Skip to content

Bump the npm_and_yarn group across 1 directory with 31 updates#2

Open
dependabot[bot] wants to merge 1 commit intocanaryfrom
dependabot/npm_and_yarn/turbopack/crates/turbopack-tracing/tests/node-file-trace/npm_and_yarn-9412694d8a
Open

Bump the npm_and_yarn group across 1 directory with 31 updates#2
dependabot[bot] wants to merge 1 commit intocanaryfrom
dependabot/npm_and_yarn/turbopack/crates/turbopack-tracing/tests/node-file-trace/npm_and_yarn-9412694d8a

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Dec 18, 2025

Bumps the npm_and_yarn group with 25 updates in the /turbopack/crates/turbopack-tracing/tests/node-file-trace directory:

Package From To
@google-cloud/firestore 4.15.1 6.2.0
axios 0.21.4 0.30.2
esbuild 0.15.12 0.25.0
express 4.18.2 4.22.0
firebase 7.24.0 10.9.0
mongoose 5.13.15 6.13.6
pug 3.0.2 3.0.3
semver 7.3.8 7.5.2
sequelize 5.22.5 6.29.0
sqlite3 5.1.2 5.1.5
vm2 3.9.11 3.10.0
body-parser 1.20.1 1.20.4
browserify-sign 4.2.1 4.2.5
cookiejar 2.1.3 2.1.4
decode-uri-component 0.2.0 0.2.2
elliptic 6.5.4 6.6.1
engine.io 3.6.0 3.6.2
es5-ext 0.10.62 0.10.64
jose 2.0.6 2.0.7
json5 1.0.1 1.0.2
luxon 3.0.4 3.7.2
msgpackr 1.7.2 1.11.8
nodemailer 6.8.0 6.10.1
socket.io-parser 3.3.2 3.3.4
word-wrap 1.2.3 1.2.5

Updates @google-cloud/firestore from 4.15.1 to 6.2.0

Release notes

Sourced from @​google-cloud/firestore's releases.

v6.2.0

6.2.0 (2022-09-13)

Features

Bug Fixes

  • Minify proto JSON files (#1771) (6393fe7)
  • Remove hack in update.sh, and replace with existing pattern for protobuf dependencies. (#1769) (6ba6751)

v6.1.0

6.1.0 (2022-09-07)

Features

  • Accept google-gax instance as a parameter (#1757) (ef59a22)

Bug Fixes

  • Better support for fallback mode (#1756) (a029a6e)
  • Don't allow serialization of firestore settings (#1742) (fa0ad66)
  • Pin Typescript to prevent new type checking. (#1764) (dd01b27)
  • Update GAX (#1758) (1931415)
  • Version 7 of protobufjs broke the update.sh script. Added path to built in protobuf. (#1766) (40f1db3)

v6.0.0

6.0.0 (2022-07-22)

⚠ BREAKING CHANGES

  • update library to use Node 12 (#1725)

Features

Bug Fixes

  • change REST binding for ListDocuments to support root collection (#1695) (6185f13)

... (truncated)

Changelog

Sourced from @​google-cloud/firestore's changelog.

6.2.0 (2022-09-13)

Features

Bug Fixes

  • Minify proto JSON files (#1771) (6393fe7)
  • Remove hack in update.sh, and replace with existing pattern for protobuf dependencies. (#1769) (6ba6751)

6.1.0 (2022-09-07)

Features

  • Accept google-gax instance as a parameter (#1757) (ef59a22)

Bug Fixes

  • Better support for fallback mode (#1756) (a029a6e)
  • Don't allow serialization of firestore settings (#1742) (fa0ad66)
  • Pin Typescript to prevent new type checking. (#1764) (dd01b27)
  • Update GAX (#1758) (1931415)
  • Version 7 of protobufjs broke the update.sh script. Added path to built in protobuf. (#1766) (40f1db3)

6.0.0 (2022-07-22)

⚠ BREAKING CHANGES

  • update library to use Node 12 (#1725)

Features

Bug Fixes

  • change REST binding for ListDocuments to support root collection (#1695) (6185f13)
  • deps: update dependency protobufjs to v7 (#1747) (4e8d33c)
  • split v1 and v1beta1 protos to improve startup time (#1664) (f3729cf)

... (truncated)

Commits

Updates axios from 0.21.4 to 0.30.2

Release notes

Sourced from axios's releases.

v0.30.2

What's Changed

New Contributors

Full Changelog: axios/axios@v0.30.1...v0.30.2

Release v0.30.1

Release notes:

Bug Fixes

Contributors to this release

Full Changelog: axios/axios@v0.30.0...v0.30.1

Release v0.30.0

Release notes:

Bug Fixes

Contributors to this release

Full Changelog: axios/axios@v0.29.0...v0.30.0

v0.29.0

Release notes:

Bug Fixes

Contributors to this release

... (truncated)

Commits

Updates esbuild from 0.15.12 to 0.25.0

Release notes

Sourced from esbuild's releases.

v0.25.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.24.0 or ~0.24.0. See npm's documentation about semver for more information.

  • Restrict access to esbuild's development server (GHSA-67mh-4wv8-2f99)

    This change addresses esbuild's first security vulnerability report. Previously esbuild set the Access-Control-Allow-Origin header to * to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in the report.

    Starting with this release, CORS will now be disabled, and requests will now be denied if the host does not match the one provided to --serve=. The default host is 0.0.0.0, which refers to all of the IP addresses that represent the local machine (e.g. both 127.0.0.1 and 192.168.0.1). If you want to customize anything about esbuild's development server, you can put a proxy in front of esbuild and modify the incoming and/or outgoing requests.

    In addition, the serve() API call has been changed to return an array of hosts instead of a single host string. This makes it possible to determine all of the hosts that esbuild's development server will accept.

    Thanks to @​sapphi-red for reporting this issue.

  • Delete output files when a build fails in watch mode (#3643)

    It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.

  • Fix correctness issues with the CSS nesting transform (#3620, #3877, #3933, #3997, #4005, #4037, #4038)

    This release fixes the following problems:

    • Naive expansion of CSS nesting can result in an exponential blow-up of generated CSS if each nesting level has multiple selectors. Previously esbuild sometimes collapsed individual nesting levels using :is() to limit expansion. However, this collapsing wasn't correct in some cases, so it has been removed to fix correctness issues.

      /* Original code */
.parent {
  > .a,
  > .b1 > .b2 {
    color: red;
  }
}
/* Old output (with --supported:nesting=false) */
.parent > :is(.a, .b1 > .b2) {
color: red;
}
/* New output (with --supported:nesting=false) */
.parent > .a,
.parent > .b1 > .b2 {
color: red;
}

      Thanks to @​tim-we for working on a fix.

    • The & CSS nesting selector can be repeated multiple times to increase CSS specificity. Previously esbuild ignored this possibility and incorrectly considered && to have the same specificity as &. With this release, this should now work correctly:

      /* Original code (color should be red) */

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2022

This changelog documents all esbuild versions published in the year 2022 (versions 0.14.11 through 0.16.12).

0.16.12

  • Loader defaults to js for extensionless files (#2776)

    Certain packages contain files without an extension. For example, the yargs package contains the file yargs/yargs which has no extension. Node, Webpack, and Parcel can all understand code that imports yargs/yargs because they assume that the file is JavaScript. However, esbuild was previously unable to understand this code because it relies on the file extension to tell it how to interpret the file. With this release, esbuild will now assume files without an extension are JavaScript files. This can be customized by setting the loader for "" (the empty string, representing files without an extension) to another loader. For example, if you want files without an extension to be treated as CSS instead, you can do that like this:

    • CLI:

      esbuild --bundle --loader:=css

    • JS:

      esbuild.build({
  bundle: true,
  loader: { '': 'css' },
})

    • Go:

      api.Build(api.BuildOptions{
  Bundle: true,
  Loader: map[string]api.Loader{"": api.LoaderCSS},
})

    In addition, the "type" field in package.json files now only applies to files with an explicit .js, .jsx, .ts, or .tsx extension. Previously it was incorrectly applied by esbuild to all files that had an extension other than .mjs, .mts, .cjs, or .cts including extensionless files. So for example an extensionless file in a "type": "module" package is now treated as CommonJS instead of ESM.

0.16.11

  • Avoid a syntax error in the presence of direct eval (#2761)

    The behavior of nested function declarations in JavaScript depends on whether the code is run in strict mode or not. It would be problematic if esbuild preserved nested function declarations in its output because then the behavior would depend on whether the output was run in strict mode or not instead of respecting the strict mode behavior of the original source code. To avoid this, esbuild transforms nested function declarations to preserve the intended behavior of the original source code regardless of whether the output is run in strict mode or not:

    // Original code
if (true) {
  function foo() {}
  console.log(!!foo)
  foo = null
  console.log(!!foo)
}

... (truncated)

Commits
  • e9174d6 publish 0.25.0 to npm
  • c27dbeb fix hosts in plugin-tests.js
  • 6794f60 fix hosts in node-unref-tests.js
  • de85afd Merge commit from fork
  • da1de1b fix #4065: bitwise operators can return bigints
  • f4e9d19 switch case liveness: default is always last
  • 7aa47c3 fix #4028: minify live/dead switch cases better
  • 22ecd30 minify: more constant folding for strict equality
  • 4cdf03c fix #4053: reordering of .tsx in node_modules
  • dc71977 fix #3692: 0 now picks a random ephemeral port
  • Additional commits viewable in compare view

Updates express from 4.18.2 to 4.22.0

Release notes

Sourced from express's releases.

4.22.0

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Full Changelog: expressjs/express@4.21.0...4.21.1

4.21.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from express's changelog.

4.22.0 / 2025-12-01

4.21.2 / 2024-11-06

  • deps: path-to-regexp@0.1.12
    • Fix backtracking protection
  • deps: path-to-regexp@0.1.11
    • Throws an error on invalid path values

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express since your current version.


Updates firebase from 7.24.0 to 10.9.0

Commits

Updates mongoose from 5.13.15 to 6.13.6

Release notes

Sourced from mongoose's releases.

6.13.6 / 2025-01-13

  • fix: disallow nested $where in populate match
Changelog

Sourced from mongoose's changelog.

6.13.6 / 2025-01-13

8.9.4 / 2025-01-09

  • fix(document): fix document not applying manual populate when using a function in schema.options.ref #15138 IchirokuXVI
  • fix(model): make Model.validate() static correctly cast document arrays #15169 #15164
  • fix(model): allow passing validateBeforeSave option to bulkSave() to skip validation #15161 #15156
  • fix(schema): allow multiple self-referencing discriminator schemas using Schema.prototype.discriminator #15142 #15120
  • types: avoid BufferToBinary<> wiping lean types when passed to generic functions #15160 #15158
  • docs: fix <code> in header ids #15159
  • docs: fix header in field-level-encryption.md #15137 damieng

8.9.3 / 2024-12-30

  • fix(schema): make duplicate index error a warning for now to prevent blocking upgrading #15135 #15112 #15109
  • fix(model): handle document array paths set to non-array values in Model.castObject() #15124 #15075
  • fix(document): avoid using childSchemas.path for compatibility with pre-Mongoose-8.8 schemas #15131 #15071
  • fix(model): avoid throwing unnecessary error if updateOne() returns null in save() #15126
  • perf(cursor): clear the stack every time if using populate with batchSize to avoid stack overflows with large docs #15136 #10449
  • types: make BufferToBinary avoid Document instances #15123 #15122
  • types(model+query): avoid stripping out virtuals when calling populate with paths generic #15132 #15111
  • types(schema): add missing removeIndex #15134
  • types: add cleanIndexes() to IndexManager interface #15127
  • docs: move search endpoint to netlify #15119

