build(deps): bump the npm-security group across 3 directories with 17 updates by dependabot[bot] · Pull Request #549 · ever-co/ever-traduora

dependabot · 2026-07-16T02:22:02Z

Bumps the npm-security group with 17 updates in the / directory:

Package	From	To
axios	`1.11.0`	`1.16.0`
js-yaml	`4.1.0`	`4.2.0`
morgan	`1.10.0`	`1.11.0`
nodemailer	`8.0.11`	`9.0.1`
typeorm	`0.2.37`	`0.3.29`
@angular/common	`12.2.5`	`20.3.25`
@angular/compiler	`19.2.25`	`20.3.25`
@angular/core	`19.2.25`	`20.3.25`
@babel/core	`7.8.3`	`7.26.9`
linkify-it	`3.0.2`	`5.0.0`
piscina	`3.1.0`	`4.8.0`
qs	`6.5.3`	`6.5.5`
shell-quote	`1.8.1`	`1.10.0`
tar	`6.1.11`	`6.2.1`
webpack-dev-server	`3.11.2`	`5.2.2`
websocket-driver	`0.7.4`	`0.7.5`
ws	`7.5.5`	`7.5.12`

Bumps the npm-security group with 5 updates in the /api directory:

Package	From	To
axios	`0.21.4`	`0.32.0`
js-yaml	`4.1.0`	`4.2.0`
morgan	`1.10.0`	`1.11.0`
nodemailer	`6.6.3`	`9.0.1`
typeorm	`0.2.37`	`0.3.29`

Bumps the npm-security group with 3 updates in the /webapp directory: @angular/common, @angular/compiler and @angular/core.

Updates axios from 1.11.0 to 1.16.0

Release notes

Sourced from axios's releases.

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)

Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)

Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)

parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)

Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)

transformRequest input typing change was reverted. The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (#10745, #10810)

🚀 New Features

QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#10802)

ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #6485). (#10680)

Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#6897)

🐛 Bug Fixes

HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#10794, #10800, #6241, #10822, #10825)

HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#10708, #10819, #7149)

Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#10795, #10772, #10806, #7260)

XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#10787)

Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#10724, #7276, #10729)

Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#7414, #6389, #6460)

UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#7378)

Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#10833)

🔧 Maintenance & Chores

Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#10588, #7419)

Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#10820, #10791, #10796)

Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#10821, #10782, #10759, #10804)

Reverted: Reverted the transformRequest input typing change from #10745 after follow-up review. (#10745, #10810)

Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#10785, #10813, #10814)

Release: Updated changelog and packages, and prepared the 1.16.0 release. (#10790, #10834)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@singhankit001 (#10588)

@cuiweixie (#7419)

@iruizsalinas (#10787)

@MarcosNocetti (#10680)

@deepview-autofix (#10729)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)

Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)

Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)

parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)

Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)

transformRequest input typing change was reverted. The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (#10745, #10810)

🚀 New Features

QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#10802)

ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #6485). (#10680)

Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#6897)

🐛 Bug Fixes

HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#10794, #10800, #6241, #10822, #10825)

HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#10708, #10819, #7149)

Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#10795, #10772, #10806, #7260)

XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#10787)

Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#10724, #7276, #10729)

Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#7414, #6389, #6460)

UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#7378)

Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#10833)

🔧 Maintenance & Chores

Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#10588, #7419)

Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#10820, #10791, #10796)

Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#10821, #10782, #10759, #10804)

Reverted: Reverted the transformRequest input typing change from #10745 after follow-up review. (#10745, #10810)

Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#10785, #10813, #10814)

Release: Updated changelog and packages, and prepared the 1.16.0 release. (#10790, #10834)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@singhankit001 (#10588)

@cuiweixie (#7419)

@iruizsalinas (#10787)

@MarcosNocetti (#10680)

@deepview-autofix (#10729)

... (truncated)

Commits

df53d7d chore(release): prepare release 1.16.0 (#10834)
9d92bcd fix: gadgets and smaller issues (#10833)
5107ee6 fix: prevent undefined error codes in settle (#7276)
e573499 fix(fetch): defer global access in fetch adapter (#7260)
ad68e1a fix(http): honor timeout during connect without redirects (#10819)
2a51828 fix(http): decode URL basic auth credentials (#10825)
0e8b6bb fix(http): preserve user-supplied Host header when forwarding through a proxy...
79f39e1 docs: document paramsSerializer.encode for strict RFC 3986 query encoding (#1...
0fe3a5f [Docs/Types] Update parseReviver TypeScript definitions for ES2023 and add ...
cd6737f chore: matches the sibling responseStream.on(aborted) handler and added tests...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates js-yaml from 4.1.0 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added a loader option limiting merge sequence length. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

Commits

590dbab 4.2.0 released
f944dc5 Add package.json funding field
f692719 Changelog update
9971a06 Fix digits in YAML named tag handles
464a5b8 Fix flow scalar trailing whitespace folding, close #307
1fda4f7 Tests for #567, #565
031ad07 Stop resolving numbers with underscores as numeric scalars, #627
e46d223 CI config update
9023fee Add lockfile
990e6f4 Docs update
Additional commits viewable in compare view

Updates morgan from 1.10.0 to 1.11.0

Release notes

Sourced from morgan's releases.

1.11.0

What's Changed

feat: add :pid token by @ganesh3367 in expressjs/morgan#329

Security Fix:

Escape control characters in :remote-user token to prevent log injection

Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

New Contributors

@inigomarquinez made their first contribution in expressjs/morgan#291

@jonchurch made their first contribution in expressjs/morgan#299

@bjohansebas made their first contribution in expressjs/morgan#301

@UlisesGascon made their first contribution in expressjs/morgan#300

@ctcpip made their first contribution in expressjs/morgan#319

@ganesh3367 made their first contribution in expressjs/morgan#329

Full Changelog: expressjs/morgan@1.10.0...1.11.0

1.10.1

What's Changed

renaming simple to sample in readme by @ryhinchey in expressjs/morgan#237

adding installation instructions to readme by @ryhinchey in expressjs/morgan#233

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/morgan#291

ci: replace travis with github actions by @inigomarquinez in expressjs/morgan#290

docs: add example output for log formats by @jonchurch in expressjs/morgan#299

ci: use ubuntu-latest by @bjohansebas in expressjs/morgan#301

ci: apply OSSF Scorecard security best practices by @UlisesGascon in expressjs/morgan#300

remove --bail by @jonchurch in expressjs/morgan#314

⬆️ bump on-headers by @ctcpip in expressjs/morgan#319

New Contributors

@inigomarquinez made their first contribution in expressjs/morgan#291

@jonchurch made their first contribution in expressjs/morgan#299

@bjohansebas made their first contribution in expressjs/morgan#301

@UlisesGascon made their first contribution in expressjs/morgan#300

@ctcpip made their first contribution in expressjs/morgan#319

Full Changelog: expressjs/morgan@1.10.0...1.10.1

Changelog

Sourced from morgan's changelog.

1.11.0 / 2026-06-02

add :pid token

Security Fix:

Escape control characters in :remote-user token to prevent log injection

Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

1.10.1 / 2025-07-17

deps: on-headers@~1.1.0

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

Commits

e0e6f17 Release 1.11.0 (#350)
b3f5d9b Merge commit from fork
203c758 build(deps): bump github/codeql-action from 4.32.4 to 4.35.2 (#346)
002bc81 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#347)
561b0d7 build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.0 (#338)
2db705e build(deps): bump github/codeql-action from 3.29.7 to 4.32.4 (#337)
a373c5f build(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.3 (#327)
c8e72fa build(deps): bump actions/checkout from 4.1.1 to 6.0.1 (#324)
023300e build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (#307)
9d8d6c0 build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 (#306)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for morgan since your current version.

Updates nodemailer from 8.0.11 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

Commits

69cf625 chore(master): release 9.0.1 (#1828)
a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
4e58450 chore: update dev dependencies
541f5fd chore(master): release 9.0.0 (#1827)
0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
6a947ac fix!: validate TLS certificates by default when fetching remote content
See full diff in compare view

Updates typeorm from 0.2.37 to 0.3.29

Release notes

Sourced from typeorm's releases.

0.3.29

What's Changed

fix: fix up aggregate methods ambiguous column by @Cprakhar in typeorm/typeorm#11822

fix: prevent eager-loaded entities from overwriting manual relations by @LeviHeber in typeorm/typeorm#11267

fix: release query runner when there is no migration to revert by @mjr128 in typeorm/typeorm#11232

fix: add async to the method using setFindOptions() by @bindon in typeorm/typeorm#10787

chore: disable eslint errors for chai assertions by @alumni in typeorm/typeorm#11833

ci(tests): Remove limitation of branches to run on by @OSA413 in typeorm/typeorm#11794

ci: upgrade actions to v6 by @pkuczynski in typeorm/typeorm#11844

docs(v0.3): add version dropdown (stable/dev) by @naorpeled in typeorm/typeorm#11863

fix(sap): QueryBuilder parameter of type JS Date not escaped correctly by @alumni in typeorm/typeorm#11867

feat(sap): add pool timeout by @alumni in typeorm/typeorm#11868

feat(qodo): enable new review experience in v0.3 by @naorpeled in typeorm/typeorm#11910

feat: add returning option to update/upsert operations by @naorpeled in typeorm/typeorm#11782

test: enable repository-returning test by @gioboa in typeorm/typeorm#11913

chore(qodo): disable in progress notification in v0.3 by @naorpeled in typeorm/typeorm#11928

ci(docs): add deploy Github Action to v0.3 branch by @naorpeled in typeorm/typeorm#11929

chore(qodo): disable persistent comments and inline code suggestions in v0.3 by @naorpeled in typeorm/typeorm#11989

chore(deps): update all dependencies to the latest minor version by @alumni in typeorm/typeorm#12015

fix(redis): redis cache version detection by @mguida22 in typeorm/typeorm#11936

ci: remove summary comments location policy by @naorpeled in typeorm/typeorm#12117

ci(qodo): remove /improve from pr and push commands by @naorpeled in typeorm/typeorm#12129

ci: migrate from npm to pnpm by @pkuczynski in typeorm/typeorm#12193

ci(qodo): sync qodo pr agent config from master by @naorpeled in typeorm/typeorm#12265

ci: remove docs indexing by @alumni in typeorm/typeorm#12435

fix(security): validate limit() in Update/SoftDelete query builders by @smith-xyz in typeorm/typeorm#12437

chore(deps): update all minor by @alumni in typeorm/typeorm#12443

chore(release): release 0.3.29 by @michaelbromley in typeorm/typeorm#12442

New Contributors

@LeviHeber made their first contribution in typeorm/typeorm#11267

@mjr128 made their first contribution in typeorm/typeorm#11232

@bindon made their first contribution in typeorm/typeorm#10787

Full Changelog: typeorm/typeorm@0.3.28...0.3.29

0.3.28

What's Changed

build(deps): bump brace-expansion from 2.0.1 to 2.0.2 in /sample/playground by @dependabot[bot] in typeorm/typeorm#11522

chore: update dependencies by @alumni in typeorm/typeorm#11666

chore: fix package preview by @alumni in typeorm/typeorm#11542

fix: add multiSubnetFailover to mssql driver option types by @isaru66 in typeorm/typeorm#10804

ci: introduce jsdoc eslint plugin (warnings only) by @pkuczynski in typeorm/typeorm#11681

feat: add support for jsonpath column type in PostgreSQL by @pkuczynski in typeorm/typeorm#11684

feat: entity schema support trees by @wszgrcy in typeorm/typeorm#11606

ci: remove close stale issues GH action by @gioboa in typeorm/typeorm#11696

docs: remove unused docs example file by @pkuczynski in typeorm/typeorm#11675

docs: updated jsdoc link to PostgreSQL documentation for data types by @pkuczynski in typeorm/typeorm#11680

ci: bump actions/setup-node to v5 and benefit from automatic caching by @pkuczynski in typeorm/typeorm#11709

feat(cli/init): pick dependencies versions from our own package.json by @pkuczynski in typeorm/typeorm#11705

... (truncated)

Changelog

Sourced from typeorm's changelog.

0.3.29 (2026-05-08)

Bug Fixes

add async to the method using setFindOptions() (#10787) (cc07c90)

change import for process dependency (#11248) (1c67c3b)

cli: init command loading non-existing package.json (#11947) (4d9d1a6)

fix up aggregate methods ambiguous column (#11822) (6e34756)

fix up limit with joins (#11987) (3657db8)

getPendingMigrations unnecessarily creating migrations table (#11672) (1dbc224)

postgres: execute queries sequentially to avoid pg 8.19.0 deprecation warning (#12105) (79829a0)

prevent columns with select false from being returned (#11944) (6b20831)

prevent eager-loaded entities from overwriting manual relations (#11267) (2d8c515)

propagate schema and database to closure junction table (#12110) (58b403f)

redis: redis cache version detection (#11936) (f22c7a2)

release query runner when there is no migration to revert (#11232) (a46eb0a)

sap: QueryBuilder parameter of type JS Date not escaped correctly (#11867) (5153436)

security: validate limit() in Update/SoftDelete query builders (#12437) (0d7991a)

virtual property handling in schema builder (#11000) (5bd3255)

Features

add returning option to update/upsert operations (#11782) (11d9767)

sap: add pool timeout (#11868) (b4e2ad2)

sap: support locking in select (#11996) (86a9e3e)

0.3.28 (2025-12-02)

Bug Fixes

add multiSubnetFailover option for mssql (#10804) (83e3a8a)

circular import in SapDriver.ts (#11750) (bed7913)

cli: init command reading package.json from two folders up (#11789) (dd55218)

deps: upgrade glob to fix CVE-2025-64756 (#11784) (dc74f53)

mongodb: add missing findBy method to MongoEntityManager (#11814) (38715bb)

redis: version detection logic (#11815) (6f486e5)

typesense doc sync (#11807) (d0b5454)

Features

add support for jsonpath column type in PostgreSQL (#11684) (4f05718)

cli/init: pick dependencies versions from our own package.json (#11705) (b930909)

entity schema support trees (#11606) (925dee0)

export QueryPartialEntity and QueryDeepPartialEntity types (#11748) (ade198c)

init version in postgres driver only if not set (#11373) (cb1284c)

manage MongoDB SOCKS5 proxy settings (#11731) (d7867eb)

mssql: support 'vector' type for MS SQL Server (#11732) (2681051)

mysql: add pool size options for each connection (

… updates Bumps the npm-security group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.11.0` | `1.16.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.2.0` | | [morgan](https://github.com/expressjs/morgan) | `1.10.0` | `1.11.0` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `8.0.11` | `9.0.1` | | [typeorm](https://github.com/typeorm/typeorm) | `0.2.37` | `0.3.29` | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `12.2.5` | `20.3.25` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `19.2.25` | `20.3.25` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `19.2.25` | `20.3.25` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.8.3` | `7.26.9` | | [linkify-it](https://github.com/markdown-it/linkify-it) | `3.0.2` | `5.0.0` | | [piscina](https://github.com/piscinajs/piscina) | `3.1.0` | `4.8.0` | | [qs](https://github.com/ljharb/qs) | `6.5.3` | `6.5.5` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.1` | `1.10.0` | | [tar](https://github.com/isaacs/node-tar) | `6.1.11` | `6.2.1` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `3.11.2` | `5.2.2` | | [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` | | [ws](https://github.com/websockets/ws) | `7.5.5` | `7.5.12` | Bumps the npm-security group with 5 updates in the /api directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `0.21.4` | `0.32.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.2.0` | | [morgan](https://github.com/expressjs/morgan) | `1.10.0` | `1.11.0` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.6.3` | `9.0.1` | | [typeorm](https://github.com/typeorm/typeorm) | `0.2.37` | `0.3.29` | Bumps the npm-security group with 3 updates in the /webapp directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) and [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core). Updates `axios` from 1.11.0 to 1.16.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.11.0...v1.16.0) Updates `js-yaml` from 4.1.0 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.2.0) Updates `morgan` from 1.10.0 to 1.11.0 - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.10.0...1.11.0) Updates `nodemailer` from 8.0.11 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v8.0.11...v9.0.1) Updates `typeorm` from 0.2.37 to 0.3.29 - [Release notes](https://github.com/typeorm/typeorm/releases) - [Changelog](https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md) - [Commits](typeorm/typeorm@0.2.37...0.3.29) Updates `@angular/common` from 12.2.5 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/common) Updates `@angular/compiler` from 19.2.25 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 19.2.25 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/core) Updates `@babel/core` from 7.8.3 to 7.26.9 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.26.9/packages/babel-core) Updates `linkify-it` from 3.0.2 to 5.0.0 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@3.0.2...5.0.0) Updates `piscina` from 3.1.0 to 4.8.0 - [Release notes](https://github.com/piscinajs/piscina/releases) - [Changelog](https://github.com/piscinajs/piscina/blob/v4.8.0/CHANGELOG.md) - [Commits](piscinajs/piscina@v3.1.0...v4.8.0) Updates `qs` from 6.5.3 to 6.5.5 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.3...v6.5.5) Updates `shell-quote` from 1.8.1 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.1...v1.10.0) Updates `tar` from 6.1.11 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.11...v6.2.1) Updates `webpack-dev-server` from 3.11.2 to 5.2.2 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v3.11.2...v5.2.2) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.4...0.7.5) Updates `ws` from 7.5.5 to 7.5.12 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.5...7.5.12) Updates `axios` from 1.11.0 to 1.16.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.11.0...v1.16.0) Updates `nodemailer` from 8.0.11 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v8.0.11...v9.0.1) Updates `@babel/core` from 7.8.3 to 7.26.9 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.26.9/packages/babel-core) Updates `linkify-it` from 3.0.2 to 5.0.0 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@3.0.2...5.0.0) Updates `qs` from 6.5.3 to 6.5.5 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.3...v6.5.5) Updates `tar` from 6.1.11 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.11...v6.2.1) Updates `ws` from 7.5.5 to 7.5.12 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.5...7.5.12) Updates `@angular/compiler` from 19.2.25 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 19.2.25 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/core) Updates `@babel/core` from 7.8.3 to 7.26.9 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.26.9/packages/babel-core) Updates `piscina` from 3.1.0 to 4.8.0 - [Release notes](https://github.com/piscinajs/piscina/releases) - [Changelog](https://github.com/piscinajs/piscina/blob/v4.8.0/CHANGELOG.md) - [Commits](piscinajs/piscina@v3.1.0...v4.8.0) Updates `qs` from 6.5.3 to 6.5.5 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.3...v6.5.5) Updates `tar` from 6.1.11 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.11...v6.2.1) Updates `webpack-dev-server` from 3.11.2 to 5.2.2 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v3.11.2...v5.2.2) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.4...0.7.5) Updates `axios` from 0.21.4 to 0.32.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.11.0...v1.16.0) Updates `js-yaml` from 4.1.0 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.2.0) Updates `morgan` from 1.10.0 to 1.11.0 - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.10.0...1.11.0) Updates `nodemailer` from 6.6.3 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v8.0.11...v9.0.1) Updates `typeorm` from 0.2.37 to 0.3.29 - [Release notes](https://github.com/typeorm/typeorm/releases) - [Changelog](https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md) - [Commits](typeorm/typeorm@0.2.37...0.3.29) Updates `js-yaml` from 4.1.0 to 3.14.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.2.0) Updates `js-yaml` from 4.1.0 to 3.14.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.2.0) Updates `@angular/common` from 12.2.5 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/common) Updates `@angular/compiler` from 9.0.0 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 9.0.0 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/core) --- updated-dependencies: - dependency-name: axios dependency-version: 1.16.0 dependency-type: direct:production dependency-group: npm-security - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production dependency-group: npm-security - dependency-name: morgan dependency-version: 1.11.0 dependency-type: direct:production dependency-group: npm-security - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm-security - dependency-name: typeorm dependency-version: 0.3.29 dependency-type: direct:production dependency-group: npm-security - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm-security - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm-security - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm-security - dependency-name: "@babel/core" dependency-version: 7.26.9 dependency-type: indirect dependency-group: npm-security - dependency-name: linkify-it dependency-version: 5.0.0 dependency-type: indirect dependency-group: npm-security - dependency-name: piscina dependency-version: 4.8.0 dependency-type: indirect dependency-group: npm-security - dependency-name: qs dependency-version: 6.5.5 dependency-type: indirect dependency-group: npm-security - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm-security - dependency-name: tar dependency-version: 6.2.1 dependency-type: indirect dependency-group: npm-security - dependency-name: webpack-dev-server dependency-version: 5.2.2 dependency-type: indirect dependency-group: npm-security - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm-security - dependency-name: ws dependency-version: 7.5.12 dependency-type: indirect dependency-group: npm-security - dependency-name: axios dependency-version: 1.16.0 dependency-type: direct:production dependency-group: npm-security - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm-security - dependency-name: "@babel/core" dependency-version: 7.26.9 dependency-type: indirect dependency-group: npm-security - dependency-name: linkify-it dependency-version: 5.0.0 dependency-type: indirect dependency-group: npm-security - dependency-name: qs dependency-version: 6.5.5 dependency-type: indirect dependency-group: npm-security - dependency-name: tar dependency-version: 6.2.1 dependency-type: indirect dependency-group: npm-security - dependency-name: ws dependency-version: 7.5.12 dependency-type: indirect dependency-group: npm-security - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm-security - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm-security - dependency-name: "@babel/core" dependency-version: 7.26.9 dependency-type: indirect dependency-group: npm-security - dependency-name: piscina dependency-version: 4.8.0 dependency-type: indirect dependency-group: npm-security - dependency-name: qs dependency-version: 6.5.5 dependency-type: indirect dependency-group: npm-security - dependency-name: tar dependency-version: 6.2.1 dependency-type: indirect dependency-group: npm-security - dependency-name: webpack-dev-server dependency-version: 5.2.2 dependency-type: indirect dependency-group: npm-security - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm-security - dependency-name: axios dependency-version: 0.32.0 dependency-type: direct:production dependency-group: npm-security - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production dependency-group: npm-security - dependency-name: morgan dependency-version: 1.11.0 dependency-type: direct:production dependency-group: npm-security - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm-security - dependency-name: typeorm dependency-version: 0.3.29 dependency-type: direct:production dependency-group: npm-security - dependency-name: js-yaml dependency-version: 3.14.1 dependency-type: direct:production dependency-group: npm-security - dependency-name: js-yaml dependency-version: 3.14.1 dependency-type: direct:production dependency-group: npm-security - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm-security - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm-security - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm-security ... Signed-off-by: dependabot[bot] <support@github.com>

cla-assistant · 2026-07-16T02:22:16Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

sonarqubecloud · 2026-07-16T02:22:33Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

socket-security · 2026-07-16T02:23:30Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `js-yaml` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: yarn.lock → `npm/@commitlint/config-lerna-scopes@19.7.0` → `npm/semantic-release@24.2.3` → `npm/lerna@8.2.1` → `npm/@commitlint/cli@19.8.0` → `npm/js-yaml@4.2.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/js-yaml@4.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 16, 2026

Navigation Menu

Uh oh!

build(deps): bump the npm-security group across 3 directories with 17 updates - #549

build(deps): bump the npm-security group across 3 directories with 17 updates#549
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm-security-e8a70f0dfc

dependabot Bot commented on behalf of github Jul 16, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cla-assistant Bot commented Jul 16, 2026

Uh oh!

sonarqubecloud Bot commented Jul 16, 2026

Uh oh!

socket-security Bot commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 16, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.16.0 — May 2, 2026

⚠️ Notable Changes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.16.0 — May 2, 2026

⚠️ Notable Changes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

[4.2.0] - 2026-06-01

Added

Changed

Fixed

Security

[3.14.2] - 2025-11-15

Security

[4.1.1] - 2025-11-12

Security

1.11.0

What's Changed

New Contributors

1.10.1

What's Changed

New Contributors

1.11.0 / 2026-06-02

1.10.1 / 2025-07-17

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

9.0.1 (2026-06-17)

Bug Fixes

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

0.3.29

What's Changed

New Contributors

0.3.28

What's Changed

0.3.29 (2026-05-08)

Bug Fixes

Features

0.3.28 (2025-12-02)

Bug Fixes

Features

Uh oh!

cla-assistant Bot commented Jul 16, 2026

Uh oh!

sonarqubecloud Bot commented Jul 16, 2026

Quality Gate passed

Uh oh!

socket-security Bot commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 16, 2026 •

edited by cubic-dev-ai Bot

Loading