in AGENTS.md

v4.4.2

Commits:

  • 0c62df0ea19fd05abdf90473e9eef7eea530fab2 Clean up docs navigation and stale labels (#5901)
  • 20cc794895cc8604fe0c87d83a5d1c3f89fad0ac chore: add security policy and refresh tooling deps
  • 6fbe07b0177efdd1bf1c0b05160e70d7a0702337 fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (#5791)
  • 4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd Tighten discriminated union option typing
  • bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908 Update PR guidance for agents
  • cf0dc942a32805c292fff59ade20a7ace980735a Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint
  • 292c894a5fd2aa42e527900b83d8d7a3009a709c docs: add Zernio gold sponsor
  • 1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca docs: document codec inversion
  • 1373c85da9aeff704a9762d27bc58699618aefb7 docs: remove AI disclosure guidance
  • e20d02b473c08e3a4e557bc610b1b5fac079b649 chore: ignore triage notes
  • e58ea4d91b1dfe8194b73508203213cbc7e9c936 docs: test Zod Mini tab code heights
  • 905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff docs: document preprocess input type narrowing
  • bf64bac850d4dee2b7dde7e64909d5d796d32043 chore: tighten test guidance in AGENTS.md
  • 8ec4e73f4c4693b6361ad591be40fb41eb8a9f95 chore: update play.ts scratch
  • 02c2baf7d0d615872fa4528a8020603b71211702 Make z.preprocess defer optionality to inner schema (#5929)
  • 88015df8e25c44fb5385eb3ef28935119cd5edea fix(docs): drop deprecated baseUrl from tsconfig
  • c59d4474e3b4cad1b323462186cf607178ce8267 4.4.2

v4.4.1

Commits:

  • 481f7be4238c83ed58183f921b2646f340a91c6a ci: gate release publishing on full test workflow
  • 95ccab423aec720b2523c3a64cdc7e3204537cc7 test(v3): restore optional undefined expectations
  • cede2c63739a5823d6aa5093d291e9a111da943d fix(v4): reject tuple holes before required defaults (#5900)
  • edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7 release: 4.4.1
  • 180d83d1dbe6a59260710cc8637a3dea2281ee56 docs: remove Jazz featured sponsor

v4.4.0

4.4.0

This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.

Potentially breaking bug fixes

... (truncated)

Commits
  • 1fb56a5 docs: document release procedure in AGENTS.md
  • f3c9ec0 4.4.3
  • c2be4f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent...
  • 1cab693 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
  • b8dffe9 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
  • 9195250 docs: remove Mintlify from bronze sponsors (churned)
  • 2c70332 docs: normalize bronze sponsor logos to github avatar pattern
  • 7391be8 docs: prune lapsed silver/bronze sponsors and add active ones
  • 2aeec83 docs: prune lapsed gold sponsors and rebalance logo sizing
  • 4c2fa95 docs: use Zernio primary wordmark for gold sponsor logo
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the backend-patch-and-minor group with 8 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.100.1` | `0.112.4` |
| [docx](https://github.com/dolanmiu/docx) | `9.6.1` | `9.7.1` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.5.2` | `8.6.0` |
| [helmet](https://github.com/helmetjs/helmet) | `8.1.0` | `8.3.0` |
| [jsonrepair](https://github.com/josdejong/jsonrepair) | `3.14.0` | `3.15.0` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.16` |
| [pdfkit](https://github.com/foliojs/pdfkit) | `0.18.0` | `0.19.1` |
| [zod](https://github.com/colinhacks/zod) | `4.3.6` | `4.4.3` |



Updates `@anthropic-ai/sdk` from 0.100.1 to 0.112.4
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.100.1...sdk-v0.112.4)

Updates `docx` from 9.6.1 to 9.7.1
- [Release notes](https://github.com/dolanmiu/docx/releases)
- [Commits](dolanmiu/docx@9.6.1...9.7.1)

Updates `express-rate-limit` from 8.5.2 to 8.6.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.5.2...v8.6.0)

Updates `helmet` from 8.1.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v8.1.0...v8.3.0)

Updates `jsonrepair` from 3.14.0 to 3.15.0
- [Changelog](https://github.com/josdejong/jsonrepair/blob/main/CHANGELOG.md)
- [Commits](josdejong/jsonrepair@v3.14.0...v3.15.0)

Updates `nanoid` from 3.3.11 to 3.3.16
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.11...3.3.16)

Updates `pdfkit` from 0.18.0 to 0.19.1
- [Release notes](https://github.com/foliojs/pdfkit/releases)
- [Changelog](https://github.com/foliojs/pdfkit/blob/master/CHANGELOG.md)
- [Commits](foliojs/pdfkit@v0.18.0...v0.19.1)

Updates `zod` from 4.3.6 to 4.4.3
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.3.6...v4.4.3)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.112.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-patch-and-minor
- dependency-name: docx
  dependency-version: 9.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-patch-and-minor
- dependency-name: express-rate-limit
  dependency-version: 8.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-patch-and-minor
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-patch-and-minor
- dependency-name: jsonrepair
  dependency-version: 3.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-patch-and-minor
- dependency-name: nanoid
  dependency-version: 3.3.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-patch-and-minor
- dependency-name: pdfkit
  dependency-version: 0.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-patch-and-minor
- dependency-name: zod
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-patch-and-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants