build(deps): Bump the web-nodejs-npm group across 1 directory with 12 updates by dependabot[bot] · Pull Request #486 · UNITRONIX/BetterDesk

dependabot · 2026-11-01T19:26:57Z

Bumps the web-nodejs-npm group with 12 updates in the /web-nodejs directory:

Package	From	To
axios	`1.20.0`	`1.21.0`
csrf-csrf	`3.2.2`	`4.0.3`
express	`4.22.2`	`5.3.0`
express-rate-limit	`7.5.1`	`8.7.2`
helmet	`7.2.0`	`8.3.0`
nodemailer	`10.2.1`	`10.3.1`
otplib	`12.0.1`	`13.5.0`
ws	`8.21.2`	`8.22.0`
jest	`29.7.0`	`30.5.2`
protobufjs-cli	`1.3.3`	`2.7.1`
supertest	`7.2.2`	`7.3.1`
pg	`8.22.0`	`8.23.1`

Updates axios from 1.20.0 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)

UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)

Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)

Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)

URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)

Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)

Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)

Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)

XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)

HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)

TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)

Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)

Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)

Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)

Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)

Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)

Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)

Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

@lazerg (#11194)

@QIU-Guanzong (#11228)

@Iams4kura (#11125)

@vjymisal0 (#11179)

@jarrensj (#11238)

@LineGu (#11132)

@luantaraschi (#11134)

@Cyberhet (#11284)

@nyxst4ck (#11138)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)

UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)

Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)

Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)

URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)

Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)

Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)

Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)

XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)

HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)

TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)

Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)

Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)

Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)

Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)

Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)

Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)

Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

@lazerg (#11194)

@QIU-Guanzong (#11228)

@Iams4kura (#11125)

@vjymisal0 (#11179)

@jarrensj (#11238)

@LineGu (#11132)

@luantaraschi (#11134)

@Cyberhet (#11284)

@nyxst4ck (#11138)

... (truncated)

Commits

aa54a5e docs: remove cancelled sponsors from README (#11369)
e6b79d9 chore(release): prepare release 1.21.0 (#11346)
fceeb10 chore(deps-dev): bump the development_dependencies group with 4 updates (#11342)
7d15df3 docs: refresh sponsor data (#11341)
8d8e844 docs: correct interceptor options and request lifecycle guide (#11335)
326843a test(no-proxy): cover the request-hostname path with a long dotted host (#11235)
e5195ec feat(core): expose request duration on the response (#11214)
8d415e6 fix(headers): bind matcher callbacks to the headers instance (#11216)
b16dd77 fix(xhr): remove progress event listeners on request completion (#11225)
790b2ca chore(deps): bump the github-actions group with 3 updates (#11323)
Additional commits viewable in compare view

Updates csrf-csrf from 3.2.2 to 4.0.3

Changelog

Sourced from csrf-csrf's changelog.

4.0.3 (2025-05-27)

generateCsrfToken will now always check if the existing token is valid before returning it. This validation is only derived from the request cookie, this way GET requests are not expected to include the CSRF token to ensure token reuse, this was a bug and not the intended/expected behavior.

If the CSRF token container in the request is somehow invalid when generateCsrfToken is called, this will be silently ignored and a new valid CSRF token will be generated and returned. If validateOnReuse is set to true, an error will be thrown instead.

Bug Fixes

validateOnReuse incorrectly throws (26b3dd6)

4.0.2 (2025-05-09)

Bug Fixes

broken type exports (8967de6)

4.0.1 (2025-05-08)

Bug Fixes

correctly skip CSRF token validation when validateOnReuse is false (bcaf1c3)

4.0.0 (2025-04-27)

⚠ BREAKING CHANGES

This list may not be an exhaustive list of breaking changes, for more information consult the version 3 -> 4 upgrade guide and the updated configuration documentation in the README.

Token generation now uses createHmac, the format has changed significantly, see the CSRF token format section of the upgrade guide.

getSessionIdentifier is now required and must return a unique identifier per-request (and per-session) - this is an essential part of CSRF token security

getTokenFromRequest renamed to getCsrfTokenFromRequest

generateToken renamed to generateCsrfToken

overwrite and validateOnReuse parameters for generateCsrfToken have been merged into a single object parameter which also accepts cookieOptions: generateCsrfToken(req, res, options);

Default value for validateOnReuse is now false

Default value for cookieOptions.sameSite is now strict

cookieOptions.signed is no longer available, CSRF tokens are inherently signed, this is redundant

delimiter option removed, csrfTokenDelimiter and messageDelimiter are now used for the respective purpose

signed option in cookieOptions config option removed (redundant), csrf tokens generated by csrf-csrf are inherently signed

size config option now sets the size of the message used to construct the hmac, now defaults to 32 instead of 64, this is combined with the return value of getSessionIdentifier to construct the hmac payload

Type CsrfTokenCookieOverrides renamed to CsrfTokenCookieOptions

Type CsrfTokenCreator renamed to CsrfTokenGenerator

Type doubleCsrfProtection renamed to DoubleCsrfProtection

Type RequestMethod renamed to CsrfRequestMethod

Type CsrfIgnoredMethods renamed to CsrfIgnoredRequestMethods

Features

... (truncated)

Commits

See full diff in compare view

Updates express from 4.22.2 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements
Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366
// QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});
Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167
When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903
app.render('index', null, callback); // now works as expected
Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234
res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464
Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233
res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

cf6722b 5.3.0 (#7468)
8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
9efc29e docs: fix pass-through typos (#7509)
2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
9169cbe docs: add missing apostrophe in example (#7483)
7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
98bd4cd deps: proxy-addr@^2.0.8 (#7474)
9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates express-rate-limit from 7.5.1 to 8.7.2

Release notes

Sourced from express-rate-limit's releases.

v8.7.2

You can view the changelog here.

v8.7.1

You can view the changelog here.

v8.7.0

You can view the changelog here.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

v8.5.2

You can view the changelog here.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

v8.4.1

You can view the changelog here.

v8.4.0

You can view the changelog here.

v8.3.2

You can view the changelog here.

v8.3.1

You can view the changelog here.

v8.3.0

You can view the changelog here.

v8.2.1

You can view the changelog here.

v8.2.0

You can view the changelog here.

v8.1.0

You can view the changelog here.

... (truncated)

Commits

3fa4577 8.7.2
7427a5c v8.7.2 changelog
da5b115 fix: don't un-count requests that complete after the window resets (#707)
28331a7 docs: Restore hyphenated anchor links for error codes (#705)
404bc3a docs: show how to reset the key of an IPv6 client (#704)
e0b3886 docs: fix inverted skipSuccessfulRequests and ipv6Subnet descriptions (#703)
97bc073 chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 (#702)
991c16d chore(deps): bump ip-address from 10.7.1 to 10.7.3 (#699)
a6ace2a chore(deps-dev): bump the development-dependencies group with 9 updates (#698)
518a0d5 chore(deps): bump ip-address from 10.7.0 to 10.7.1 (#696)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates helmet from 7.2.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

Content-Security-Policy: improved performance by ~7% when there are no dynamic directives

Content-Security-Policy: improved error handling for invalid directive names

Fixed

Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level

Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid

Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522

Improve error message when passing duplicate options

8.1.0 - 2025-03-17

Changed

Content-Security-Policy gives a better error when a directive value, like self, should be quoted. See #482

8.0.0 - 2024-09-28

Changed

Breaking: Strict-Transport-Security now has a max-age of 365 days, up from 180

Breaking: Content-Security-Policy middleware now throws an error if a directive should have quotes but does not, such as self instead of 'self'. See #454

Breaking: Content-Security-Policy's getDefaultDirectives now returns a deep copy. This only affects users who were mutating the result

Breaking: Strict-Transport-Security now throws an error when "includeSubDomains" option is misspelled. This was previously a warning

Removed

Breaking: Drop support for Node 16 and 17. Node 18+ is now required

Commits

75f1a98 8.3.0
f03f70d Update changelog for 8.3.0 release
a307fce Fix capitalization in CSP package changelog
5347b43 Format default CSP in README for readability
9afc570 CSP: fix middleware-specific README missing link
266c95c Minor speedups to project setups test
7a4196c CSP: update package-specific changelog
02716b4 CSP: improve performance when there are no dynamic directives
3f511ed CSP: move utility functions to separate file
80338af CSP: disabling defaults with no directives is now an error
Additional commits viewable in compare view

Updates nodemailer from 10.2.1 to 10.3.1

Release notes

Sourced from nodemailer's releases.

v10.3.1

10.3.1 (2026-10-29)

Bug Fixes

apply the otp option in MailComposer too (1d4087f)

v10.3.0

10.3.0 (2026-10-29)

Summary

This release adds support for the OTP-Token header from the IETF draft draft-goto-otp-token, which lets mail clients and browsers offer a one-time passcode for autofill on the site it belongs to. It also fixes how a Content-ID header is encoded.

Who should upgrade

Anyone sending one-time passcodes by email who wants them to be machine-readable.

Anyone already setting an OTP-Token header through headers: before this release it went out MIME encoded and could not be parsed.

Anyone embedding images with a cid that holds a non-ASCII character or a quote.

Highlights

New otp message option: otp: { code: '123456', origin: 'https://example.com' } adds OTP-Token: "123456"; origin="https://example.com". The origin is reduced to its canonical form, only https (or http on a loopback host) is accepted, and invalid values fail the send with the new EOTP error code. See Message configuration.

A custom OTP-Token header is no longer MIME word encoded. Line breaks and control characters are still removed.

OTP-Token is included in the DKIM signature by default.

A Content-ID header, from an attachment cid or set through headers, is now encoded as a message id rather than as text, so a cid with a non-ASCII character or a quote keeps matching the cid: URL in the HTML.

Groundmail added to the well-known services.

Features

add the otp option for the OTP-Token header (

… updates Bumps the web-nodejs-npm group with 12 updates in the /web-nodejs directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.20.0` | `1.21.0` | | [csrf-csrf](https://github.com/Psifi-Solutions/csrf-csrf) | `3.2.2` | `4.0.3` | | [express](https://github.com/expressjs/express) | `4.22.2` | `5.3.0` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `7.5.1` | `8.7.2` | | [helmet](https://github.com/helmetjs/helmet) | `7.2.0` | `8.3.0` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `10.2.1` | `10.3.1` | | [otplib](https://github.com/yeojz/otplib/tree/HEAD/packages/otplib) | `12.0.1` | `13.5.0` | | [ws](https://github.com/websockets/ws) | `8.21.2` | `8.22.0` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `29.7.0` | `30.5.2` | | [protobufjs-cli](https://github.com/protobufjs/protobuf.js) | `1.3.3` | `2.7.1` | | [supertest](https://github.com/ladjs/supertest) | `7.2.2` | `7.3.1` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.1` | Updates `axios` from 1.20.0 to 1.21.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.20.0...v1.21.0) Updates `csrf-csrf` from 3.2.2 to 4.0.3 - [Changelog](https://github.com/Psifi-Solutions/csrf-csrf/blob/main/CHANGELOG.md) - [Commits](https://github.com/Psifi-Solutions/csrf-csrf/commits) Updates `express` from 4.22.2 to 5.3.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v4.22.2...v5.3.0) Updates `express-rate-limit` from 7.5.1 to 8.7.2 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.7.2) Updates `helmet` from 7.2.0 to 8.3.0 - [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md) - [Commits](helmetjs/helmet@v7.2.0...v8.3.0) Updates `nodemailer` from 10.2.1 to 10.3.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v10.2.1...v10.3.1) Updates `otplib` from 12.0.1 to 13.5.0 - [Release notes](https://github.com/yeojz/otplib/releases) - [Commits](https://github.com/yeojz/otplib/commits/v13.5.0/packages/otplib) Updates `ws` from 8.21.2 to 8.22.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.2...8.22.0) Updates `jest` from 29.7.0 to 30.5.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.2/packages/jest) Updates `protobufjs-cli` from 1.3.3 to 2.7.1 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-cli-v1.3.3...protobufjs-cli-v2.7.1) Updates `supertest` from 7.2.2 to 7.3.1 - [Release notes](https://github.com/ladjs/supertest/releases) - [Commits](forwardemail/supertest@v7.2.2...v7.3.1) Updates `pg` from 8.22.0 to 8.23.1 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg) --- updated-dependencies: - dependency-name: axios dependency-version: 1.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-nodejs-npm - dependency-name: csrf-csrf dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: web-nodejs-npm - dependency-name: express dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: web-nodejs-npm - dependency-name: express-rate-limit dependency-version: 8.7.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: web-nodejs-npm - dependency-name: helmet dependency-version: 8.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: web-nodejs-npm - dependency-name: nodemailer dependency-version: 10.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-nodejs-npm - dependency-name: otplib dependency-version: 13.5.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: web-nodejs-npm - dependency-name: ws dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-nodejs-npm - dependency-name: jest dependency-version: 30.5.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: web-nodejs-npm - dependency-name: protobufjs-cli dependency-version: 2.7.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: web-nodejs-npm - dependency-name: supertest dependency-version: 7.3.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-nodejs-npm - dependency-name: pg dependency-version: 8.23.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-nodejs-npm ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 1, 2026

dependabot Bot requested a review from UNITRONIX as a code owner November 1, 2026 19:26

dependabot Bot added the javascript Pull requests that update javascript code label Nov 1, 2026

Navigation Menu

Repository navigation

build(deps): Bump the web-nodejs-npm group across 1 directory with 12 updates - #486

build(deps): Bump the web-nodejs-npm group across 1 directory with 12 updates#486
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/web-nodejs/web-nodejs-npm-270d77172e

dependabot Bot commented on behalf of github Nov 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 1, 2026

v1.21.0 — October 21, 2026

⚠️ Breaking Changes & Deprecations

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.21.0 — October 21, 2026

⚠️ Breaking Changes & Deprecations

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

4.0.3 (2025-05-27)

Bug Fixes

4.0.2 (2025-05-09)

Bug Fixes

4.0.1 (2025-05-08)

Bug Fixes

4.0.0 (2025-04-27)

⚠ BREAKING CHANGES

Features

v5.3.0

Highlights

🐞 Bug fixes

🚀 Improvements

5.3.0

🐞 Bug fixes

🚀 Improvements

v8.7.2

v8.7.1

v8.7.0

v8.6.2

v8.6.1

v8.6.0

v8.5.2

v8.5.1

v8.5.0

v8.4.1

v8.4.0

v8.3.2

v8.3.1

v8.3.0

v8.2.1

v8.2.0

v8.1.0

8.3.0 - 2026-07-11

Changed

Fixed

8.2.0 - 2026-05-21

8.1.0 - 2025-03-17

Changed

8.0.0 - 2024-09-28

Changed

Removed

v10.3.1

10.3.1 (2026-10-29)

Bug Fixes

v10.3.0

10.3.0 (2026-10-29)

Summary

Who should upgrade

Highlights

Features

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants