build(deps): Bump the minor-patch group across 1 directory with 19 updates

[dependabot]

Bumps the minor-patch group with 19 updates in the /backend directory:

Package	From	To
csv-parse	7.0.2	7.0.3
exifreader	4.46.0	4.50.0
express-rate-limit	8.7.0	8.7.1
fit-file-parser	6.1.2	6.2.2
geo-tz	8.1.9	8.1.10
nodemailer	10.0.16	10.1.0
pg	8.23.0	8.23.1
pino	10.3.1	10.4.0
uuid	14.0.2	14.0.3
webdav	5.10.0	5.11.0
zod	4.6.5	4.6.7
zxing-wasm	3.1.4	3.1.5
@types/multer	2.2.0	2.3.0
@typescript-eslint/eslint-plugin	8.70.0	8.71.2
@typescript-eslint/parser	8.70.0	8.71.2
eslint	10.10.0	10.12.0
pino-pretty	13.1.3	13.2.0
ts-jest	29.4.12	29.4.14
tsx	4.23.13	4.23.15

Updates csv-parse from 7.0.2 to 7.0.3

Changelog

Sourced from csv-parse's changelog.

7.0.3 (2026-09-25)

Bug Fixes

• csv-parse: preserve typed column keys (#500) (745f045)
• csv-parse: type the delimiter_auto score callback arguments (#499) (4aa04da)

Commits

• 594c646 chore(release): publish
• 16d9900 refactor(csv-parse): isolate error and normalize_options in types
• 4aa04da fix(csv-parse): type the delimiter_auto score callback arguments (#499)
• 8d4173d build: latest dev dependencies
• c8caa1c build: generate latest dist
• 6c45c9b build: remove npx usage in package scripts
• 6f39f27 test: remove lint errors
• 94ae7b9 test: rename mocha setup rule
• 42a6b09 test: remove ts-node usage
• 745f045 fix(csv-parse): preserve typed column keys (#500)
• Additional commits viewable in compare view

Updates exifreader from 4.46.0 to 4.50.0

Release notes

Sourced from exifreader's releases.

4.50.0: Package exports map and Node file loading in ES module bundles

Changed

• The package now declares an exports map. exifreader, exifreader/package.json, exifreader/src/* and exifreader/dist/* resolve as before, including the extension-less exifreader/src/exif-reader and exifreader/dist/exif-reader, which now also resolve for ES module imports in Node and Deno.
• With Node, Deno, esbuild and Rollup, any other src/ path now needs its .js extension: exifreader/src/tags.js resolves, exifreader/src/tags no longer does.
• bin/, webpack.config.js, babel.config.json and exif-reader.d.ts can no longer be imported by bare specifier. Nothing in the package resolves them that way, and the CLI reads them by file path. TypeScript users still get exif-reader.d.ts through the types condition and field.
• The map has a browser condition that points at the ES module source, so tools that apply the browser condition without the module condition keep getting it: esbuild with an explicit conditions list, which is what Cloudflare's Wrangler runs, bundles the source as before. Metro resolving for the web platform now gets the source instead of the UMD file, with identical behavior.
• The map has a node condition that points at the UMD file, so bundlers that target Node (esbuild with platform: 'node', webpack with target: 'node', Bun's bundler with --target=bun, and other tools that apply the node condition) bundle the same file Node loads. For webpack's default Node configuration and for bun build --target=bun this changes the bundled file from the ES module source to the UMD file. It parses images the same way, and the bundler includes @xmldom/xmldom in the bundle when that package is installed, instead of loading it from node_modules at run time. When @xmldom/xmldom is not installed, webpack reports a missing optional module and the build still works. Like any CommonJS file, the UMD file needs the bundler to support CommonJS: Rollup needs @rollup/plugin-commonjs, and Vite's development server needs exifreader left out of ssr.noExternal.

Fixed

• Bundling require('exifreader') for the browser with esbuild now works. esbuild now bundles the ES module source, as webpack, Vite, Rollup and Parcel already did, instead of picking the UMD file and failing on its http and https requires.
• Loading a file path or a URL in Node now works when exifreader is in an ES module bundle made by a tool other than webpack (esbuild with format: 'esm', Vite's SSR build with exifreader in ssr.noExternal, and the tools built on them), and when the ES module source is loaded directly by Node, Bun or Deno. Before, only the UMD file loaded by Node itself and webpack bundles could do this. On Node, those setups need 20.16 or later on the 20 line, or 22.3 or later. The UMD file loaded by Node itself keeps working on every supported version. The UMD file finds @xmldom/xmldom as before, and bundlers include it when it is installed. Outside webpack the ES module source gets no implicit @xmldom/xmldom: for XMP, pass the domParser option as described in Parsing XMP tags when not in a DOM environment.

Full Changelog: mattiasw/ExifReader@v4.49.0...v4.50.0

4.49.0: HEIC and AVIF image size, more tags from JPEG XL and PNG Exif, description and security fixes

Added

• JPEG XL files with a Brotli-compressed Exif box return the thumbnail, the IPTC, XMP, ICC and Photoshop tags and the Canon and Pentax maker notes that the Exif data carries, as files with an uncompressed Exif box do.
• PNG files with Exif in a Raw profile type exif text chunk return the Photoshop tags, the Canon and Pentax maker notes and the IPTC, XMP and ICC tags that the Exif data carries, as files with an eXIf chunk do. A Raw profile type iptc chunk in the same file takes precedence over IPTC tags in the Exif data.
• HEIC/HEIF and AVIF files return the image width and height, as Image Width and Image Height in the file group, and the number of color components and their bit depth, as Color Components and Bits Per Sample. Bits Per Sample is left out when the components differ in bit depth. These describe the primary image, so an iPhone photo reports the full photo size rather than that of one of its tiles or its thumbnail.

Fixed

• The support table in the README no longer marks any cell as untested. MPF is a JPEG APP2 structure with no place in TIFF, PNG, HEIC/HEIF, AVIF, WebP or JPEG XL, so those cells now say not applicable. Photoshop tags are read from the Exif data of PNG, HEIC/HEIF, AVIF, WebP and JPEG XL files just as they are from TIFF, so those cells now say partially supported.
• The support table in the README now says that IPTC tags are read from the Exif data of HEIC/HEIF, AVIF, WebP and JPEG XL files, and that ICC tags are read from the Exif data of JPEG XL files, instead of marking them as not supported. The custom build and tag filtering sections of the README no longer say that only TIFF files read IPTC, XMP and ICC tags from the Exif data.
• The Exif ExifVersion and FlashpixVersion, the InteroperabilityVersion and the MPF MPFVersion tags written as ASCII text, as some cameras do, now have that text as their description, such as 0220, instead of a single wrong character.
• An Exif tag whose description is looked up in a fixed list of values, such as SampleFormat, InkSet or SecurityClassification, and that was stored as ASCII text naming an Object.prototype member, such as constructor, was described as that member, for example the Object function, or as its source text. Such a value is now described as Unknown.
• The IPTC ObjectData Preview File Format Version tag, which the IIM specification stores as a 2-octet number, was described as its raw bytes, and a text value naming an Object.prototype member, such as constructor, was described as that member, for example the Object function. It is now described as the version name for its preview file format, such as 1.02 for JFIF version 1, as the version number when the format and version pair is unknown, or as its own text when it is text that names no known version.
• The Exif SampleFormat tag of an image with one sample per pixel, such as a grayscale TIFF, now has its format as its description, such as Unsigned, instead of Unknown.
• The Exif ComponentsConfiguration tag now has its components as its description, such as YCbCr, instead of an empty text. The description read the component bytes as ASCII digits, which files do not store.
• A box in a JPEG XL, HEIC/HEIF or AVIF file with too few bytes for its own header, or in JPEG XL for the 4-byte field its content starts with, had the missing bytes read from the data after it. A JPEG XL file with such an Exif or jxlp box could then return Exif tags or an image width and height read from there. The content of such a box is no longer read, or reading stops at that box.

Security

• The thumbnails in the Exif data of compressed PNG text chunks are read only up to twice the file size plus 64 KiB in total. A small file could otherwise make the library copy out thumbnails many times its own size. The thumbnail of a JPEG XL Brotli Exif box has the same bound.
• The text of an IPTC dataset in a block without a Coded Character Set dataset was converted one character at a time: a crafted JPEG with about 8 MiB of IPTC Caption/Abstract text blocked load() for about 0.42 seconds and raised peak memory to about 130 MB. The text is now converted in chunks, so the same file takes about 0.17 seconds and peaks at about 120 MB.
• The descriptions of IPTC datasets such as Date Created built their text one character at a time, whatever the Coded Character Set: a crafted JPEG with about 8 MiB of Date Created blocked load() for about 0.4 seconds and raised peak memory to about 129 MB. The text is now converted in chunks, so the same file takes about 0.16 seconds and peaks at about 110 MB.
• The descriptions of the Exif ComponentsConfiguration, WhitePoint and PrimaryChromaticities tags built a separate text for every element of the value before joining them: a crafted TIFF with an 8 MiB ComponentsConfiguration value raised peak memory to about 290 MB and blocked load() for about 0.4 seconds. The description is now built in chunks, so the same file peaks at about 235 MB and takes about 0.35 seconds. An 8 MiB list of fractions in WhitePoint or PrimaryChromaticities now peaks at about 290 MB instead of about 365 MB.
• A WhitePoint or PrimaryChromaticities value that was not a list of fractions, such as 8 MiB of bytes, was described as undefined/undefined for every element: a description of about 176 million characters that raised peak memory to about 1,260 MB and blocked load() for about 2.3 seconds. Such a value is now described as its values joined with , , as other tags are, so the same file peaks at about 450 MB and takes about 0.6 seconds.

Full Changelog: mattiasw/ExifReader@v4.48.1...v4.49.0

4.48.1: Less memory and time on crafted files, plus tag and type fixes

Fixed

• The TypeScript type for Pentax maker notes now names the K-3 III camera orientation CameraOrientation, as the library returns it, instead of Orientation, so Orientation in the flat result is optional again. It also marks PentaxVersion, PentaxModelID, CameraOrientation, RollAngle and PitchAngle optional, since a file may lack any of them.
• The TypeScript type for Canon maker notes now marks AutoRotate optional, since the library returns it only when the Canon ShotInfo tag holds it. Reading AutoRotate.value without a check no longer type-checks.
• A Canon maker note whose ShotInfo tag is stored with a type other than SHORT could return an AutoRotate value that is not a number, such as an array for RATIONAL. Such a value is now left out.

... (truncated)

Changelog

Sourced from exifreader's changelog.

[4.50.0] - 2026-10-12

Changed

• The package now declares an exports map. exifreader, exifreader/package.json, exifreader/src/* and exifreader/dist/* resolve as before, including the extension-less exifreader/src/exif-reader and exifreader/dist/exif-reader, which now also resolve for ES module imports in Node and Deno.
• With Node, Deno, esbuild and Rollup, any other src/ path now needs its .js extension: exifreader/src/tags.js resolves, exifreader/src/tags no longer does.
• bin/, webpack.config.js, babel.config.json and exif-reader.d.ts can no longer be imported by bare specifier. Nothing in the package resolves them that way, and the CLI reads them by file path. TypeScript users still get exif-reader.d.ts through the types condition and field.
• The map has a browser condition that points at the ES module source, so tools that apply the browser condition without the module condition keep getting it: esbuild with an explicit conditions list, which is what Cloudflare's Wrangler runs, bundles the source as before. Metro resolving for the web platform now gets the source instead of the UMD file, with identical behavior.
• The map has a node condition that points at the UMD file, so bundlers that target Node (esbuild with platform: 'node', webpack with target: 'node', Bun's bundler with --target=bun, and other tools that apply the node condition) bundle the same file Node loads. For webpack's default Node configuration and for bun build --target=bun this changes the bundled file from the ES module source to the UMD file. It parses images the same way, and the bundler includes @xmldom/xmldom in the bundle when that package is installed, instead of loading it from node_modules at run time. When @xmldom/xmldom is not installed, webpack reports a missing optional module and the build still works. Like any CommonJS file, the UMD file needs the bundler to support CommonJS: Rollup needs @rollup/plugin-commonjs, and Vite's development server needs exifreader left out of ssr.noExternal.

Fixed

• Bundling require('exifreader') for the browser with esbuild now works. esbuild now bundles the ES module source, as webpack, Vite, Rollup and Parcel already did, instead of picking the UMD file and failing on its http and https requires.
• Loading a file path or a URL in Node now works when exifreader is in an ES module bundle made by a tool other than webpack (esbuild with format: 'esm', Vite's SSR build with exifreader in ssr.noExternal, and the tools built on them), and when the ES module source is loaded directly by Node, Bun or Deno. Before, only the UMD file loaded by Node itself and webpack bundles could do this. On Node, those setups need 20.16 or later on the 20 line, or 22.3 or later. The UMD file loaded by Node itself keeps working on every supported version. The UMD file finds @xmldom/xmldom as before, and bundlers include it when it is installed. Outside webpack the ES

... (truncated)

Commits

• d2bd7fb 4.50.0
• c839640 Update changelog for 4.50.0
• e2e0752 Load Node builtins and xmldom without the webpack-only require
• 763cdbc Add a resolver matrix and permanent packaging resolution legs
• 0e04484 Add the package.json exports map with the root entry and passthroughs
• 5ca4465 Resolve the installed exifreader without package self-reference
• dfea03b Lock package resolution by bare specifier in the packaging test
• 8eabaad 4.49.0
• ef2b87d Update changelog for 4.49.0
• 48a0d3c Read HEIC and AVIF color components and bits per sample from the primary item...
• Additional commits viewable in compare view

Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits

• c2e30b3 8.7.1
• b40a390 v8.7.1 changelog
• ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
• 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
• 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
• 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
• 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
• 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
• 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
• 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
• Additional commits viewable in compare view

Updates fit-file-parser from 6.1.2 to 6.2.2

Release notes

Sourced from fit-file-parser's releases.

fit-file-parser v6.2.2 — Restore bounded device-header compatibility

Fixed

• Restore activity decoding for existing Bryton and Magene FIT files that set reserved bit 4 in normal record headers. These files were readable before 5.2.0.
• Require complete definitions and native/developer payloads for messages using this compatibility behavior, without modifying the original bytes.

Compatibility

• Strict mode, full raw-message retention, and the standalone raw reader continue rejecting reserved header bits. The other reserved data-header bit remains invalid in all modes.
• Checksum validation continues to follow force. No parser options, output fields, or public API signatures changed.
• Retry previously rejected originals after upgrading. Existing successful imports require no migration.

Validation

• All 238 tests across 28 test files pass, including ordinary/strict/raw modes, malformed definitions, truncated payloads, developer fields, compressed timestamps, checksum policy, and concatenated-file isolation.
• CI passes on Node.js 20, 22, 24, and 25, including builds, lint, type checks, and profile checks.
• Compared 1,563 private FIT originals against 6.2.1: the two previously rejected files recover, with 4,272 and 4,169 records; the other 1,561 outputs are identical. No new failures.

fit-file-parser v6.2.1 — Consistent recovery and opt-in strict validation

Highlights

• Align parseFilesAsync() with the recovery behavior of parseAsync() and callback parsing for each FIT file.
• Add opt-in strict: true validation for complete files, records, and definitions, and reject trailing bytes. CRC validation remains controlled by force.
• With the default force: true and strict: false, the all-file API accepts missing CRC bytes and ignores a non-FIT suffix, while keeping independent decoder state for each file.

Compatibility

• Existing API signatures, default decoding, parsed output, and damaged-file recovery are preserved. Existing consumers do not need to change their options.
• force continues to default to true; strict defaults to false. Additional validation requires explicitly enabling strict.
• Strict single-file parsing requires exactly one complete FIT file; strict parseFilesAsync() accepts complete concatenated FIT files.
• Temperature mappings and unit conversions are unchanged.

Validation

• CI passed on Node.js 20, 22, 24, and 25.
• All 228 tests across 27 test files passed, along with lint, type checks, profile checks, generated-source checks, and ESM/CommonJS builds.
• The full corpus covered 68,003 inputs containing 68,195 FIT files, including 43 concatenated inputs and 95 Suunto files. Strict validation passed for 68,002 inputs; one known header-CRC mismatch recovered with force: true, with zero unrecoverable inputs.
• Direct comparison against 6.2.0 found zero output differences for existing consumers or for the new API's per-file results. All 5,081,039 temperature readings, including 314,699 Suunto readings, were unchanged.
• ESM and CommonJS compatibility checks matched the published 6.2.0 package, including synthetic damaged-input cases.

fit-file-parser v6.2.0 — Corpus repairs and concatenated FIT support

Highlights

• Adds parseFilesAsync() to read every complete FIT file in concatenated input, returning separate results in file order with independent decoder state.
• Decodes documented session and lap swimming summaries, segment and gear-shift counts, lap bounds, metabolic calories, and grade-adjusted speed.
• Retains every battery sample in batteries and messages.battery, including timestamp and capacity percentage when present.
• Preserves exact bytes for developer fields without usable names in opt-in unmapped_messages, including cached descriptions.
• Recovers unsigned-byte record temperatures from 0 through 126 with normal unit conversion while preserving the original bytes in opt-in output.

Compatibility

... (truncated)

Changelog

Sourced from fit-file-parser's changelog.

6.2.2 - 2026-10-11

Fixed

• Restore ordinary decoding of existing Bryton and Magene FIT files whose normal record headers set reserved bit 4. Their activity data was readable before 5.2.0 and is recovered without modifying the original bytes.
• Require complete definitions and native/developer payloads for messages using reserved-header compatibility, including ordinary data records that reference a definition with the reserved bit set.

Compatibility

• Strict parsing, full raw-message retention, and the standalone raw reader continue rejecting reserved header bits. Bit 5 in data headers remains invalid in all modes. Checksum behavior still follows force.
• No new options or parsed output fields. Existing successful imports need no migration; retry previously rejected originals with the updated parser.

6.2.1 - 2026-10-10

Added

• Add the opt-in strict parser option to require complete files and records, valid definitions, and no trailing bytes in every parsing API. Checksum validation remains controlled by force.

Fixed

• Apply the same recovery policy to parseFilesAsync(), parseAsync(), and callback parsing. The all-file API now accepts missing CRC bytes with force: true when strict is disabled, and ignores a non-FIT suffix.
• Keep existing decoder behavior, recovery, and output when strict is not requested, including handling of malformed records and definitions.
• Apply additional definition and record bounds checks only in strict mode.

Compatibility

• force still defaults to true; strict defaults to false.
• strict: true requires exactly one file for parseAsync() and callback parsing, or complete concatenated files for parseFilesAsync().
• Temperature mappings and unit conversions are unchanged.

6.2.0 - 2026-10-10

Added

• Add parseFilesAsync() to return every complete FIT file in concatenated input as a separate result, with independent decoder state and file order.
• Decode documented session and lap swimming summaries, segment and gear-shift

... (truncated)

Commits

• db12c29 fix: restore bounded reserved-header compatibility and release 6.2.2
• cc63b23 fix: align parsing recovery and release 6.2.1
• 856a749 chore: release fit-file-parser 6.2.0
• 9b3d949 fix: preserve FIT fields and parse concatenated files
• c75cb6a chore: align fit-parser package metadata
• 2e3ea9b docs: prohibit Garmin FIT SDK project dependencies
• See full diff in compare view

Updates geo-tz from 8.1.9 to 8.1.10

Release notes

Sourced from geo-tz's releases.

v8.1.10

8.1.10 (2026-10-12)

Bug Fixes

• update to 2026e data (d11e034)

Commits

• 40cf0f2 Merge pull request #212 from evansiroky/2026e-working
• d11e034 fix: update to 2026e data
• See full diff in compare view

Updates nodemailer from 10.0.16 to 10.1.0

Release notes

Sourced from nodemailer's releases.

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

• Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.
• connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.
• Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.
• A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.
• With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.
• The envelope is pipelined (MAIL FROM, RCPT TO and DATA in one batch) when the server announces PIPELINING.
• Errors carry originalCode (the system error code Nodemailer replaced, such as ECONNREFUSED) and, for ETIMEDOUT, timeoutType.

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)
• mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
• mime-node: finish an encoded part only after its output was read (ec97d8f)
• qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
• smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
• smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
• smtp-connection: refuse a second connect() call (24ba2e0)
• turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

• encode base64 and quoted-printable without per-chunk delays (fd377bb)

Changelog

Sourced from nodemailer's changelog.

10.1.0 (2026-10-10)

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)
• mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
• mime-node: finish an encoded part only after its output was read (ec97d8f)
• qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
• smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
• smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
• smtp-connection: refuse a second connect() call (24ba2e0)
• turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

• encode base64 and quoted-printable without per-chunk delays (fd377bb)

Commits

• 0780032 chore(master): release 10.1.0 (#1890)
• 42b91d9 fix(qp): encode a lone CR or LF in binary quoted-printable parts
• b9b8c84 test(smtp-pool): fail the clear event test with the pool state instead of han...
• 4f1a34a test(smtp-connection): keep the scripted server silent after a stalled STARTTLS
• f90fb04 fix(smtp-connection): drop the connection when DATA is taken after a refused ...
• bdcd046 fix(smtp-connection): count the wait for the greeting against connectionTimeout
• 751330a test(smtp-pool): measure the rate limit against a window wider than connecting
• ec97d8f fix(mime-node): finish an encoded part only after its output was read
• 24ba2e0 fix(smtp-connection): refuse a second connect() call
• 91ed683 fix: let the proxy handshake and the SMTP connection share one deadline
• Additional commits viewable in compare view

Updates pg from 8.23.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

Commits

• 0980cef Publish
• 2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
• 7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
• 9683053 fix(pg): do not treat Sync as connection ending (#3772)
• 4589038 fix: validate server certificate against host when connecting to an IP addres...
• 9808955 cleanup: Fix typo in comment
• 2b02f64 fix: avoid mutating query config (#3720)
• 0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
• 2991480 Deprecate serializing invalid Dates (#3731)
• c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
• Additional commits viewable in compare view

Updates pino from 10.3.1 to 10.4.0

Release notes

Sourced from pino's releases.

v10.4.0

What's Changed

• Add warning on incompatible formatters.level with multi-target transports by @​lraveri in pinojs/pino#2381
• chore: use TSTyche for type testing by @​mrazauskas in pinojs/pino#2376
• Add Sentry Native Integration Docs by @​KyleTryon in pinojs/pino#2394
• docs: add flush limitation warning for pino-pretty, fix #1015 by @​mcollina in pinojs/pino#2402
• feat(browser): add redaction support by @​abhu85 in pinojs/pino#2396
• chore: lint the type declaration file by @​mrazauskas in pinojs/pino#2408
• chore: remove TSTyche config file by @​mrazauskas in pinojs/pino#2409
• docs: clarify multi-target formatter limitation by @​mcollina in pinojs/pino#2410
• No bots allowed by @​mcollina in pinojs/pino#2412
• build(deps): bump real-require from 0.2.0 to 1.0.0 by @​dependabot[bot] in pinojs/pino#2414
• build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @​dependabot[bot] in pinojs/pino#2418
• fix: use util.getCallSites when able to allow frozen intrinsics by @​CarlOlson in pinojs/pino#2294
• Update AWS Lambda reference in asynchronous docs by @​urbanautomaton in pinojs/pino#2413
• chore: update license by @​Tony133 in pinojs/pino#2375
• fix: add named default export by @​mrazauskas in pinojs/pino#2421
• Update contrib doc by @​jsumners in pinojs/pino#2424
• docs: use @​hono/structured-logger for Pino with Hono by @​brunorodmoreira in pinojs/pino#2425
• chore(deps): remove pre-commit by @​kshitijanurag in pinojs/pino#2423
• build(deps): bump actions/github-script from 8 to 9 by @​dependabot[bot] in pinojs/pino#2427
• build(deps-dev): bump eslint-plugin-promise from 6.6.0 to 7.3.0 by @​dependabot[bot] in pinojs/pino#2428
• build(deps-dev): bump tstyche from 6.2.0 to 7.1.0 by @​dependabot[bot] in pinojs/pino#2429
• test: fix flaky transport config test by @​mcollina in pinojs/pino#2434
• chore: upgrade typescript to v6.0.2 by @​Tony133 in pinojs/pino#2419
• docs: fix typo "compatability" → "compatibility" in README by @​premsreelathasugeendran in pinojs/pino#2435
• docs: warn against untrusted top-level log keys by @​mcollina in pinojs/pino#2450
• test(transport): keep event loop alive while awaiting async flush by @​YBJ0000 in pinojs/pino#2470
• docs: clarify Node.js version support policy in LTS doc by @​youdie006 in pinojs/pino#2472
• fix: honor per-target level filter on single-element targets array by @​mcollina in pinojs/pino#2432
• fix(multistream): resolve string level labels in write() by @​xianjianlf2 in pinojs/pino#2474
• fix: escape child binding keys by @​mcollina in pinojs/pino#2452
• docs: clarify stringification limits by @​mcollina in pinojs/pino#2475
• fix: add setBindings to the browser logger by @​ankit1324 in pinojs/pino#2471
• build(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in pinojs/pino#2486
• build(deps-dev): bump through2 from 4.0.2 to 5.0.10 by @​dependabot[bot] in pinojs/pino#2488
• build(deps-dev): bump bole from 5.0.29 to 6.0.7 by @​dependabot[bot] in pinojs/pino#2489
• build(deps-dev): bump eslint-plugin-n from 17.23.2 to 18.2.2 by @​dependabot[bot] in pinojs/pino#2492
• build(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @​dependabot[bot] in pinojs/pino#2485
• fix: log objects with an own proto key instead of crashing by @​spokodev in pinojs/pino#2457
• fix: build the redaction shape without Object.prototype by @​luantaraschi in pinojs/pino#2495
• ci: add Node.js 26 to test matrix by @​aquie00t in pinojs/pino#2480
• fix(multistream): fix clone add crash and missing end/remove methods by @​spellsaif in pinojs/pino#2493
• ci: check pull requests target main by @​marktran0710 in pinojs/pino#2500
• build(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 by @​dependabot[bot] in pinojs/pino#2513
• build(deps-dev): bump eslint-plugin-n from 18.2.2 to 18.3.0 by @​dependabot[bot] in pinojs/pino#2515
• Delete .github/dependabot.yml by @​jsumners in pinojs/pino#2517
• docs: document the APIs that are unavailable in the browser by @​kavish-19 in pinojs/pino#2521
• ci: pin lock-threads to upstream v6.0.2 to fix token validation failure by @​simpleqt in pinojs/pino#2525
• Add bindings() method to browser logger by @​RT1811 in pinojs/pino#2504

... (truncated)

Commits

• b29dbe9 Bumped v10.4.0
• 6ba157b docs: fix the pino-pretty flush explanation after thread-stream#198 (#2524)
• 6429c14 docs: Note that serializers run on child bindings at creation time (#2518)
• 6c71bc9 Add bindings method to browser logger (#2504)
• b557f72 ci: pin lock-threads to upstream v6.0.2 to fix token validation failure (#2525)
• 1de1212 docs: document the APIs that are unavailable in the browser (#2521)
• af2fe10 Delete .github/dependabot.yml (#2517)
• 5aa6230 build(deps-dev): bump eslint-plugin-n from 18.2.2 to 18.3.0 (#2515)
• 6f5af07 build(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 (#2513)
• 2ffe576 ci: check pull requests target main (#2500)
• Additional commits viewable in compare view

Updates uuid from 14.0.2 to 14.0.3

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

Changelog

Sourced from uuid's changelog.

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

Commits

• 993ff7b chore(main): release 14.0.3 (#982)
• f7d19b9 chore: update workflow actions (#983)
• b44f159 fix: fix CITGM #1154 (#981)
• dd8c173 chore: update deps (#975)
• See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates webdav from 5.10.0 to 5.11.0

Changelog

Sourced from webdav's changelog.

v5.11.0

2026-09-19

• #410 Clark-notation prop keys for namespace disambiguation
• Bugfixes:
  • #413 Remove node types from web builds
  • #411 Fix EntityDecoder type with correct import

Commits

• ab039cb 5.11.0
...

Description has been truncated

[dependabot]

Labels

The following labels could not be found: backend. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.