Skip to content

Bump the proxy-dependencies group across 1 directory with 9 updates - #22

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/render-proxy/proxy-dependencies-e0c70c8489
Open

Bump the proxy-dependencies group across 1 directory with 9 updates#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/render-proxy/proxy-dependencies-e0c70c8489

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown

Bumps the proxy-dependencies group with 9 updates in the /render-proxy directory:

Package From To
@napi-rs/canvas 0.1.69 1.0.3
express 4.22.2 5.2.1
express-rate-limit 7.5.1 8.6.1
helmet 7.2.0 8.3.0
multer 1.4.5-lts.2 2.2.0
pdf-parse 1.1.4 2.4.5
pdfjs-dist 4.2.67 6.1.200
redis 4.7.1 6.1.0
tesseract.js 5.1.1 7.0.0

Updates @napi-rs/canvas from 0.1.69 to 1.0.3

Release notes

Sourced from @​napi-rs/canvas's releases.

v1.0.3

What's Changed

New Contributors

Full Changelog: Brooooooklyn/canvas@v1.0.2...v1.0.3

v1.0.2

What's Changed

Full Changelog: Brooooooklyn/canvas@v1.0.1...v1.0.2

v1.0.1

What's Changed

Full Changelog: Brooooooklyn/canvas@v1.0.0...v1.0.1

v1.0.0

What's Changed

We have achieved ~11m/week downloads, and the API is stable, so we have decided to release version 1.0 at this time. There are no breaking changes; it's safe for everyone to upgrade.

Full Changelog: Brooooooklyn/canvas@v0.1.100...v1.0.0

v0.1.100

... (truncated)

Changelog

Sourced from @​napi-rs/canvas's changelog.

1.0.3 (2026-07-28)

Bug Fixes

  • deps: update rust crate imagesize to 0.15 (#1290) (2ad119e)
  • deps: update rust crate infer to 0.22 (#1294) (dc3377f)
  • shadow: align Canvas2D shadows with Chromium (#1300) (5646339)
  • shadow: apply shadowColor alpha once instead of squaring it (#1298) (2cd4e1a), closes #1297

Features

1.0.2 (2026-06-30)

Features

1.0.1 (2026-06-24)

Bug Fixes

  • link aarch64-pc-windows-msvc against static CRT (#1276) (8483662)
  • missing icudtl.dat in win32-arm64 package (#1278) (e1a75d1)

1.0.0 (2026-05-04)

0.1.100 (2026-04-26)

Bug Fixes

0.1.99 (2026-04-18)

Bug Fixes

  • drawImage gray halo on transparent PNG edges with imageSmoothingEnabled (#1252) (a748f3f)

0.1.98 (2026-04-15)

Features

0.1.97 (2026-03-16)

Bug Fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​napi-rs/canvas since your current version.


Updates express from 4.22.2 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

5.0.1 / 2024-10-08

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0

... (truncated)

Commits

Updates express-rate-limit from 7.5.1 to 8.6.1

Release notes

Sourced from express-rate-limit's releases.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

v8.5.2

You can view the changelog here.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

v8.4.1

You can view the changelog here.

v8.4.0

You can view the changelog here.

v8.3.2

You can view the changelog here.

v8.3.1

You can view the changelog here.

v8.3.0

You can view the changelog here.

v8.2.1

You can view the changelog here.

v8.2.0

You can view the changelog here.

v8.1.0

You can view the changelog here.

v8.0.1

You can view the changelog here.

v8.0.0

You can view the changelog here.

Commits
  • c7fced5 8.6.1
  • b21110e chore: deprecate millisecond-based time constants (#662)
  • fad3d85 chore(deps-dev): bump the development-dependencies group with 4 updates (#660)
  • fffb3c4 8.6.0
  • f366b2d docs: debugging guide, time constants, & v8.6.0 changelog (#652)
  • 593ddd2 fix: make debug output easier to read (#653)
  • ef8c129 fix: Pin safe version of @​asyncapi/specs dev dep (#659)
  • 7b05e0d feat: add time constants to support more readable values for windowMs (#655)
  • 863e730 chore(deps-dev): bump the development-dependencies group with 3 updates (#657)
  • e0e711e fix: correct wording in usage documentation for express-rate-limit (#656)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates helmet from 7.2.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

  • Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
  • Content-Security-Policy: improved error handling for invalid directive names

Fixed

  • Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
  • Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
  • Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

  • Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
  • Improve error message when passing duplicate options

8.1.0 - 2025-03-17

Changed

  • Content-Security-Policy gives a better error when a directive value, like self, should be quoted. See #482

8.0.0 - 2024-09-28

Changed

  • Breaking: Strict-Transport-Security now has a max-age of 365 days, up from 180
  • Breaking: Content-Security-Policy middleware now throws an error if a directive should have quotes but does not, such as self instead of 'self'. See #454
  • Breaking: Content-Security-Policy's getDefaultDirectives now returns a deep copy. This only affects users who were mutating the result
  • Breaking: Strict-Transport-Security now throws an error when "includeSubDomains" option is misspelled. This was previously a warning

Removed

  • Breaking: Drop support for Node 16 and 17. Node 18+ is now required
Commits
  • 75f1a98 8.3.0
  • f03f70d Update changelog for 8.3.0 release
  • a307fce Fix capitalization in CSP package changelog
  • 5347b43 Format default CSP in README for readability
  • 9afc570 CSP: fix middleware-specific README missing link
  • 266c95c Minor speedups to project setups test
  • 7a4196c CSP: update package-specific changelog
  • 02716b4 CSP: improve performance when there are no dynamic directives
  • 3f511ed CSP: move utility functions to separate file
  • 80338af CSP: disabling defaults with no directives is now an error
  • Additional commits viewable in compare view

Updates multer from 1.4.5-lts.2 to 2.2.0

Release notes

Sourced from multer's releases.

v2.2.0

Important

What's Changed

New Contributors

Full Changelog: expressjs/multer@v2.1.1...v2.2.0

v2.1.1

Important

What's Changed

New Contributors

Full Changelog: expressjs/multer@v2.1.0...v2.1.1

v2.1.0

Important

What's Changed

... (truncated)

Changelog

Sourced from multer's changelog.

2.2.0

2.1.1

2.1.0

2.0.2

2.0.1

2.0.0

Commits
  • 2e2af08 2.2.0 (#1412)
  • a192b52 feat: add fieldNestingDepth limit option
  • 9c801c7 fix: clean up in-progress disk writes on abort
  • 0adb21d ci: add Node 26 to test matrix (#1404)
  • f5e17c3 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1410)
  • de1fefd chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 (#1409)
  • 67abfc8 chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1397)
  • 368c8a1 2.1.1 (#1380)
  • 7e66481 🐛 fix recursion issue
  • 643571e ✅ add explicit test for client able to send body without abrupt disconnect
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for multer since your current version.


Updates pdf-parse from 1.1.4 to 2.4.5

Release notes

Sourced from pdf-parse's releases.

Release v2.4.5

What's Changed

🚨 Breaking Changes

📚 Documentation

Full Changelog: mehmet-kozan/pdf-parse@v2.4.4...v2.4.5

Release v2.4.4

What's Changed

🚨 Breaking Changes

✨ New Features

📚 Documentation

🧰 Other Changes

Full Changelog: mehmet-kozan/pdf-parse@v2.4.3...v2.4.4

Release v2.4.4-beta.1

What's Changed

🚨 Breaking Changes

✨ New Features

📚 Documentation

🧰 Other Changes

... (truncated)

Commits
  • e8e800b Remove Tidelift funding option
  • 614e669 Integration test dependency fix (#38)
  • cff0ae1 For browser build, set the background web worker explicitly. (#37)
  • 54937b6 Update README.md
  • 1e87edd Update API Extractor config and rename API docs
  • c153bf7 Release v2.4.4 and update README formatting
  • 69eec3e NPM publish workflow now triggers only on published releases. (#33)
  • 1bfae05 Command-line interface for quick PDF processing implemented. (#32)
  • 8a7a044 CDN urls updated pdf-parse/utils replaced with pdf-parse/node (#31)
  • 4b6c46e getTable() return type changed. (#30)
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates pdfjs-dist from 4.2.67 to 6.1.200

Release notes

Sourced from pdfjs-dist's releases.

v6.1.200

This release contains improvements for annotation rendering, annotation editing, font conversion, image conversion, merging files, SMask rendering and the viewer.

Changes since v6.0.227

@dependabot
Bump the proxy-dependencies group across 1 directory with 9 updates
950a608 
Bumps the proxy-dependencies group with 9 updates in the /render-proxy directory:

| Package | From | To |
| --- | --- | --- |
| [@napi-rs/canvas](https://github.com/Brooooooklyn/canvas) | `0.1.69` | `1.0.3` |
| [express](https://github.com/expressjs/express) | `4.22.2` | `5.2.1` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `7.5.1` | `8.6.1` |
| [helmet](https://github.com/helmetjs/helmet) | `7.2.0` | `8.3.0` |
| [multer](https://github.com/expressjs/multer) | `1.4.5-lts.2` | `2.2.0` |
| [pdf-parse](https://github.com/mehmet-kozan/pdf-parse) | `1.1.4` | `2.4.5` |
| [pdfjs-dist](https://github.com/mozilla/pdf.js) | `4.2.67` | `6.1.200` |
| [redis](https://github.com/redis/node-redis) | `4.7.1` | `6.1.0` |
| [tesseract.js](https://github.com/naptha/tesseract.js) | `5.1.1` | `7.0.0` |



Updates `@napi-rs/canvas` from 0.1.69 to 1.0.3
- [Release notes](https://github.com/Brooooooklyn/canvas/releases)
- [Changelog](https://github.com/Brooooooklyn/canvas/blob/main/CHANGELOG.md)
- [Commits](Brooooooklyn/canvas@v0.1.69...v1.0.3)

Updates `express` from 4.22.2 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v4.22.2...v5.2.1)

Updates `express-rate-limit` from 7.5.1 to 8.6.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.6.1)

Updates `helmet` from 7.2.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v7.2.0...v8.3.0)

Updates `multer` from 1.4.5-lts.2 to 2.2.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v1.4.5-lts.2...v2.2.0)

Updates `pdf-parse` from 1.1.4 to 2.4.5
- [Release notes](https://github.com/mehmet-kozan/pdf-parse/releases)
- [Commits](mehmet-kozan/pdf-parse@v1.1.4...v2.4.5)

Updates `pdfjs-dist` from 4.2.67 to 6.1.200
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](mozilla/pdf.js@v4.2.67...v6.1.200)

Updates `redis` from 4.7.1 to 6.1.0
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@4.7.1...redis@6.1.0)

Updates `tesseract.js` from 5.1.1 to 7.0.0
- [Release notes](https://github.com/naptha/tesseract.js/releases)
- [Commits](naptha/tesseract.js@v5.1.1...v7.0.0)

---
updated-dependencies:
- dependency-name: "@napi-rs/canvas"
  dependency-version: 1.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: multer
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: pdf-parse
  dependency-version: 2.4.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: pdfjs-dist
  dependency-version: 6.1.200
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: redis
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: tesseract.js
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants