Skip to content

Bump the dependencies group with 10 updates - #1434

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-d9efe1698e
Open

Bump the dependencies group with 10 updates#1434
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-d9efe1698e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 10 updates:

Package From To
npm-check-updates 23.0.0 23.0.1
typescript 6.0.3 7.0.2
@types/pg 8.20.0 8.20.3
@elastic/elasticsearch 9.4.2 9.4.3
@aws-sdk/client-s3 3.1095.0 3.1101.0
mockserver-client 7.4.0 7.5.0
mongoose 9.8.0 9.9.1
mysql2 3.23.1 3.23.2
@types/oracledb 7.0.1 7.0.2
redis 6.1.0 6.2.0

Updates npm-check-updates from 23.0.0 to 23.0.1

Release notes

Sourced from npm-check-updates's releases.

v23.0.1

What's Changed

Full Changelog: raineorshine/npm-check-updates@v23.0.0...v23.0.1

Commits

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @types/pg from 8.20.0 to 8.20.3

Commits

Updates @elastic/elasticsearch from 9.4.2 to 9.4.3

Release notes

Sourced from @​elastic/elasticsearch's releases.

v9.4.3

Changelog

Commits

Updates @aws-sdk/client-s3 from 3.1095.0 to 3.1101.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1101.0

3.1101.0(2026-07-31)

New Features
  • client-resiliencehubv2: Adding support for new testing capability in AWS Resilience Hub. (105876ce)
  • client-cloudwatch-logs: Amazon CloudWatch Logs now lets you create and update lookup tables directly from CloudWatch Logs query results by passing a queryId, and configure a lookup table as a scheduled query destination so it refreshes automatically with the latest query results on each run. (6f5f75a0)
  • client-network-firewall: Doc Updates for Container Attributes (82107b32)
  • client-billing: Adds GetEnterpriseSupportChargeSummary, GetEnterpriseSupportContractDetails, and ListEnterpriseSupportLinkedAccountCharges. These APIs provide first-time programmatic access to billing data for Enterprise Support usage previously only available upon request through AWS Concierge or Support. (643d01c5)
  • client-quicksight: Adding TopicV2 management APIs, adding possibility to use Topics in Analysis (087bb505)
  • client-connectcampaignsv2: Launching feature for abandonment rate pacing control for outbound campaigns. (fbb8c225)
  • client-amp: Amazon Managed Service for Prometheus adds support for an Amazon OpenSearch Service exporter for managed collectors. (d9c634a8)
  • client-elementalinference: AWS Elemental Inference now supports graphic composition on cropped video outputs, enabling branded graphics and other visual elements to be overlaid as part of the inference workflow. (b9116f87)
  • client-rds: Adds StorageOperationStatus and StorageOperationPercentProgress to DescribeDBInstances, letting you monitor RDS storage initialization and optimization progress. (842d1779)
  • client-datazone: Adding support for enhanced Git experience in Sagemaker Unified Studio. (e5fcea3c)
  • client-transcribe-streaming: This release adds a new optional TranscriptFormat parameter to the Amazon Transcribe streaming API, letting customers select spoken or written form for numeric and formatted output. (5808fd5c)
  • client-bedrock-runtime: Added support for mid-conversation tool changes in the Amazon Bedrock Converse and ConverseStream APIs (8f29d856)
  • client-cloudformation: Adding enum for sensitive property to DriftIgnoredReason (ce2fa95d)
  • client-marketplace-catalog: This release enhances the ListEntities API to support TargetAgreementId, TargetAgreementIntent, and CreatedBySource filters for the Offer entity type. (550b6cf0)
  • client-outposts: Adds the "EKS" value to the AWSServiceName enum and marks the Address field as sensitive. (65dd1932)

For list of updated packages, view updated-packages.md in assets-3.1101.0.zip

v3.1100.0

3.1100.0(2026-07-31)

Chores
  • add packages-internal to root tsconfig inclusion (#8240) (a0f3fb58)
New Features
  • clients: update client endpoints as of 2026-07-31 (30d44c7e)
  • client-bcm-pricing-calculator: Removing Smithy RPC v2 CBOR support that was added in previous SDK release. (edce242c)
  • client-bcm-recommended-actions: Removing Smithy RPC v2 CBOR support that was added in previous SDK release. (7bed97ab)
Bug Fixes
  • core/protocols: v2 JSON codec updates and JsonBytesStringAdapter (#8238) (a1001f4b)
Tests

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1101.0 (2026-07-31)

Note: Version bump only for package @​aws-sdk/client-s3

3.1100.0 (2026-07-31)

Note: Version bump only for package @​aws-sdk/client-s3

3.1099.0 (2026-07-30)

Note: Version bump only for package @​aws-sdk/client-s3

3.1098.0 (2026-07-29)

Note: Version bump only for package @​aws-sdk/client-s3

3.1097.0 (2026-07-28)

Note: Version bump only for package @​aws-sdk/client-s3

3.1096.0 (2026-07-27)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

Updates mockserver-client from 7.4.0 to 7.5.0

Release notes

Sourced from mockserver-client's releases.

MockServer 7.5.0

[7.5.0] - 2026-07-29

Security

  • BREAKING: response templates can no longer reach arbitrary Java classes by default, closing the template remote-code-execution path reported as GHSA-7pwj-xvc2-hfpc. A caller who can reach the management API can register an expectation, and a response template was able to load java.lang.Runtime and execute OS commands in the MockServer process. Both engines that could do this are now sandboxed out of the box:
    • velocityDisallowClassLoading now defaults to true (was false), installing Velocity's SecureUberspector so a template cannot reach classes through $request.class.classLoader.loadClass(...). This is the more exposed half of the issue, and the half the report did not cover: Velocity ships in the DEFAULT distribution, whereas the JavaScript engine does not.
    • JavaScript templates now resolve no Java classes unless an operator grants them. Previously an empty javascriptAllowedClasses and empty javascriptDisallowedClasses meant unrestricted Java.type(...) access; that combination — the out-of-the-box state — now denies every class.
    • The GraalJS guest context no longer grants access to the members of java.lang.Class or java.lang.ClassLoader. Denying classes at Java.type(...) alone was not sufficient: real host objects are bound into the context (faker and the other built-in helpers), and under the previous HostAccess.ALL a template could walk from one of them to a classloader — faker.getClass().getClassLoader().loadClass('java.lang.Runtime') — reaching Runtime without the class filter ever being consulted. That walk is now closed, so host-class lookup is the single complete gate; a regression test drives four such walks (including through request) and fails if any resolves. Velocity's SecureUberspector already blocked the equivalent walk through its own bound helpers, which is now covered by a test too. Both flips are fully reversible with one property and remove no functionality: set mockserver.velocityDisallowClassLoading=false, or list the classes your templates need in mockserver.javascriptAllowedClasses (the single entry * lets any class resolve again). Templates that do not touch Java classes are unaffected, which is the overwhelming majority — JavaScript templates have the full ES2023 standard library available regardless of this setting. A refused class is logged once at WARN naming the class and the property to set, because GraalJS otherwise surfaces a refusal only as the class being undefined ("... is not a function"); the log is bounded and de-duplicated so a hostile template cannot flood it. mockserver.javascriptAllowedClasses is now also settable through the Spring test listener's @MockServerTest properties, which it was not before — it was a nice-to-have while the default was unrestricted, and is the only way to grant a class now that it is not. The insecure-mode WARN now fires when an operator has explicitly opened the sandbox rather than when it is closed. Proven end-to-end by a Netty integration test that registers the reported payload through the real management API and asserts the OS command creates no marker file, with a negative control on a deliberately unsandboxed server that DOES create it — so a regression cannot pass as an inert payload. This lands DEF-2 and DEF-3 of docs/plans/later/security-defaults.md ahead of the other default flips listed there; JavaScript went further than that plan proposed (deny everything, not a built-in "safe types" allow-list) because deny-by-default is the only form that stays safe as the JDK grows new reachable classes.

Fixed

  • A property file that cannot be read is now reported instead of ignored in silence (#2358). When a mockserver.propertyFile an operator had explicitly configured could not be read, MockServer applied none of its properties and said nothing about it — at any log level. The only symptom was that every

... (truncated)

Changelog

Sourced from mockserver-client's changelog.

[7.5.0] - 2026-07-29

Security

  • BREAKING: response templates can no longer reach arbitrary Java classes by default, closing the template remote-code-execution path reported as GHSA-7pwj-xvc2-hfpc. A caller who can reach the management API can register an expectation, and a response template was able to load java.lang.Runtime and execute OS commands in the MockServer process. Both engines that could do this are now sandboxed out of the box:
    • velocityDisallowClassLoading now defaults to true (was false), installing Velocity's SecureUberspector so a template cannot reach classes through $request.class.classLoader.loadClass(...). This is the more exposed half of the issue, and the half the report did not cover: Velocity ships in the DEFAULT distribution, whereas the JavaScript engine does not.
    • JavaScript templates now resolve no Java classes unless an operator grants them. Previously an empty javascriptAllowedClasses and empty javascriptDisallowedClasses meant unrestricted Java.type(...) access; that combination — the out-of-the-box state — now denies every class.
    • The GraalJS guest context no longer grants access to the members of java.lang.Class or java.lang.ClassLoader. Denying classes at Java.type(...) alone was not sufficient: real host objects are bound into the context (faker and the other built-in helpers), and under the previous HostAccess.ALL a template could walk from one of them to a classloader — faker.getClass().getClassLoader().loadClass('java.lang.Runtime') — reaching Runtime without the class filter ever being consulted. That walk is now closed, so host-class lookup is the single complete gate; a regression test drives four such walks (including through request) and fails if any resolves. Velocity's SecureUberspector already blocked the equivalent walk through its own bound helpers, which is now covered by a test too. Both flips are fully reversible with one property and remove no functionality: set mockserver.velocityDisallowClassLoading=false, or list the classes your templates need in mockserver.javascriptAllowedClasses (the single entry * lets any class resolve again). Templates that do not touch Java classes are unaffected, which is the overwhelming majority — JavaScript templates have the full ES2023 standard library available regardless of this setting. A refused class is logged once at WARN naming the class and the property to set, because GraalJS otherwise surfaces a refusal only as the class being undefined ("... is not a function"); the log is bounded and de-duplicated so a hostile template cannot flood it. mockserver.javascriptAllowedClasses is now also settable through the Spring test listener's @MockServerTest properties, which it was not before — it was a nice-to-have while the default was unrestricted, and is the only way to grant a class now that it is not. The insecure-mode WARN now fires when an operator has explicitly opened the sandbox rather than when it is closed. Proven end-to-end by a Netty integration test that registers the reported payload through the real management API and asserts the OS command creates no marker file, with a negative control on a deliberately unsandboxed server that DOES create it — so a regression cannot pass as an inert payload. This lands DEF-2 and DEF-3 of docs/plans/later/security-defaults.md ahead of the other default flips listed there; JavaScript went further than that plan proposed (deny everything, not a built-in "safe types" allow-list) because deny-by-default is the only form that stays safe as the JDK grows new reachable classes.

Fixed

  • A property file that cannot be read is now reported instead of ignored in silence (#2358). When a mockserver.propertyFile an operator had explicitly configured could not be read, MockServer applied none of its properties and said nothing about it — at any log level. The only symptom was that every property in the file appeared to be at its default, which surfaces far downstream as unexplained

... (truncated)

Commits
  • 2024884 build(deps): bump the npm-minor-and-patch group across 2 directories with 3 u...
  • b15e8cc build(deps): bump the npm-minor-and-patch group across 2 directories with 4 u...
  • a2c56a9 fix(client-node): stop the jar downloader deleting other versions and leaking...
  • 32d6023 fix(deps): clear npm transitive DoS advisories in the Node projects
  • 5ab560d build(deps-dev): bump c8 in /mockserver-client-node (#2437)
  • 228b142 test(client-node): close the OpenAPI action ratchet now the spec is complete
  • 4d2ea52 test(client-node): lint the client and fail when a test suite cannot be built
  • 6618918 fix(client-node): generate types from the in-repo spec and gate them against ...
  • bc4d50c fix(client-node): allow gRPC bidi, forward-validate and forward-with-fallback...
  • aac3c7a test(clients): make the silently-skipping client suites actually run
  • Additional commits viewable in compare view

Updates mongoose from 9.8.0 to 9.9.1

Release notes

Sourced from mongoose's releases.

9.9.1 / 2026-07-31

  • fix(query): avoid path collision when excluding subdocuments with nested select: false paths #12798
  • types(model): support overriding schema-level lean with lean: false #16413

9.9.0 / 2026-07-30

  • perf(document): improve toObject perf with faster string checks and avoiding unnecessary isSelected on paths with no getters #16407 #16373 #16385
  • perf(model): improve insertMany() performance and general change tracking performance #16370
  • perf(timestamps): avoid adding $setOnInsert for createdAt unless upsert set #16411
  • perf: improve toObject() performance #16408 #16405 #16378 #14394 BIGSUS24
  • types: add discriminator key to each member of embedded discriminator enum- #16412 #16045

9.8.1 / 2026-07-27

  • perf(document): avoid rebuilding modified paths during required path validation #16379 xianjianlf2
  • perf(document): avoid clearing the required paths cache on every document instantiation #16404 #16377
  • fix(query): reject update modifiers without paths #16387 AbdelrahmanHafez
  • perf: cache toString() results in array.unique to avoid redundant allocations #16390 vivek180905
  • types: respect the _id option when inferring StandardSchema types #16402
  • types(model): keep Model.schema typed when TSchema is omitted samuelmbabhazi
  • docs(guide): clarify strictQuery handling of filter paths not in the schema #16397 MuhammadFarhantahir
Changelog

Sourced from mongoose's changelog.

9.9.1 / 2026-07-31

  • fix(query): avoid path collision when excluding subdocuments with nested select: false paths #12798 BIGSUS24
  • types(model): apply schema-level lean to find() #16413
  • types(model): support overriding schema-level lean with lean: false #16413

9.9.0 / 2026-07-30

  • perf(document): improve toObject perf with faster string checks and avoiding unnecessary isSelected on paths with no getters #16407 #16373 #16385
  • perf(model): improve insertMany() performance and general change tracking performance #16370
  • perf(timestamps): avoid adding $setOnInsert for createdAt unless upsert set #16411
  • perf: improve toObject() performance #16408 #16405 #16378 #14394 BIGSUS24
  • types: add discriminator key to each member of embedded discriminator enum- #16412 #16045

8.24.2 / 2026-07-27

9.8.1 / 2026-07-27

  • perf(document): avoid rebuilding modified paths during required path validation #16379 xianjianlf2
  • perf(document): avoid clearing the required paths cache on every document instantiation #16404 #16377
  • fix(query): reject update modifiers without paths #16387 AbdelrahmanHafez
  • perf: cache toString() results in array.unique to avoid redundant allocations #16390 vivek180905
  • types: respect the _id option when inferring StandardSchema types #16402
  • types(model): keep Model.schema typed when TSchema is omitted samuelmbabhazi
  • docs(guide): clarify strictQuery handling of filter paths not in the schema #16397 MuhammadFarhantahir
Commits
  • a510d89 chore: release 9.9.1
  • 1287a37 Merge pull request #16414 from Automattic/vkarpov15/gh-16413
  • cddce69 types: add lean: false overrides for remaining find operations
  • 3d301c9 types(model): support lean: false overriding schema-level lean option re: #16413
  • 95935a7 Merge pull request #16409 from BIGSUS24/fix/subdocument-select-false-projecti...
  • e970583 types(model): handle { lean: true } schema option on Model.find() types
  • c14e17e docs: add missing changelog entry
  • 650c286 chore: release 9.9.0
  • 0b4ef8a test: improve flakey test
  • 2ccf221 Merge pull request #16412 from Automattic/vkarpov15/gh-16045-3
  • Additional commits viewable in compare view

Updates mysql2 from 3.23.1 to 3.23.2

Release notes

Sourced from mysql2's releases.

v3.23.2

3.23.2 (2026-07-27)

Bug Fixes

  • correct connectAttributes typo in ChangeUser packet (#4423) (f64ce07), closes #2140
  • don't leave a failed execute as the active command (#4425) (fbd64b6)
Changelog

Sourced from mysql2's changelog.

3.23.2 (2026-07-27)

Bug Fixes

  • correct connectAttributes typo in ChangeUser packet (#4423) (f64ce07), closes #2140
  • don't leave a failed execute as the active command (#4425) (fbd64b6)
Commits
  • a987302 chore(master): release 3.23.2 (#4424)
  • 6c0cbc6 build(deps): bump postcss from 8.5.15 to 8.5.23 in /website (#4437)
  • 2aec892 build(deps): bump lucide-react from 1.26.0 to 1.27.0 in /website (#4436)
  • 4f7a589 build(deps): bump sass from 1.101.7 to 1.102.0 in /website (#4435)
  • 992adc5 build(deps): bump lucide-react from 1.25.0 to 1.26.0 in /website (#4431)
  • 26c956b build(deps): bump sass from 1.101.6 to 1.101.7 in /website (#4432)
  • e6a1cf7 build(deps): bump sass from 1.101.3 to 1.101.6 in /website (#4427)
  • 3f240ce build(deps): bump fast-uri from 3.1.2 to 3.1.4 in /website (#4422)
  • 28ad315 build(deps): bump immutable from 5.1.5 to 5.1.9 in /website (#4421)
  • 67821f8 build(deps): bump svgo from 3.3.3 to 3.3.4 in /website (#4420)
  • Additional commits viewable in compare view

Updates @types/oracledb from 7.0.1 to 7.0.2

Commits

Updates redis from 6.1.0 to 6.2.0

Release notes

Sourced from redis's releases.

redis@6.2.0

6.2.0

✨ Highlights

Cluster commands now follow the server's request/response policies. node-redis reads each command's routing policy from the server's COMMAND metadata and routes and aggregates accordingly, so the cluster client behaves much more like a single server. Multi-key commands that span hash slots — MGET, MSET, DEL, EXISTS, TOUCH, UNLINK — are transparently split per slot and their replies reassembled in caller order, so cross-slot calls that previously failed with CROSSSLOT now just work. Fan-out commands such as KEYS, DBSIZE, FLUSHALL, PING, WAIT, SCRIPT EXISTS and CONFIG SET run across every shard (or every node) and their replies are aggregated per the server's policy, SCAN walks the whole cluster behind a per-client virtual cursor, and RANDOMKEY / FT.CURSOR get correct cluster-aware routing. Replica read-scaling was also aligned with the server flags, so read-only keyless commands (DBSIZE, KEYS, SCAN, RANDOMKEY, and the RediSearch / time-series reads) can be served from replicas again.

⚠️ Behavior change for the raw sendCommand path: a table-recognized command sent raw — e.g. cluster.sendCommand(['DBSIZE']) — now follows its policy (fan-out and aggregate) instead of hitting a single node. Callers who relied on raw commands for per-node operations should target a specific node with cluster.nodeClient(node).sendCommand(...).

This release also brings a broad wave of new command coverage across the client and modules. The time-series package gains the most: new TS.NRANGE/TS.NREVRANGE multi-key pivot commands, a TS.READ cursor reader, TS.QUERYLABELS, EXCLUDEEMPTY on MRANGE/MREVRANGE, and multi-aggregator support. RediSearch adds FT.ALIASLIST, a COLLECT reducer for FT.AGGREGATE, HNSW RERANK, timeout warnings on the FT.SEARCH family, and the full set of stemmer languages. The core client adds SUNIONCARD/SDIFFCARD, LMOVEM/BLMOVEM, ZREVRANK WITHSCORE, COMMAND DOCS, and XREAD MAXCOUNT/MAXSIZE. A large batch of correctness fixes lands for zero-valued optional arguments (LIMIT 0, DB 0, SAMPLES 0, ENTRIESREAD 0, IDLETIME/FREQ 0, ENTRIESADDED 0) that were previously dropped from the wire, alongside several cluster and sentinel connection-lifecycle fixes.

The new HIMPORT command family (managed fieldset lifecycle) ships as experimental — see the warning below.

🚀 New Features

⚠️ Experimental

  • feat(client): add HIMPORT command family with managed fieldset lifecycle (#3381) — @​nkaradzhov. The HIMPORT family and its FieldsetRegistry/PreparedFieldsets API are experimental and unstable; the surface may change or be removed in a future release. Do not depend on it in production.

🐛 Bug Fixes

  • fix(cluster): reject commands before the cluster topology is ready (#3321) — @​GiHoon1123
  • fix(cluster): rebind abort/timeout listeners when a command moves to another queue (#3367) — @​GiHoon1123
  • fix(cluster): make extractAllCommands drain the write queue (#3364) — @​GiHoon1123
  • fix(sentinel): reject connect() instead of hanging when the resolved master is unreachable (#3331) — @​GiHoon1123
  • fix(client): include the acquire-timeout duration in the pool timeout error message (#3382) — @​Piyush0049
  • fix(client): reject the in-flight connect attempt when the socket dies during the initiator (#3374) — @​nkaradzhov
  • fix(client): correct DoublyLinkedList head removal (#3320) — @​abhijeet117
  • fix(client): XADD/XTRIM with LIMIT 0 must emit the argument (#3342) — @​Develop-KIM
  • fix(client): XGROUP CREATE/SETID with ENTRIESREAD 0 must emit the argument (#3333) — @​Develop-KIM
  • fix(client): XSETID with ENTRIESADDED 0 must emit the argument (#3324) — @​spokodev
  • fix(client): MEMORY USAGE must emit SAMPLES when 0 (#3328) — @​Develop-KIM
  • fix(client): RESTORE with IDLETIME/FREQ 0 must emit the argument (#3323) — @​spokodev
  • fix(client): GETEX PXAT with a Date must encode milliseconds (#3317) — @​spokodev
  • fix(client): COPY with DB 0 must emit the DB argument (#3318) — @​spokodev

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dependencies group with 10 updates
209fe78 
Bumps the dependencies group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [npm-check-updates](https://github.com/raineorshine/npm-check-updates) | `23.0.0` | `23.0.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.20.0` | `8.20.3` |
| [@elastic/elasticsearch](https://github.com/elastic/elasticsearch-js) | `9.4.2` | `9.4.3` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1095.0` | `3.1101.0` |
| [mockserver-client](https://github.com/mock-server/mockserver-monorepo/tree/HEAD/mockserver-client-node) | `7.4.0` | `7.5.0` |
| [mongoose](https://github.com/Automattic/mongoose) | `9.8.0` | `9.9.1` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.1` | `3.23.2` |
| [@types/oracledb](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/oracledb) | `7.0.1` | `7.0.2` |
| [redis](https://github.com/redis/node-redis) | `6.1.0` | `6.2.0` |


Updates `npm-check-updates` from 23.0.0 to 23.0.1
- [Release notes](https://github.com/raineorshine/npm-check-updates/releases)
- [Changelog](https://github.com/raineorshine/npm-check-updates/blob/main/CHANGELOG.md)
- [Commits](raineorshine/npm-check-updates@v23.0.0...v23.0.1)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@types/pg` from 8.20.0 to 8.20.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg)

Updates `@elastic/elasticsearch` from 9.4.2 to 9.4.3
- [Release notes](https://github.com/elastic/elasticsearch-js/releases)
- [Changelog](https://github.com/elastic/elasticsearch-js/blob/main/CHANGELOG.md)
- [Commits](elastic/elasticsearch-js@v9.4.2...v9.4.3)

Updates `@aws-sdk/client-s3` from 3.1095.0 to 3.1101.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1101.0/clients/client-s3)

Updates `mockserver-client` from 7.4.0 to 7.5.0
- [Release notes](https://github.com/mock-server/mockserver-monorepo/releases)
- [Changelog](https://github.com/mock-server/mockserver-monorepo/blob/master/changelog.md)
- [Commits](https://github.com/mock-server/mockserver-monorepo/commits/mockserver-client-go/v7.5.0/mockserver-client-node)

Updates `mongoose` from 9.8.0 to 9.9.1
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@9.8.0...9.9.1)

Updates `mysql2` from 3.23.1 to 3.23.2
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.23.1...v3.23.2)

Updates `@types/oracledb` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/oracledb)

Updates `redis` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@6.1.0...redis@6.2.0)

---
updated-dependencies:
- dependency-name: npm-check-updates
  dependency-version: 23.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@types/pg"
  dependency-version: 8.20.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@elastic/elasticsearch"
  dependency-version: 9.4.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1101.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mockserver-client
  dependency-version: 7.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mongoose
  dependency-version: 9.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mysql2
  dependency-version: 3.23.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/oracledb"
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: redis
  dependency-version: 6.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code major An incompatible API change labels Aug 10, 2026
@netlify

netlify Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

❌ Deploy Preview for testcontainers-node failed.

Name Link
🔨 Latest commit 209fe78
🔍 Latest deploy log https://app.netlify.com/projects/testcontainers-node/deploys/6a791f5f3eaab60008aa1b31

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code major An incompatible API change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants