Skip to content

chore: bump qs, @kubernetes/client-node and express in /components/centraldashboard-angular/backend - #447

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/components/centraldashboard-angular/backend/multi-18639ed6f9
Closed

chore: bump qs, @kubernetes/client-node and express in /components/centraldashboard-angular/backend#447
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/components/centraldashboard-angular/backend/multi-18639ed6f9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor

Bumps qs to 6.16.0 and updates ancestor dependencies qs, @kubernetes/client-node and express. These dependencies need to be updated together.

Updates qs from 6.15.3 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

  • [New] stringify: add a depth option to bound recursion depth (default Infinity)
  • [Fix] stringify: serialize Date values when a filter is provided
  • [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
  • [Fix] parse: flatten a collection appended to an overflowed array (#571)
  • [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
  • [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
  • [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
  • [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
  • [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
  • [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
  • [Dev Deps] update @ljharb/eslint-config, eslint
  • [Dev Deps] update eslint, evalmd
Commits
  • bb9379e v6.16.0
  • 62fd254 [Fix] stringify: serialize Date values when a filter is provided
  • 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
  • 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
  • d56f48c [Fix] parse: flatten a collection appended to an overflowed array
  • e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
  • 9a76af2 [Dev Deps] update eslint, evalmd
  • 3a890d4 [Dev Deps] update eslint, evalmd
  • b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
  • Additional commits viewable in compare view

Updates @kubernetes/client-node from 0.8.2 to 2.0.0

Release notes

Sourced from @​kubernetes/client-node's releases.

Release 2.0.0

Breaking Changes

  • HTTP backend migrated from node-fetch to undici. undici is now the underlying fetch implementation. The node-fetch dependency has been removed. Code relying on node-fetch-specific Agent/request internals or proxy wiring may need updates; the client now configures an undici Dispatcher instead of a node-fetch agent. (#2306)
  • Dropped Node.js 18 support. Node 18 removed from the test matrix (EOL Apr 30, 2025). (#2815)
  • Dropped Node.js 20 support. (#2840)
  • Dropped Node.js 23 support. (#2840)
  • socks-proxy-agent upgraded 8.x → 10.x and socks added as a direct dependency for the undici SOCKS proxy path. (#2820, #2802)
  • undici pinned to ^8.0.0. (#2821)

Features

  • Add SOCKS proxy support on the undici dispatcher path via a SocksClient connector. (#2802)
  • Add support for OIDC custom CA certificates via idp-certificate-authority and idp-certificate-authority-data. (#2761)
  • Allow port forwarding to a Deployment or Service (previously Pod-only). (#2749)
  • Introduce Node.js 26 support / testing. (#2848)
  • Generated against Kubernetes API release-1.36 (updated from release-1.34 via release-1.35 and release-1.36). (#2732, #2734, #2945)

Fixes

  • informer: treat TimeoutError as reconnectable, normalize timeout errors, and add exponential backoff on reconnect. (#2813)
  • Fix custom fetch implementation to use the Node.js https module instead of the dispatcher. (#2761)
  • Fix ArrayBuffer slice to return only the relevant portion of the buffer. (#2761)
  • Fix timeoutSignal being lost after being overridden with controller.signal. (#2665)
  • Fix cp from a Pod being broken. (#2664)
  • Fix Knative Service YAML parsing by checking API groups. (#2688)
  • Don't cast undefined expiration times in exec auth. (#2666)
  • Add a File polyfill for Node.js compatibility with undici (interim, prior to dropping older Node versions). (#2815)

Tooling / Internal

  • Migrated the full test suite from nock to the undici MockAgent; nock dependency removed. (#2813, #2306)
  • TypeScript upgraded to 6.x; ESLint upgraded to 10.x; typescript-eslint to 8.6x. (#2807, #2765, #2885)
  • Pinned all GitHub Actions to SHAs and added the zizmor security linter; resolved template-injection and permission-scoping findings. (#2814)
  • Enabled npm trusted publishing. (#2726)
  • Numerous dependency bumps (undici, ws, openid-client, js-yaml, form-data, jsonpath-plus, @​types/node, and dev tooling). Notes:
  • #2815 covers both the Node 18 drop and the File polyfill (same branch).
  • #2840 covers both Node 20 and Node 23 drops.
  • #2761 covers three entries (OIDC custom CA + the https fetch fix + the ArrayBuffer slice fix).
  • #2813 covers the informer reconnect fix and the nock→MockAgent migration.

... (truncated)

Commits
  • f72cc23 Merge pull request #3006 from davidgamero/release-2.0.0
  • 07c47b0 chore: update version from 2.0.0-rc.1 to 2.0.0 in package-lock.json
  • 0675448 release package bump
  • f48ae2b Merge pull request #3002 from kubernetes-client/dependabot/npm_and_yarn/main/...
  • 9d1d12c Merge pull request #2997 from kubernetes-client/dependabot/npm_and_yarn/main/...
  • 14423f7 Merge pull request #2996 from kubernetes-client/dependabot/npm_and_yarn/main/...
  • 0af9449 build(deps): bump undici from 8.9.0 to 8.10.0
  • 7b5e8b1 build(deps): bump ws from 8.21.1 to 8.21.2
  • fb5764d build(deps-dev): bump tsx from 4.23.5 to 4.23.7
  • 637ba96 Merge pull request #3004 from kubernetes-client/ci/fix-zimor
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​kubernetes/client-node since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates express from 4.22.2 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

5.0.1 / 2024-10-08

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore: bump qs, @kubernetes/client-node and express
caf27a7 
Bumps [qs](https://github.com/ljharb/qs) to 6.16.0 and updates ancestor dependencies [qs](https://github.com/ljharb/qs), [@kubernetes/client-node](https://github.com/kubernetes-client/javascript) and [express](https://github.com/expressjs/express). These dependencies need to be updated together.


Updates `qs` from 6.15.3 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.3...v6.16.0)

Updates `@kubernetes/client-node` from 0.8.2 to 2.0.0
- [Release notes](https://github.com/kubernetes-client/javascript/releases)
- [Commits](kubernetes-client/javascript@0.8.2...2.0.0)

Updates `express` from 4.22.2 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v4.22.2...v5.2.1)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: indirect
- dependency-name: "@kubernetes/client-node"
  dependency-version: 2.0.0
  dependency-type: direct:production
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 3, 2026
@google-oss-prow

google-oss-prow Bot commented Sep 3, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andyatmiami for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@google-oss-prow google-oss-prow Bot added area/dashboard-angular area - related to central dashboard angular size/XXL labels Sep 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@juliusvonkohout
juliusvonkohout deleted the dependabot/npm_and_yarn/components/centraldashboard-angular/backend/multi-18639ed6f9 branch September 4, 2026 07:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@juliusvonkohout juliusvonkohout Awaiting requested review from juliusvonkohout
@thesuperzapper thesuperzapper Awaiting requested review from thesuperzapper

Assignees

No one assigned

Labels

area/dashboard-angular area - related to central dashboard angular dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code size/XXL

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@juliusvonkohout