8.9.2 / 2024-12-19

  • fix(schema): avoid throwing duplicate index error if index spec keys have different order or index has a custom name #15112 #15109
  • fix(map): clean modified subpaths when overwriting values in map of subdocs #15114 #15108
  • fix(aggregate): pull session from transaction local storage for aggregation cursors #15094 IchirokuXVI
  • types: correctly handle union types in BufferToBinary and related helpers #15103 #15102 #15057
  • types: add UUID to RefType #15115 #15101
  • docs: remove link to Mongoose 5.x docs from dropdown #15116
  • docs(connection+document+model): remove remaining references to remove(), clarify that deleteOne() does not execute until then() or exec() #15113 #15107

8.9.1 / 2024-12-16

  • fix(connection): remove heartbeat check in load balanced mode #15089 #15042 #14812
  • fix(discriminator): gather childSchemas when creating discriminator to ensure $getAllSubdocs() can properly get all subdocs #15099 #15088 #15092
  • fix(model): handle discriminators in castObject() #15096 #15075
  • fix(schema): throw error if duplicate index definition using unique in schema path and subsequent .index() call #15093 #15056
  • fix: mark documents that are populated using hydratedPopulatedDocs option as populated in top-level doc #15080 #15048
  • fix(document+schema): improve error message for get() on invalid path #15098 #15071
  • docs: remove more callback doc references & some small other changes #15095

8.9.0 / 2024-12-13

  • feat: upgrade mongodb -> 6.12

... (truncated)

Commits
  • e59e342 chore: release 6.13.6
  • 64a9f97 fix: disallow nested $where in populate match
  • 15bdccf chore: release 6.13.5
  • 33679bc fix: disallow using $where in match
  • 22210b1 chore: release 6.13.4
  • d21a239 Merge pull request #15043 from Automattic/vkarpov15/gh-15039
  • 68377ff fix: save execution stack in query as string
  • 6fbe9f0 Merge pull request #14998 from markstos/UT-8434-doc-strict-query-flipflop
  • 3e3dc2e docs: clarify strictQuery default will flip-flop in "Migrating to 6.x"
  • d98b2e7 docs: Add missing closing tag for Lodash entry.
  • Additional commits viewable in compare view

Updates pug from 3.0.2 to 3.0.3

Release notes

Sourced from pug's releases.

pug-code-gen@3.0.3

Bug Fixes

  • Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options (#3438)

pug@3.0.3

Bug Fixes

  • Update pug-code-gen with the following fix: (#3438)

    Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options

Commits

Updates semver from 7.3.8 to 7.5.2

Release notes

Sourced from semver's releases.

v7.5.2

7.5.2 (2023-06-15)

Bug Fixes

v7.5.1

7.5.1 (2023-05-12)

Bug Fixes

v7.5.0

7.5.0 (2023-04-17)

Features

Bug Fixes

v7.4.0

7.4.0 (2023-04-10)

Features

Bug Fixes

@dependabot
Bump the npm_and_yarn group across 1 directory with 31 updates
78641a6 
Bumps the npm_and_yarn group with 25 updates in the /turbopack/crates/turbopack-tracing/tests/node-file-trace directory:

| Package | From | To |
| --- | --- | --- |
| [@google-cloud/firestore](https://github.com/googleapis/nodejs-firestore) | `4.15.1` | `6.2.0` |
| [axios](https://github.com/axios/axios) | `0.21.4` | `0.30.2` |
| [esbuild](https://github.com/evanw/esbuild) | `0.15.12` | `0.25.0` |
| [express](https://github.com/expressjs/express) | `4.18.2` | `4.22.0` |
| [firebase](https://github.com/firebase/firebase-js-sdk) | `7.24.0` | `10.9.0` |
| [mongoose](https://github.com/Automattic/mongoose) | `5.13.15` | `6.13.6` |
| [pug](https://github.com/pugjs/pug) | `3.0.2` | `3.0.3` |
| [semver](https://github.com/npm/node-semver) | `7.3.8` | `7.5.2` |
| [sequelize](https://github.com/sequelize/sequelize) | `5.22.5` | `6.29.0` |
| [sqlite3](https://github.com/TryGhost/node-sqlite3) | `5.1.2` | `5.1.5` |
| [vm2](https://github.com/patriksimek/vm2) | `3.9.11` | `3.10.0` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.1` | `1.20.4` |
| [browserify-sign](https://github.com/crypto-browserify/browserify-sign) | `4.2.1` | `4.2.5` |
| [cookiejar](https://github.com/bmeck/node-cookiejar) | `2.1.3` | `2.1.4` |
| [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) | `0.2.0` | `0.2.2` |
| [elliptic](https://github.com/indutny/elliptic) | `6.5.4` | `6.6.1` |
| [engine.io](https://github.com/socketio/socket.io) | `3.6.0` | `3.6.2` |
| [es5-ext](https://github.com/medikoo/es5-ext) | `0.10.62` | `0.10.64` |
| [jose](https://github.com/panva/jose) | `2.0.6` | `2.0.7` |
| [json5](https://github.com/json5/json5) | `1.0.1` | `1.0.2` |
| [luxon](https://github.com/moment/luxon) | `3.0.4` | `3.7.2` |
| [msgpackr](https://github.com/kriszyp/msgpackr) | `1.7.2` | `1.11.8` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `6.8.0` | `6.10.1` |
| [socket.io-parser](https://github.com/Automattic/socket.io-parser) | `3.3.2` | `3.3.4` |
| [word-wrap](https://github.com/jonschlinkert/word-wrap) | `1.2.3` | `1.2.5` |



Updates `@google-cloud/firestore` from 4.15.1 to 6.2.0
- [Release notes](https://github.com/googleapis/nodejs-firestore/releases)
- [Changelog](https://github.com/googleapis/nodejs-firestore/blob/main/CHANGELOG.md)
- [Commits](googleapis/nodejs-firestore@v4.15.1...v6.2.0)

Updates `axios` from 0.21.4 to 0.30.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.21.4...v0.30.2)

Updates `esbuild` from 0.15.12 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md)
- [Commits](evanw/esbuild@v0.15.12...v0.25.0)

Updates `express` from 4.18.2 to 4.22.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md)
- [Commits](expressjs/express@4.18.2...4.22.0)

Updates `firebase` from 7.24.0 to 10.9.0
- [Release notes](https://github.com/firebase/firebase-js-sdk/releases)
- [Changelog](https://github.com/firebase/firebase-js-sdk/blob/main/CHANGELOG.md)
- [Commits](https://github.com/firebase/firebase-js-sdk/compare/firebase@7.24.0...firebase@10.9.0)

Updates `mongoose` from 5.13.15 to 6.13.6
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@5.13.15...6.13.6)

Updates `pug` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/pugjs/pug/releases)
- [Commits](https://github.com/pugjs/pug/compare/pug@3.0.2...pug@3.0.3)

Updates `semver` from 7.3.8 to 7.5.2
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.3.8...v7.5.2)

Updates `sequelize` from 5.22.5 to 6.29.0
- [Release notes](https://github.com/sequelize/sequelize/releases)
- [Commits](sequelize/sequelize@v5.22.5...v6.29.0)

Updates `sqlite3` from 5.1.2 to 5.1.5
- [Release notes](https://github.com/TryGhost/node-sqlite3/releases)
- [Commits](TryGhost/node-sqlite3@v5.1.2...v5.1.5)

Updates `vm2` from 3.9.11 to 3.10.0
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Commits](patriksimek/vm2@3.9.11...v3.10.0)

Updates `body-parser` from 1.20.1 to 1.20.4
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.1...1.20.4)

Updates `browserify-sign` from 4.2.1 to 4.2.5
- [Changelog](https://github.com/browserify/browserify-sign/blob/main/CHANGELOG.md)
- [Commits](browserify/browserify-sign@v4.2.1...v4.2.5)

Updates `cookiejar` from 2.1.3 to 2.1.4
- [Commits](https://github.com/bmeck/node-cookiejar/commits)

Updates `decode-uri-component` from 0.2.0 to 0.2.2
- [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases)
- [Commits](SamVerschueren/decode-uri-component@v0.2.0...v0.2.2)

Updates `dottie` from 2.0.2 to 2.0.6
- [Release notes](https://github.com/mickhansen/dottie.js/releases)
- [Commits](mickhansen/dottie.js@v2.0.2...v2.0.6)

Updates `elliptic` from 6.5.4 to 6.6.1
- [Commits](indutny/elliptic@v6.5.4...v6.6.1)

Updates `engine.io` from 3.6.0 to 3.6.2
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/commits)

Updates `es5-ext` from 0.10.62 to 0.10.64
- [Release notes](https://github.com/medikoo/es5-ext/releases)
- [Changelog](https://github.com/medikoo/es5-ext/blob/main/CHANGELOG.md)
- [Commits](medikoo/es5-ext@v0.10.62...v0.10.64)

Updates `follow-redirects` from 1.15.2 to 1.15.11
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.2...v1.15.11)

Updates `jose` from 2.0.6 to 2.0.7
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/v2.0.7/CHANGELOG.md)
- [Commits](panva/jose@v2.0.6...v2.0.7)

Updates `json5` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v1.0.1...v1.0.2)

Updates `luxon` from 3.0.4 to 3.7.2
- [Changelog](https://github.com/moment/luxon/blob/master/CHANGELOG.md)
- [Commits](moment/luxon@3.0.4...3.7.2)

Updates `msgpackr` from 1.7.2 to 1.11.8
- [Release notes](https://github.com/kriszyp/msgpackr/releases)
- [Commits](https://github.com/kriszyp/msgpackr/commits/v1.11.8)

Updates `nodemailer` from 6.8.0 to 6.10.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v6.8.0...v6.10.1)

Updates `path-to-regexp` from 0.1.7 to 0.1.12
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.12)

Updates `send` from 0.18.0 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.18.0...0.19.2)

Updates `serve-static` from 1.15.0 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.15.0...v1.16.3)

Updates `socket.io-parser` from 3.3.2 to 3.3.4
- [Release notes](https://github.com/Automattic/socket.io-parser/releases)
- [Changelog](https://github.com/socketio/socket.io-parser/blob/3.3.4/CHANGELOG.md)
- [Commits](socketio/socket.io-parser@3.3.2...3.3.4)

Updates `tar` from 6.1.11 to 6.2.1
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.1.11...v6.2.1)

Updates `word-wrap` from 1.2.3 to 1.2.5
- [Release notes](https://github.com/jonschlinkert/word-wrap/releases)
- [Commits](jonschlinkert/word-wrap@1.2.3...1.2.5)

---
updated-dependencies:
- dependency-name: "@google-cloud/firestore"
  dependency-version: 6.2.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 0.30.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-version: 4.22.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: firebase
  dependency-version: 10.9.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: mongoose
  dependency-version: 6.13.6
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: pug
  dependency-version: 3.0.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: semver
  dependency-version: 7.5.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: sequelize
  dependency-version: 6.29.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: sqlite3
  dependency-version: 5.1.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vm2
  dependency-version: 3.10.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserify-sign
  dependency-version: 4.2.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookiejar
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: decode-uri-component
  dependency-version: 0.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dottie
  dependency-version: 2.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: elliptic
  dependency-version: 6.6.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: engine.io
  dependency-version: 3.6.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: es5-ext
  dependency-version: 0.10.64
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.15.11
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jose
  dependency-version: 2.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: json5
  dependency-version: 1.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: luxon
  dependency-version: 3.7.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: msgpackr
  dependency-version: 1.11.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 6.10.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io-parser
  dependency-version: 3.3.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 6.2.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: word-wrap
  dependency-version: 1.2.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants