Skip to content

chore(deps): bump the backend-npm group across 1 directory with 11 updates - #63

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-npm-4653402183
Open

chore(deps): bump the backend-npm group across 1 directory with 11 updates#63
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-npm-4653402183

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the backend-npm group with 11 updates in the /backend directory:

Package From To
dotenv 17.4.2 18.0.9
express 5.2.1 5.3.0
express-rate-limit 8.7.0 8.7.1
mongoose 9.10.0 9.11.4
multer 2.3.0 2.5.0
redis 6.2.1 6.3.0
ws 8.21.3 8.22.0
@supabase/supabase-js 2.116.0 2.118.0
firebase-admin 14.4.0 14.5.0
eslint 8.57.1 10.13.0
prettier 3.9.6 3.9.10

Updates dotenv from 17.4.2 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

  • Permit DOTENV_PATH being empty string with the CLI (#1076)

18.0.8 (2026-10-14)

Changed

  • Fast parser should strip appended extra quotes (#1073)
  • Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

  • Treat undefined settings like quiet: true as null rather than falsey (#1070)
  • CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

  • Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

  • Fix missing typescript module declaration (#1068)
  • Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

  • import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

  • Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

  • Patch additional edge cases for the fast parser (#1056)

... (truncated)

Commits
  • 8d1ab85 18.0.9
  • 59a40ce changelog
  • 88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
  • bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
  • 6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
  • 10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
  • e2fe95e 18.0.8
  • 7aa712a type detail improvement
  • 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
  • 0b4843a changelog
  • Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits
  • c2e30b3 8.7.1
  • b40a390 v8.7.1 changelog
  • ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
  • 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
  • 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
  • 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
  • 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
  • 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
  • 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
  • 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
  • Additional commits viewable in compare view

Updates mongoose from 9.10.0 to 9.11.4

Release notes

Sourced from mongoose's releases.

9.11.4 / 2026-10-23

  • fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates
  • fix: only use own properties when looking up discriminators by key
  • fix(schema): disallow setting special properties via virtual()
  • fix(query): respect connection-level sanitizeFilter in queries
  • fix(query): disallow special properties like __proto__ as paths in where() and mod()
  • fix(deps): upgrade mquery -> 6.0.1 to avoid prototype pollution with query helpers like gt() and in()

9.11.3 / 2026-10-21

9.11.2 / 2026-10-12

9.11.1 / 2026-10-07

  • fix(document): call recursive toObject() when setting a path to a nested object #16571
  • fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS
  • fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml
  • fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai
  • fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai
  • fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny
  • fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1
  • fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1
  • types(schema): treat Int32 paths as number #16565 #16564 lazerg
  • types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

  • feat: use MongoDB Node.js driver 7.7.x #16550
  • feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar
  • fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411
  • types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519
  • docs(guide): use async/await instead of removed callbacks #16566 joi-agent
  • test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506

9.10.4 / 2026-10-02

  • fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.11.4 / 2026-10-23

  • fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates
  • fix: only use own properties when looking up discriminators by key
  • fix(schema): disallow setting special properties via virtual()
  • fix(query): respect connection-level sanitizeFilter in queries
  • fix(query): disallow special properties like __proto__ as paths in where() and mod()
  • fix(deps): upgrade mquery -> 6.0.1 to avoid prototype pollution with query helpers like gt() and in()

9.11.3 / 2026-10-21

8.24.6 / 2026-10-20

9.11.2 / 2026-10-12

9.11.1 / 2026-10-07

  • fix(document): call recursive toObject() when setting a path to a nested object #16571
  • fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS
  • fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml
  • fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai
  • fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai
  • fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny
  • fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1
  • fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1
  • types(schema): treat Int32 paths as number #16565 #16564 lazerg
  • types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

  • feat: use MongoDB Node.js driver 7.7.x #16550
  • feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar

... (truncated)

Commits
  • 8d8b50f chore: release 9.11.4
  • 1a95578 chore: bump mquery -> 6.0.1
  • e339a2a Merge branch 'vkarpov15/20261022/master/security'
  • 12058e0 Merge branch 'vkarpov15/20261016/master/security'
  • b68f907 fix: only use own properties when looking up discriminators by key
  • e681842 fix: skip inherited properties in setDottedPath - not user facing but still g...
  • 2a195d1 fix: avoid setting values underneath inherited properties when constructing n...
  • fc01d2f fix: avoid overriding built-in properties when copying conditions and avoid p...
  • 74df776 fix: disallow setting special properties via virtual()
  • 4bb6594 fix(query): respect connection-level sanitizeFilter in queries
  • Additional commits viewable in compare view

Updates multer from 2.3.0 to 2.5.0

Release notes

Sourced from multer's releases.

v2.5.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/multer@v2.4.0...v2.5.0

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

... (truncated)

Changelog

Sourced from multer's changelog.

2.5.0

  • Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
  • Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#1481)
  • Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#1489)

2.4.0

  • Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
  • Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
  • Accept a function for limits, called with the request, to set limits per request (#1133)
  • Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
  • Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
  • Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
  • Allow multer.diskStorage() to be called without options (#1471)
  • Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
  • Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
  • Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
  • Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
  • Files skipped by fileFilter no longer count towards maxCount (#1426)
  • Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
  • Remove the concat-stream dependency (#1356)
  • Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
  • Docs: add FormData upload examples (#896)
  • Docs: remove the translated READMEs (#1463)
  • Internal: run the test suite on macOS (#1464)
Commits
  • 2c380d0 2.5.0 (#1490)
  • 80a2d9d fix: swallow late busboy error after teardown
  • c901d48 chore(deps): bump github/codeql-action/analyze to 4.38.2 (#1486)
  • ba3619a chore(deps): bump github/codeql-action/upload-sarif (#1487)
  • 0b72081 chore(deps): bump github/codeql-action/init to 4.38.2 (#1488)
  • 7661ce7 fix: allow a field value exactly at the fieldSize limit (#1481)
  • 6dac92f fix: don't add a failed upload to the abort cleanup list (#1489)
  • dd9f062 docs: fix typo in .none() and grammar in .any() (#1485)
  • 35979e5 2.4.0 (#1469)
  • b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
  • Additional commits viewable in compare view

Updates redis from 6.2.1 to 6.3.0

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for redis since your current version.


Updates ws from 8.21.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

  • Introduced the protocols option (8b918b01).

Bug fixes

  • Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).
Commits
  • 297202c [dist] 8.22.0
  • 8b918b0 [feature] Introduce the protocols option
  • 73e03eb [ci] Update actions/setup-node action to v7
  • d9b8954 [fix] Change the ready state after validating the arguments (#2337)
  • See full diff in compare view

Updates @supabase/supabase-js from 2.116.0 to 2.118.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)
  • storage: add content-encoding support for uploads (#1949)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Atharv Gaur @​Athaxv
  • Ferhat Elmas
  • Lukas Klingsbo

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Lukas Klingsbo

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

  • deps: bump next to patch RCE in realtime-js example (#2733)
  • functions: send a Blob or File with its own content type (#2714)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

❤️ Thank You

  • Lukas Klingsbo

2.117.3 (2026-10-07)

🩹 Fixes

  • storage: send multipart fields before files (#2736)

❤️ Thank You

2.117.2 (2026-09-25)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.117.1 (2026-09-23)

🩹 Fixes

  • auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

2.117.0 (2026-09-22)

🚀 Features

  • auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

  • fadymak
Commits
  • b9753a1 feat(postgrest): leave computed fields out of select('*') and resolve no-argu...
  • 88faa11 fix(ci): patch next and sharp advisories and pin node-browser playwright (#2753)
  • aac9d32 chore(release): version 2.117.3 changelogs (#2744)
  • 4d23055 fix(storage): send multipart fields before files (#2736)
  • a684cf9 chore(release): version 2.117.2 changelogs (#2707)
  • 54c225d chore(release): version 2.117.1 changelogs (#2700)
  • 739b351 fix(auth): return stored session when a refresh loses to another tab (#2698)
  • f34d428 chore(release): version 2.117.0 changelogs (#2697)
  • cc45ccf feat(auth): enable passkey API by default and deprecate experimental passkey ...
  • c511286 docs(realtime): document relationship of accessToken() and heartbeat (#2680)
  • Additional commits viewable in compare view

Updates firebase-admin from 14.4.0 to 14.5.0

Release notes

Sourced from firebase-admin's releases.

...

Description has been truncated

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying codehub with  Cloudflare Pages  Cloudflare Pages

Latest commit: 12a5dfa
Status: ✅  Deploy successful!
Preview URL: https://8eccb231.codehub-1fr.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-back-jak9.codehub-1fr.pages.dev

View logs

@vercel

vercel Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
code-hub Ready Ready Preview Oct 26, 2026 7:08pm UTC

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/backend/backend-npm-4653402183 branch from 946f56b to 3fc9302 Compare October 19, 2026 19:08
@dependabot
chore(deps): bump the backend-npm group across 1 directory with 11 up…
12a5dfa 
…dates

Bumps the backend-npm group with 11 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [dotenv](https://github.com/motdotla/dotenv) | `17.4.2` | `18.0.9` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.7.0` | `8.7.1` |
| [mongoose](https://github.com/Automattic/mongoose) | `9.10.0` | `9.11.4` |
| [multer](https://github.com/expressjs/multer) | `2.3.0` | `2.5.0` |
| [redis](https://github.com/redis/node-redis) | `6.2.1` | `6.3.0` |
| [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.116.0` | `2.118.0` |
| [firebase-admin](https://github.com/firebase/firebase-admin-node) | `14.4.0` | `14.5.0` |
| [eslint](https://github.com/eslint/eslint) | `8.57.1` | `10.13.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.10` |



Updates `dotenv` from 17.4.2 to 18.0.9
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v17.4.2...v18.0.9)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `express-rate-limit` from 8.7.0 to 8.7.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.7.0...v8.7.1)

Updates `mongoose` from 9.10.0 to 9.11.4
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@9.10.0...9.11.4)

Updates `multer` from 2.3.0 to 2.5.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.3.0...v2.5.0)

Updates `redis` from 6.2.1 to 6.3.0
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@6.2.1...redis@6.3.0)

Updates `ws` from 8.21.3 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.3...8.22.0)

Updates `@supabase/supabase-js` from 2.116.0 to 2.118.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.118.0/packages/core/supabase-js)

Updates `firebase-admin` from 14.4.0 to 14.5.0
- [Release notes](https://github.com/firebase/firebase-admin-node/releases)
- [Changelog](https://github.com/firebase/firebase-admin-node/blob/main/CHANGELOG.md)
- [Commits](firebase/firebase-admin-node@v14.4.0...v14.5.0)

Updates `eslint` from 8.57.1 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v8.57.1...v10.13.0)

Updates `prettier` from 3.9.6 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.6...3.9.10)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.117.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-npm
- dependency-name: dotenv
  dependency-version: 18.0.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: eslint
  dependency-version: 10.12.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: backend-npm
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-npm
- dependency-name: express-rate-limit
  dependency-version: 8.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-npm
- dependency-name: firebase-admin
  dependency-version: 14.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-npm
- dependency-name: mongoose
  dependency-version: 9.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-npm
- dependency-name: multer
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-npm
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-npm
- dependency-name: redis
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-npm
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/backend/backend-npm-4653402183 branch from 3fc9302 to 12a5dfa Compare October 26, 2026 19:08

This branch was successfully deployed

1 active deployment
Preview — 12a5dfa1 Deployed Oct 26, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants