Skip to content

build(deps): bump the npm-dependencies group with 9 updates - #97

Merged
hzhangxyz merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-bea183c670
Mar 11, 2026
Merged

build(deps): bump the npm-dependencies group with 9 updates#97
hzhangxyz merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-bea183c670

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 9 updates:

Package From To
commander 14.0.2 14.0.3
mariadb 3.4.5 3.5.2
mysql2 3.16.2 3.19.1
pg 8.17.2 8.20.0
sequelize 6.37.7 6.37.8
@rollup/plugin-terser 0.4.4 1.0.0
@types/node 25.1.0 25.4.0
jest 30.2.0 30.3.0
rollup 4.57.0 4.59.0

Updates commander from 14.0.2 to 14.0.3

Release notes

Sourced from commander's releases.

v14.0.3

Added

  • Release Policy document (#2462)

Changes

  • old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
  • clarify typing for deprecated callback parameter to .outputHelp() (#2427)
  • simple readability improvements to README (#2465)
Changelog

Sourced from commander's changelog.

[14.0.3] (2026-01-31)

Added

  • Release Policy document (#2462)

Changes

  • old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
  • clarify typing for deprecated callback parameter to .outputHelp() (#2427)
  • simple readability improvements to README (#2465)
Commits

Updates mariadb from 3.4.5 to 3.5.2

Release notes

Sourced from mariadb's releases.

MariaDB Connector/Node.js 3.5.2

3.5.2 (Mar 2026)

Full Changelog

Issues Fixed

  • CONJS-342 Resolved TypeScript compilation errors introduced in mariadb-connector-nodejs v3.5.1
  • CONJS-343 Fixed an issue where batch operations would hang when provided with empty array parameter values

MariaDB Connector/Node.js 3.5.1

3.5.1 (Feb 2026)

Full Changelog

Notable changes

  • CONJS-338 Add asyncDispose support for Connection, PoolConnection and Pool #250
  • CONJS-339 Add default type parameter to Prepare interface and fix executeStream generic #334
  • CONJS-339 Add wildcard for values params on Prepare

Issues Fixed

  • CONJS-331 Plugin authentication change correction
  • CONJS-335 Deno compatibility: send COM_QUIT synchronously to prevent socket cleanup race condition
  • CONJS-336 Connection attribute _server_host send host, but IP resulting of name resolution
  • CONJS-340 Fix pool connection event to emit wrapped connections and prevent user errors from breaking pool #342
  • CONJS-341 Support charset + collation combination in connection options #337

MariaDB Connector/Node.js 3.5.0 RC

3.5.0-rc.0 (Oct 2025)

Full Changelog

Notable changes

  • CONJS-326 migrate from commonJS to ESM
  • CONJS-325 deno compatibility

Issues Fixed

  • CONJS-328 Fix minimumIdle option to maintain baseline idle connections
  • CONJS-330 caching_sha2_password: avoid requiring RSA key pair when connecting via Unix socket
Changelog

Sourced from mariadb's changelog.

3.5.2 (Mar 2026)

Full Changelog

Issues Fixed

  • CONJS-342 Resolved TypeScript compilation errors introduced in mariadb-connector-nodejs v3.5.1
  • CONJS-343 Fixed an issue where batch operations would hang when provided with empty array parameter values

3.5.1 (Feb 2026)

Full Changelog

Notable changes

  • CONJS-338 Add asyncDispose support for Connection, PoolConnection and Pool #250
  • CONJS-339 Add default type parameter to Prepare interface and fix executeStream generic #334
  • CONJS-339 Add wildcard for values params on Prepare

Issues Fixed

  • CONJS-331 Plugin authentication change correction
  • CONJS-335 Deno compatibility: send COM_QUIT synchronously to prevent socket cleanup race condition
  • CONJS-336 Connection attribute _server_host send host, but IP resulting of name resolution
  • CONJS-340 Fix pool connection event to emit wrapped connections and prevent user errors from breaking pool #342
  • CONJS-341 Support charset + collation combination in connection options #337

3.5.0-rc.0 (Oct 2025)

Full Changelog

Notable changes

  • CONJS-326 migrate from commonJS to ESM
  • CONJS-325 deno compatibility

Issues Fixed

  • CONJS-328 Fix minimumIdle option to maintain baseline idle connections
  • CONJS-330 caching_sha2_password: avoid requiring RSA key pair when connecting via Unix socket
Commits
  • ca98915 bump 3.5.2 version
  • e721d70 [misc] code style correction
  • 87ca82e [CONJS-343] batch hangs when having an empty parameters values #343
  • e054849 [CONJS-342] Move TypeScript type dependencies from peer to regular dependenci...
  • be72ebf [perf] Optimize buffer copy in readBufferLengthEncodedCopy with subarray
  • dbd5472 [CONJS-333] Optimize column type checking with buffer comparisons and pre-com...
  • e71f849 [misc] Release version 3.5.1
  • 82b639c [misc] bump dependencies
  • a5ba902 [perf] Optimize execute command with bitwise operations and constant reuse
  • 65b9508 [perf] Optimize parameter type checking and remove unused pipe property
  • Additional commits viewable in compare view

Updates mysql2 from 3.16.2 to 3.19.1

Release notes

Sourced from mysql2's releases.

v3.19.1

3.19.1 (2026-03-09)

Security Bug Fixes

  • bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#4161) (91c5229)
  • handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4164) (1869215)
  • prevent query param override of URL-defined connection options (fixes a potential config injection vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4162) (3123b4e)
  • validate buffer bounds in geometry parser (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4159) (7c2ae00)

v3.19.0

3.19.0 (2026-03-05)

Features

  • use server's preferred auth method to eliminate auth switch roundtrip (#4140) (b57c671)

Bug Fixes

  • fix precision loss for large decimal values (#4135) (099beea)

v3.18.2

3.18.2 (2026-02-26)

Bug Fixes

  • types: add supportBigNumbers, bigNumberStrings, dateStrings, and timezone options to QueryOptions (#4127) (b274e72)
  • types: extend QueryValues to callback-based methods (#4129) (2ad5f0b)
  • types: improve ExecuteValues "nested" params (#4133) (3f94950)
  • types: support Raw and Uint8Array params (#4132) (bde9aec)

v3.18.1

3.18.1 (2026-02-25)

Bug Fixes

  • types: ensure optional params in query and execute methods (#4123) (3f4bbca)

v3.18.0

3.18.0 (2026-02-23)

Features

  • add Symbol.dispose and Symbol.asyncDispose support for Connections, Pools, and Pool Clusters (#4112) (1e612dc)

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.19.1 (2026-03-09)

Bug Fixes

  • bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#4161) (91c5229)
  • handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4164) (1869215)
  • prevent query param override of URL-defined connection options (fixes a potential config injection vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4162) (3123b4e)
  • validate buffer bounds in geometry parser (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4159) (7c2ae00)

3.19.0 (2026-03-05)

Features

  • use server's preferred auth method to eliminate auth switch roundtrip (#4140) (b57c671)

Bug Fixes

  • fix precision loss for large decimal values (#4135) (099beea)

3.18.2 (2026-02-26)

Bug Fixes

  • types: add supportBigNumbers, bigNumberStrings, dateStrings, and timezone options to QueryOptions (#4127) (b274e72)
  • types: extend QueryValues to callback-based methods (#4129) (2ad5f0b)
  • types: improve ExecuteValues "nested" params (#4133) (3f94950)
  • types: support Raw and Uint8Array params (#4132) (bde9aec)

3.18.1 (2026-02-25)

Bug Fixes

  • types: ensure optional params in query and execute methods (#4123) (3f4bbca)

3.18.0 (2026-02-23)

Features

  • add Symbol.dispose and Symbol.asyncDispose support for Connections, Pools, and Pool Clusters (#4112) (1e612dc)

3.17.5 (2026-02-23)

Bug Fixes

... (truncated)

Commits
  • fa06903 chore(master): release 3.19.1 (#4160)
  • 1869215 fix: handle malformed geometry payloads (fixes a potential DoS vulnerability ...
  • 3123b4e fix: prevent query param override of URL-defined connection options (fixes ...
  • 91c5229 fix: bound null-terminated string read to packet end (fixes a potential OOB...
  • 7c2ae00 fix: validate buffer bounds in geometry parser (fixes a potential DoS vulnera...
  • 1490783 build(deps-dev): bump @​types/node from 25.3.3 to 25.3.5 in /website (#4157)
  • 9708848 build(deps-dev): bump @​types/node from 25.3.3 to 25.3.5 (#4155)
  • d8d69c4 build(deps-dev): bump poku from 3.0.2 to 4.0.0 in /website (#4158)
  • d207686 ci: define a timeout for tests (#4154)
  • bb74a52 chore(master): release 3.19.0 (#4139)
  • Additional commits viewable in compare view

Updates pg from 8.17.2 to 8.20.0

Changelog

Sourced from pg's changelog.

pg@8.20.0

  • Add onConnect callback to pg.Pool constructor options allowing for async initialization of newly created & connected pooled clients.

pg@8.19.0

pg@8.18.0

pg@8.17.0

  • Throw correct error if database URL parsing fails.

pg@8.16.0

pg@8.15.0

  • Add support for esm importing. CommonJS importing is still also supported.

pg@8.14.0

pg@8.13.0

pg@8.12.0

pg-pool@8.10.0

  • Emit release event when client is returned to the pool.

pg@8.9.0

pg@8.8.0

... (truncated)

Commits
  • c9070cc Publish
  • ad36e3c fix: typo in deprecation notice for client.query() (#3618)
  • f2d7d11 Publish
  • 5a4bafc Deprecate Client's internal query queue (#3603)
  • a215bfb Typo fix in PgPass deprecation (funciton) (#3605)
  • 01e0556 fix(pg-query-stream): invoke this.callback on cursor end/error (#2810)
  • e6e3692 Pass connection parameters to password callback (#3602)
  • d80d883 test: Fix TLS connection test ending too early
  • f332f28 fix: Connection timeout handling for native clients in connected state (#3512)
  • b2e9cb1 Remove testAsync - its redundant (#3588)
  • Additional commits viewable in compare view

Updates sequelize from 6.37.7 to 6.37.8

Release notes

Sourced from sequelize's releases.

v6.37.8

6.37.8 (2026-03-07)

Security improvements

Commits
Maintainer changes

This version was pushed to npm by wikirik, a new releaser for sequelize since your current version.


Updates @rollup/plugin-terser from 0.4.4 to 1.0.0

Changelog

Sourced from @​rollup/plugin-terser's changelog.

v1.0.0

2026-03-05

Breaking Changes

  • terser!: upgrade serialize-javascript to v7 and node to v20 (#1968)
Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​rollup/plugin-terser since your current version.


Updates @types/node from 25.1.0 to 25.4.0

Commits

Updates jest from 30.2.0 to 30.3.0

Release notes

Sourced from jest's releases.

v30.3.0

Features

  • [jest-config] Add defineConfig and mergeConfig helpers for type-safe Jest config (#15844)
  • [jest-fake-timers] Add setTimerTickMode to configure how timers advance
  • [*] Reduce token usage when run through LLMs (3f17932)

Fixes

  • [jest-config] Keep CLI coverage output when using --json with --outputFile (#15918)
  • [jest-mock] Use Symbol from test environment (#15858)
  • [jest-reporters] Fix issue where console output not displayed for GHA reporter even with silent: false option (#15864)
  • [jest-runtime] Fix issue where user cannot utilize dynamic import despite specifying --experimental-vm-modules Node option (#15842)
  • [jest-test-sequencer] Fix issue where failed tests due to compilation errors not getting re-executed even with --onlyFailures CLI option (#15851)
  • [jest-util] Make sure process.features.require_module is false (#15867)

Chore & Maintenance

  • [*] Replace remaining micromatch uses with picomatch
  • [deps] Update to sinon/fake-timers v15
  • [docs] Update V30 migration guide to notify users on jest.mock() work with case-sensitive path (#15849)
  • Updated Twitter icon to match the latest brand guidelines (#15869)
Changelog

Sourced from jest's changelog.

30.3.0

Features

  • [jest-config] Add defineConfig and mergeConfig helpers for type-safe Jest config (#15844)
  • [jest-fake-timers] Add setTimerTickMode to configure how timers advance
  • [*] Reduce token usage when run through LLMs (3f17932)

Fixes

  • [jest-config] Keep CLI coverage output when using --json with --outputFile (#15918)
  • [jest-mock] Use Symbol from test environment (#15858)
  • [jest-reporters] Fix issue where console output not displayed for GHA reporter even with silent: false option (#15864)
  • [jest-runtime] Fix issue where user cannot utilize dynamic import despite specifying --experimental-vm-modules Node option (#15842)
  • [jest-test-sequencer] Fix issue where failed tests due to compilation errors not getting re-executed even with --onlyFailures CLI option (#15851)
  • [jest-util] Make sure process.features.require_module is false (#15867)

Chore & Maintenance

  • [*] Replace remaining micromatch uses with picomatch
  • [deps] Update to sinon/fake-timers v15
  • [docs] Update V30 migration guide to notify users on jest.mock() work with case-sensitive path (#15849)
  • Updated Twitter icon to match the latest brand guidelines (#15869)
Commits

Updates rollup from 4.57.0 to 4.59.0

Release notes

Sourced from rollup's releases.

v4.59.0

4.59.0

2026-02-22

Features

  • Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

v4.58.0

4.58.0

2026-02-20

Features

  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

v4.57.1

4.57.1

2026-01-30

Bug Fixes

  • Fix heap corruption issue in Windows (#6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.59.0

2026-02-22

Features

  • Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

4.58.0

2026-02-20

Features

  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

4.57.1

2026-01-30

Bug Fixes

  • Fix heap corruption issue in Windows (#6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the npm-dependencies group with 9 updates
e690120 
Bumps the npm-dependencies group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [commander](https://github.com/tj/commander.js) | `14.0.2` | `14.0.3` |
| [mariadb](https://github.com/mariadb-corporation/mariadb-connector-nodejs) | `3.4.5` | `3.5.2` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.16.2` | `3.19.1` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.17.2` | `8.20.0` |
| [sequelize](https://github.com/sequelize/sequelize) | `6.37.7` | `6.37.8` |
| [@rollup/plugin-terser](https://github.com/rollup/plugins/tree/HEAD/packages/terser) | `0.4.4` | `1.0.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.1.0` | `25.4.0` |
| [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.2.0` | `30.3.0` |
| [rollup](https://github.com/rollup/rollup) | `4.57.0` | `4.59.0` |


Updates `commander` from 14.0.2 to 14.0.3
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](tj/commander.js@v14.0.2...v14.0.3)

Updates `mariadb` from 3.4.5 to 3.5.2
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-nodejs/blob/main/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-nodejs@3.4.5...3.5.2)

Updates `mysql2` from 3.16.2 to 3.19.1
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.16.2...v3.19.1)

Updates `pg` from 8.17.2 to 8.20.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.20.0/packages/pg)

Updates `sequelize` from 6.37.7 to 6.37.8
- [Release notes](https://github.com/sequelize/sequelize/releases)
- [Changelog](https://github.com/sequelize/sequelize/blob/main/CHANGELOG.md)
- [Commits](sequelize/sequelize@v6.37.7...v6.37.8)

Updates `@rollup/plugin-terser` from 0.4.4 to 1.0.0
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/terser/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/beep-v1.0.0/packages/terser)

Updates `@types/node` from 25.1.0 to 25.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `jest` from 30.2.0 to 30.3.0
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.3.0/packages/jest)

Updates `rollup` from 4.57.0 to 4.59.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.57.0...v4.59.0)

---
updated-dependencies:
- dependency-name: commander
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: mariadb
  dependency-version: 3.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: mysql2
  dependency-version: 3.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: pg
  dependency-version: 8.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: sequelize
  dependency-version: 6.37.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@rollup/plugin-terser"
  dependency-version: 1.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: jest
  dependency-version: 30.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: rollup
  dependency-version: 4.59.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 11, 2026
This was referenced Mar 11, 2026
Closed
Closed
Closed
Closed
Closed
@hzhangxyz
hzhangxyz merged commit 5e523a2 into main Mar 11, 2026
23 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-dependencies-bea183c670 branch March 11, 2026 16:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hzhangxyz