chore(deps): bump the npm-dependencies group across 1 directory with 22 updates by dependabot[bot] · Pull Request #533 · FilOzone/dealbot

dependabot · 2026-05-13T01:55:46Z

Bumps the npm-dependencies group with 22 updates in the /apps/backend directory:

Package	From	To
@clickhouse/client	`1.18.2`	`1.18.4`
@ipld/car	`5.4.2`	`5.4.4`
@ipld/dag-pb	`4.1.5`	`4.1.6`
@nestjs/common	`11.1.13`	`11.1.19`
@nestjs/config	`4.0.3`	`4.0.4`
@nestjs/core	`11.1.13`	`11.1.19`
@nestjs/platform-express	`11.1.13`	`11.1.19`
@nestjs/schedule	`6.1.1`	`6.1.3`
@nestjs/swagger	`11.2.6`	`11.4.2`
@nestjs/typeorm	`11.0.0`	`11.0.1`
@willsoto/nestjs-prometheus	`6.0.2`	`6.1.0`
axios	`1.13.5`	`1.16.0`
class-validator	`0.14.3`	`0.15.1`
joi	`18.0.2`	`18.2.1`
pg	`8.18.0`	`8.20.0`
pg-boss	`12.11.1`	`12.18.2`
typeorm	`0.3.28`	`0.3.29`
@nestjs/cli	`11.0.16`	`11.0.21`
@nestjs/schematics	`11.0.9`	`11.1.0`
@nestjs/testing	`11.1.13`	`11.1.19`
@types/node	`25.2.3`	`25.6.2`
ts-loader	`9.5.4`	`9.5.7`

Updates @clickhouse/client from 1.18.2 to 1.18.4

Changelog

Sourced from @clickhouse/client's changelog.

1.18.4

A release-infrastructure-only version bump (no user-facing changes). See 1.18.5 for the next release with user-facing improvements.

1.18.3

Improvements

Added keep_alive.eagerly_destroy_stale_sockets option (Node.js only, default: false). When enabled, sockets that have been idle for longer than idle_socket_ttl are destroyed immediately before each request, rather than waiting for the idle timeout to fire. This helps reclaim stale sockets during event loop delays, where the timeout callback may not run on time.
const client = createClient({
  keep_alive: {
    enabled: true,
    idle_socket_ttl: 2500,
    eagerly_destroy_stale_sockets: true,
  },
})
Added auto-detection and warning when request_timeout is high (> 60 seconds) but progress headers are not configured. Long-running queries may fail with socket hang-up errors if they exceed the load balancer idle timeout. The client now warns users to enable send_progress_in_http_headers and http_headers_progress_interval_ms settings to prevent such issues.
// This will now trigger a warning
const client = createClient({
  request_timeout: 120_000, // 120 seconds
  // send_progress_in_http_headers is not configured
})
// ✓ Properly configured to avoid load balancer timeouts
const client = createClient({
request_timeout: 400_000,
clickhouse_settings: {
send_progress_in_http_headers: 1,
http_headers_progress_interval_ms: '110000', // ~10s below LB timeout
},
})

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @clickhouse/client since your current version.

Updates @ipld/car from 5.4.2 to 5.4.4

Release notes

Sourced from @ipld/car's releases.

v5.4.4

5.4.4 (2026-05-07)

Dependencies

dev: bump aegir from 47.2.0 to 48.0.1 (#179) (a3dca47)

v5.4.3

5.4.3 (2026-04-02)

Trivial Changes

deps: bump multiformats from 12.1.3 to 13.4.2 in /examples (#176) (2c87540)

Dependencies

bump cborg from 4.5.8 to 5.0.0 (#178) (40ddb9c)

Changelog

Sourced from @ipld/car's changelog.

5.4.4 (2026-05-07)

Dependencies

dev: bump aegir from 47.2.0 to 48.0.1 (#179) (a3dca47)

5.4.3 (2026-04-02)

Trivial Changes

deps: bump multiformats from 12.1.3 to 13.4.2 in /examples (#176) (2c87540)

Dependencies

bump cborg from 4.5.8 to 5.0.0 (#178) (40ddb9c)

Commits

ed69005 chore(release): 5.4.4 [skip ci]
a3dca47 deps(dev): bump aegir from 47.2.0 to 48.0.1 (#179)
13d6e56 chore(release): 5.4.3 [skip ci]
40ddb9c deps: bump cborg from 4.5.8 to 5.0.0 (#178)
2c87540 chore(deps): bump multiformats from 12.1.3 to 13.4.2 in /examples (#176)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @ipld/car since your current version.

Updates @ipld/dag-pb from 4.1.5 to 4.1.6

Release notes

Sourced from @ipld/dag-pb's releases.

v4.1.6

4.1.6 (2026-05-07)

Dependencies

dev: bump aegir from 47.2.0 to 48.0.1 (#108) (d573d19)

Changelog

Sourced from @ipld/dag-pb's changelog.

4.1.6 (2026-05-07)

Dependencies

dev: bump aegir from 47.2.0 to 48.0.1 (#108) (d573d19)

Commits

a13ed0c chore(release): 4.1.6 [skip ci]
d573d19 deps(dev): bump aegir from 47.2.0 to 48.0.1 (#108)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @ipld/dag-pb since your current version.

Updates @nestjs/common from 11.1.13 to 11.1.19

Release notes

Sourced from @nestjs/common's releases.

v11.1.19 (2026-04-13)

Bug fixes

microservices

#16762 fix(microservices): use backing field for consumer CRASH event listener (@burhanharoon)

#16764 fix(microservices): prevent stack overflow in jsonsocket.handledata() (@kamilmysliwiec)

Committers: 2

Burhan Haroon⚡ (@burhanharoon)

Kamil Mysliwiec (@kamilmysliwiec)

v11.1.18 (2026-04-03)

Bug fixes

microservices

#16675 fix(microservices): preserve packet headers in nats serializer (@wwenrr)

core

#16683 fix(core): prevent injector hang when design:paramtypes is missing (@Youmoo)

#16637 fix(core): dependency injection edge case with moduleref.create (@JakobStaudinger)

nestjs/nest#16686 fix(core): sanitize sse message

Dependencies

core, platform-express, platform-fastify

#16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@renovate[bot])

platform-fastify

#16623 fix(deps): update dependency fastify to v5.8.4 (@renovate[bot])

platform-ws

#16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@dependabot[bot])

common

#16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@dependabot[bot])

Committers: 6

Ankit San (@ankitbelal)

Jakob Staudinger (@JakobStaudinger)

Kamil Mysliwiec (@kamilmysliwiec)

Krishna Chaitanya (@Krishnachaitanyakc)

MK (@wwenrr)

youmoo (@Youmoo)

v11.1.17 (2026-03-16)

Enhancements

microservices

#16218 feat(microservices): add redis driver identification (@vchomakov)

Bugs

platform-fastify

auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) nestjs/nest@cbdf737 (@kamilmysliwiec)

... (truncated)

Commits

6730995 chore(release): publish v11.1.19 release
3c1cc5f chore(release): publish v11.1.18 release
a39e345 refactor(common): change console logger helpers to protected
34f0f28 chore(deps): bump file-type from 21.3.3 to 21.3.4
0e96b0a chore(deps): bump file-type from 21.3.2 to 21.3.3
5a05f52 chore: update readme
447a373 chore(release): publish v11.1.17 release
99ed6e6 fix(deps): update dependency file-type to v21.3.2
268a283 fix(deps): update dependency file-type to v21.3.1
315e698 chore(release): publish v11.1.16 release
Additional commits viewable in compare view

Updates @nestjs/config from 4.0.3 to 4.0.4

Release notes

Sourced from @nestjs/config's releases.

Release 4.0.4

fix(deps): update dependency dotenv to v17.4.1 (6bc5737)

fix(deps): update dependency lodash to v4.18.1 [security] (f31ee98)

Commits

3b5d592 chore(): release v4.0.4
4fbcb03 Merge pull request #2263 from nestjs/renovate/dotenv-17.x
33dae89 Merge pull request #2269 from nestjs/renovate/cimg-node-24.x
0a727c3 Merge pull request #2313 from nestjs/renovate/npm-lodash-vulnerability
6bc5737 fix(deps): update dependency dotenv to v17.4.1
f31ee98 fix(deps): update dependency lodash to v4.18.1 [security]
059314c chore(deps): update dependency typescript-eslint to v8.58.1 (#2315)
0f81e2d chore(deps): update dependency eslint to v10.2.0 (#2314)
e673ab2 chore(deps): update dependency @types/node to v24.12.2 (#2311)
b1ede30 chore(deps): update nest monorepo to v11.1.18 (#2312)
Additional commits viewable in compare view

Updates @nestjs/core from 11.1.13 to 11.1.19

Release notes

Sourced from @nestjs/core's releases.

v11.1.19 (2026-04-13)

Bug fixes

microservices

#16762 fix(microservices): use backing field for consumer CRASH event listener (@burhanharoon)

#16764 fix(microservices): prevent stack overflow in jsonsocket.handledata() (@kamilmysliwiec)

Committers: 2

Burhan Haroon⚡ (@burhanharoon)

Kamil Mysliwiec (@kamilmysliwiec)

v11.1.18 (2026-04-03)

Bug fixes

microservices

#16675 fix(microservices): preserve packet headers in nats serializer (@wwenrr)

core

#16683 fix(core): prevent injector hang when design:paramtypes is missing (@Youmoo)

#16637 fix(core): dependency injection edge case with moduleref.create (@JakobStaudinger)

nestjs/nest#16686 fix(core): sanitize sse message

Dependencies

core, platform-express, platform-fastify

#16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@renovate[bot])

platform-fastify

#16623 fix(deps): update dependency fastify to v5.8.4 (@renovate[bot])

platform-ws

#16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@dependabot[bot])

common

#16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@dependabot[bot])

Committers: 6

Ankit San (@ankitbelal)

Jakob Staudinger (@JakobStaudinger)

Kamil Mysliwiec (@kamilmysliwiec)

Krishna Chaitanya (@Krishnachaitanyakc)

MK (@wwenrr)

youmoo (@Youmoo)

v11.1.17 (2026-03-16)

Enhancements

microservices

#16218 feat(microservices): add redis driver identification (@vchomakov)

Bugs

platform-fastify

auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) nestjs/nest@cbdf737 (@kamilmysliwiec)

... (truncated)

Commits

6730995 chore(release): publish v11.1.19 release
3c1cc5f chore(release): publish v11.1.18 release
0f962c7 fix(core): sanitize sse message
94aa424 Merge pull request #16679 from nestjs/renovate/path-to-regexp-8.x
368691c fix(core): prevent injector hang when design:paramtypes is missing
25d4fde fix(deps): update dependency path-to-regexp to v8.4.2
5c0b11e fix(deps): update dependency path-to-regexp to v8.4.1
f7d4460 Merge pull request #16637 from JakobStaudinger/moduleref-create-transient-sco...
d0a9dc9 fix(deps): update dependency path-to-regexp to v8.4.0
4677434 feat(core): export IEntryNestModule type
Additional commits viewable in compare view

Updates @nestjs/platform-express from 11.1.13 to 11.1.19

Release notes

Sourced from @nestjs/platform-express's releases.

v11.1.19 (2026-04-13)

Bug fixes

microservices

#16762 fix(microservices): use backing field for consumer CRASH event listener (@burhanharoon)

#16764 fix(microservices): prevent stack overflow in jsonsocket.handledata() (@kamilmysliwiec)

Committers: 2

Burhan Haroon⚡ (@burhanharoon)

Kamil Mysliwiec (@kamilmysliwiec)

v11.1.18 (2026-04-03)

Bug fixes

microservices

#16675 fix(microservices): preserve packet headers in nats serializer (@wwenrr)

core

#16683 fix(core): prevent injector hang when design:paramtypes is missing (@Youmoo)

#16637 fix(core): dependency injection edge case with moduleref.create (@JakobStaudinger)

nestjs/nest#16686 fix(core): sanitize sse message

Dependencies

core, platform-express, platform-fastify

#16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@renovate[bot])

platform-fastify

#16623 fix(deps): update dependency fastify to v5.8.4 (@renovate[bot])

platform-ws

#16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@dependabot[bot])

common

#16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@dependabot[bot])

Committers: 6

Ankit San (@ankitbelal)

Jakob Staudinger (@JakobStaudinger)

Kamil Mysliwiec (@kamilmysliwiec)

Krishna Chaitanya (@Krishnachaitanyakc)

MK (@wwenrr)

youmoo (@Youmoo)

v11.1.17 (2026-03-16)

Enhancements

microservices

#16218 feat(microservices): add redis driver identification (@vchomakov)

Bugs

platform-fastify

auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) nestjs/nest@cbdf737 (@kamilmysliwiec)

... (truncated)

Commits

6730995 chore(release): publish v11.1.19 release
3c1cc5f chore(release): publish v11.1.18 release
0ca5440 Merge pull request #16627 from ankitbelal/refactor/centralize-headers-and-par...
25d4fde fix(deps): update dependency path-to-regexp to v8.4.2
5c0b11e fix(deps): update dependency path-to-regexp to v8.4.1
d0a9dc9 fix(deps): update dependency path-to-regexp to v8.4.0
1a14884 refactor(core): centralize headers for streamable file responses
5a05f52 chore: update readme
447a373 chore(release): publish v11.1.17 release
315e698 chore(release): publish v11.1.16 release
Additional commits viewable in compare view

Updates @nestjs/schedule from 6.1.1 to 6.1.3

Release notes

Sourced from @nestjs/schedule's releases.

6.1.3

What's Changed

feat(cron): add initialDelay option to defer first job execution by @kyungseopk1m in nestjs/schedule#2251

Full Changelog: nestjs/schedule@6.1.2...6.1.3

Release 6.1.2

Merge pull request #2247 from kyungseopk1m/feat/cron-initial-delay (a57ce2c)

chore(deps): update dependency prettier to v3.8.3 (#2248) (bb3490d)

feat(cron): add initialDelay option to defer first job execution (1c5677f)

Merge pull request #2245 from nestjs/renovate/nest-monorepo (59046bd)

Merge pull request #2246 from nestjs/renovate/oxlint-monorepo (be4eee3)

chore(deps): update dependency oxlint to v1.60.0 (32a9ce2)

chore(deps): update nest monorepo to v11.1.19 (7d3844f)

chore: migrate to oxlint, vitest, ts6 (29de71b)

chore(deps): update dependency globals to v17.5.0 (#2244) (6c62cca)

chore(deps): update dependency sinon to v21.1.2 (#2243) (ee3b31a)

chore(deps): update dependency sinon to v21.1.1 (#2241) (eba9799)

Merge pull request #2242 from nestjs/renovate/prettier-3.x (c3ad0f7)

chore(deps): update dependency prettier to v3.8.2 (798e2a9)

Merge pull request #2199 from nestjs/renovate/cimg-node-24.x (a05354a)

chore(deps): update dependency typescript-eslint to v8.58.1 (#2240) (0367ac1)

chore(deps): update dependency eslint to v10.2.0 (#2239) (fa93e06)

chore(deps): update nest monorepo to v11.1.18 (#2238) (8cd4c02)

chore(deps): update dependency @types/node to v24.12.2 (#2237) (01482df)

chore(deps): update dependency @types/sinon to v21.0.1 (#2236) (f05b5bd)

chore(deps): update dependency ts-jest to v29.4.9 (#2235) (af545e6)

chore(deps): update dependency typescript-eslint to v8.58.0 (#2233) (4dad22a)

chore(deps): update node.js to v24.14.1 (28db9bc)

chore(deps): update dependency eslint to v10.1.0 (#2232) (413f390)

chore(deps): update nest monorepo to v11.1.17 (#2230) (46c2bc5)

chore(deps): update dependency typescript-eslint to v8.57.1 (#2231) (8fd063b)

chore(deps): update dependency sinon to v21.0.3 (#2229) (1671ad9)

chore(deps): update commitlint monorepo to v20.5.0 (#2228) (2ecd2f1)

chore(deps): update dependency lint-staged to v16.4.0 (#2227) (aa0de01)

chore(deps): update commitlint monorepo to v20.4.4 (#2226) (75034fe)

chore(deps): update dependency lint-staged to v16.3.3 (#2225) (f1c7d31)

chore(deps): update dependency jest to v30.3.0 (#2224) (1a208d4)

chore(deps): update dependency typescript-eslint to v8.57.0 (#2223) (60dd2c9)

chore(deps): update dependency eslint to v10.0.3 (#2221) (791b6ba)

chore(deps): update dependency @eslint/eslintrc to v3.3.5 (#2220) (0da1ca7)

chore(deps): update dependency @types/node to v24.12.0 (#2219) (934a93e)

chore(deps): update nest monorepo to v11.1.16 (#2218) (5f44e9b)

chore(deps): update dependency sinon to v21.0.2 (#2217) (b807746)

chore(deps): update dependency lint-staged to v16.3.2 (#2216) (4ca32bd)

chore(deps): update commitlint monorepo to v20.4.3 (#2215) (d3ceb76)

chore(deps): update nest monorepo to v11.1.15 (#2214) (b084ffc)

chore(deps): update dependency lint-staged to v16.3.1 (#2213) (8a201b2)

chore(deps): update dependency globals to v17.4.0 (#2212) (6f61793)

chore(deps): update dependency lint-staged to v16.3.0 (#2211) (aa9213a)

... (truncated)

Commits

059f196 Merge pull request #2249 from nestjs/renovate/release-it-20.x
557730e Merge pull request #2251 from kyungseopk1m/feat/cron-initial-delay-v2
14f5b80 feat(cron): add initialDelay option to defer first job execution
536367d chore(deps): update dependency release-it to v20
57e2861 Merge pull request #2250 from nestjs/revert-2247-feat/cron-initial-delay
e08f457 Revert "feat(cron): add initialDelay option to defer first job execution"
3198abe chore(): release v6.1.2
a57ce2c Merge pull request #2247 from kyungseopk1m/feat/cron-initial-delay
bb3490d chore(deps): update dependency prettier to v3.8.3 (#2248)
1c5677f feat(cron): add initialDelay option to defer first job execution
Additional commits viewable in compare view

Updates @nestjs/swagger from 11.2.6 to 11.4.2

Release notes

Sourced from @nestjs/swagger's releases.

Release 11.4.2

11.4.2 (2026-04-27)

Bug fixes

#3867 fix(plugin): keep auto-inferred default response when only error Api*Response decorators are present (@PeterTheOne)

#3876 fix(plugin): handle IsIn enum inference when type falls back to Object (@y-hsgw)

Committers: 2

Peter Grassberger (@PeterTheOne)

Yukihiro Hasegawa (@y-hsgw)

Release 11.4.1

11.4.1 (2026-04-22)

Bug fixes

#3871 fix(plugin): avoid duplicate keys when auto-generating @ApiOperation (@yogeshwaran-c)

Committers: 1

Yogeshwaran C (@yogeshwaran-c)

Release 11.4.0

11.4.0 (2026-04-22)

Features

#3868 feat(plugin): auto-mark optional @Query parameters as required: false (@yogeshwaran-c)

#3725 feat(swagger): add OpenAPI 3.2 hierarchical tags support (@apt-bh)

Bug fixes

#3874 fix(document-builder): accept multi-digit OpenAPI version segments (@yogeshwaran-c)

#3873 fix(plugin): strip regex delimiters and flags from @Matches patterns (@yogeshwaran-c)

#3870 fix(decorators): forward all OpenAPI parameter fields in @ApiHeader (@yogeshwaran-c)

#3872 fix(plugin): emit @throws descriptions as proper string literals (@yogeshwaran-c)

#3782 fix(schema): preserve example metadata for non-body params with named types (@maruthang)

#3761 fix(plugin): support boolean literal types and boolean enum values (@lucreiss)

Enhancements

#3865 feat(schema-object-factory): include class name chain in circular dependency errors (@yogeshwaran-c)

Committers: 4

Lu R A (@lucreiss)

Maruthan G (@maruthang)

Yogeshwaran C (@yogeshwaran-c)

@apt-bh

Release 11.3.2

What's Changed

fix(plugin): remap import paths within rootDir to outDir by @alex-all3dp in nestjs/swagger#3858

New Contributors

@alex-all3dp made their first contribution in nestjs/swagger#3858

... (truncated)

Commits

3f58449 chore(): release v11.4.2
b0a35f3 Merge pull request #3867 from PeterTheOne/fix-error-only-response-decorators-...
f01f6aa refactor(plugin): make isSuccessOrRedirectApiResponseArg a private method
7999f78 test: inspect @ApiResponse status arg and extend fixture with redirect/500 cases
977a139 fix(plugin): keep auto-inferred default response when only error Api*Response...
a51cf09 Merge pull request #3876 from y-hsgw/fix/plugin-string-literal-union-type
a8acf7a chore(deps): update dependency @commitlint/cli to v20.5.2 (#3878)
e054058 chore(deps): update dependency release-it to v20.0.1 (#3877)
9a3745b fix(plugin): enhance enum handling for literal union types in schema generation
6e1bb8f Merge pull request #3875 from nestjs/renovate/vite-8.x-lockfile
Additional commits viewable in compare view

Updates @nestjs/typeorm from 11.0.0 to 11.0.1

Release notes

Sourced from @nestjs/typeorm's releases.

Release 11.0.1

What's Changed

feat: support v1 of TypeORM by @naorpeled in nestjs/typeorm#2562

New Contributors

@naorpeled made their first contribution in nestjs/typeorm#2562

Full Changelog: nestjs/typeorm@11.0.0...11.0.1

Commits

57bcd24 chore(): release v11.0.1
d08fc02 Merge pull request #2528 from nestjs/renovate/postgres-18.x
3d42a8e Merge pull request #2566 from nestjs/renovate/cimg-node-24.x
180b9c9 Merge pull request #2562 from naorpeled/feat/support-v1-of-typeorm
429caa3 chore(deps): update dependency ts-jest to v29.4.9 (#2569)
4473f7b chore(deps): update dependency typescript-eslint to v8.58.0 (#2568)
ed9f679 fix: resolve lock sync issues
574b654 fix: Use ^1.0.0-dev for typeorm peer dependency range
f8a656a chore(deps): update node.js to v24.14.1
70e63ed chore: Remove unnecessary unit tests
Additional commits viewable in compare view

Updates @willsoto/nestjs-prometheus from 6.0.2 to 6.1.0

Release notes

Sourced from @willsoto/nestjs-prometheus's releases.

v6.1.0

6.1.0 (2026-03-28)

Features

support dependency injection in metric collect functions (7d49e53), closes #1837

Changelog

Sourced from @willsoto/nestjs-prometheus's changelog.

6.1.0 (2026-03-28)

Features

support dependency injection in metric collect functions (7d49e53), closes #1837

Commits

72c19a2 chore(release): 6.1.0 [skip ci]
7d49e53 feat: support dependency injection in metric collect functions
461651c refactor: convert to lefthook
60b96b6 chore(deps): update all non-major dependencies (#2462)
7210c36 chore(deps): update dependency prettier-plugin-packagejson to v3 (#2461)
c05e402 chore(deps): update all non-major dependencies (#2460)
5241c37 chore(deps): update all non-major dependencies (#2459)
33f2d27 chore(deps): update all non-major dependencies (#2458)
6f43c8e chore(deps): update dependency globals to v17 (#2457)
fe6f99c chore(deps): update all non-major dependencies (#2456)
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates axios from 1.13.5 to 1.16.0

Release notes

Sourced from axios's releases.

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)

Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)

Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)

parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)

Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)

transformRequest input typing change was reverted. The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (#10745, #10810)

🚀 New Features

QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#10802)

ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #6485). (#10680)

Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#6897)

🐛 Bug Fixes

HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#10794, #10800, #6241, #10822, #10825)

HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#10708, #10819, #7149)

Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#10795, #10772, #10806, #7260)

XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#10787)

Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#10724, #7276, #10729)

Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#7414, #6389, #6460)

UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#7378)

Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#10833)

🔧 Maintenance & Chores

Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#10588, #7419)

Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE fail...
Description has been truncated

…22 updates Bumps the npm-dependencies group with 22 updates in the /apps/backend directory: | Package | From | To | | --- | --- | --- | | [@clickhouse/client](https://github.com/ClickHouse/clickhouse-js) | `1.18.2` | `1.18.4` | | [@ipld/car](https://github.com/ipld/js-car) | `5.4.2` | `5.4.4` | | [@ipld/dag-pb](https://github.com/ipld/js-dag-pb) | `4.1.5` | `4.1.6` | | [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `11.1.13` | `11.1.19` | | [@nestjs/config](https://github.com/nestjs/config) | `4.0.3` | `4.0.4` | | [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `11.1.13` | `11.1.19` | | [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express) | `11.1.13` | `11.1.19` | | [@nestjs/schedule](https://github.com/nestjs/schedule) | `6.1.1` | `6.1.3` | | [@nestjs/swagger](https://github.com/nestjs/swagger) | `11.2.6` | `11.4.2` | | [@nestjs/typeorm](https://github.com/nestjs/typeorm) | `11.0.0` | `11.0.1` | | [@willsoto/nestjs-prometheus](https://github.com/willsoto/nestjs-prometheus) | `6.0.2` | `6.1.0` | | [axios](https://github.com/axios/axios) | `1.13.5` | `1.16.0` | | [class-validator](https://github.com/typestack/class-validator) | `0.14.3` | `0.15.1` | | [joi](https://github.com/hapijs/joi) | `18.0.2` | `18.2.1` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.18.0` | `8.20.0` | | [pg-boss](https://github.com/timgit/pg-boss) | `12.11.1` | `12.18.2` | | [typeorm](https://github.com/typeorm/typeorm) | `0.3.28` | `0.3.29` | | [@nestjs/cli](https://github.com/nestjs/nest-cli) | `11.0.16` | `11.0.21` | | [@nestjs/schematics](https://github.com/nestjs/schematics) | `11.0.9` | `11.1.0` | | [@nestjs/testing](https://github.com/nestjs/nest/tree/HEAD/packages/testing) | `11.1.13` | `11.1.19` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.2.3` | `25.6.2` | | [ts-loader](https://github.com/TypeStrong/ts-loader) | `9.5.4` | `9.5.7` | Updates `@clickhouse/client` from 1.18.2 to 1.18.4 - [Release notes](https://github.com/ClickHouse/clickhouse-js/releases) - [Changelog](https://github.com/ClickHouse/clickhouse-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/ClickHouse/clickhouse-js/commits) Updates `@ipld/car` from 5.4.2 to 5.4.4 - [Release notes](https://github.com/ipld/js-car/releases) - [Changelog](https://github.com/ipld/js-car/blob/master/CHANGELOG.md) - [Commits](ipld/js-car@v5.4.2...v5.4.4) Updates `@ipld/dag-pb` from 4.1.5 to 4.1.6 - [Release notes](https://github.com/ipld/js-dag-pb/releases) - [Changelog](https://github.com/ipld/js-dag-pb/blob/master/CHANGELOG.md) - [Commits](ipld/js-dag-pb@v4.1.5...v4.1.6) Updates `@nestjs/common` from 11.1.13 to 11.1.19 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.19/packages/common) Updates `@nestjs/config` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/nestjs/config/releases) - [Commits](nestjs/config@4.0.3...4.0.4) Updates `@nestjs/core` from 11.1.13 to 11.1.19 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.19/packages/core) Updates `@nestjs/platform-express` from 11.1.13 to 11.1.19 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.19/packages/platform-express) Updates `@nestjs/schedule` from 6.1.1 to 6.1.3 - [Release notes](https://github.com/nestjs/schedule/releases) - [Commits](nestjs/schedule@6.1.1...6.1.3) Updates `@nestjs/swagger` from 11.2.6 to 11.4.2 - [Release notes](https://github.com/nestjs/swagger/releases) - [Commits](nestjs/swagger@11.2.6...11.4.2) Updates `@nestjs/typeorm` from 11.0.0 to 11.0.1 - [Release notes](https://github.com/nestjs/typeorm/releases) - [Commits](nestjs/typeorm@11.0.0...11.0.1) Updates `@willsoto/nestjs-prometheus` from 6.0.2 to 6.1.0 - [Release notes](https://github.com/willsoto/nestjs-prometheus/releases) - [Changelog](https://github.com/willsoto/nestjs-prometheus/blob/main/CHANGELOG.md) - [Commits](willsoto/nestjs-prometheus@v6.0.2...v6.1.0) Updates `axios` from 1.13.5 to 1.16.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.5...v1.16.0) Updates `class-validator` from 0.14.3 to 0.15.1 - [Release notes](https://github.com/typestack/class-validator/releases) - [Changelog](https://github.com/typestack/class-validator/blob/develop/CHANGELOG.md) - [Commits](typestack/class-validator@v0.14.3...v0.15.1) Updates `joi` from 18.0.2 to 18.2.1 - [Commits](hapijs/joi@v18.0.2...v18.2.1) Updates `pg` from 8.18.0 to 8.20.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.20.0/packages/pg) Updates `pg-boss` from 12.11.1 to 12.18.2 - [Release notes](https://github.com/timgit/pg-boss/releases) - [Commits](timgit/pg-boss@12.11.1...12.18.2) Updates `typeorm` from 0.3.28 to 0.3.29 - [Release notes](https://github.com/typeorm/typeorm/releases) - [Changelog](https://github.com/typeorm/typeorm/blob/0.3.29/CHANGELOG.md) - [Commits](typeorm/typeorm@0.3.28...0.3.29) Updates `@nestjs/cli` from 11.0.16 to 11.0.21 - [Release notes](https://github.com/nestjs/nest-cli/releases) - [Commits](nestjs/nest-cli@11.0.16...11.0.21) Updates `@nestjs/schematics` from 11.0.9 to 11.1.0 - [Release notes](https://github.com/nestjs/schematics/releases) - [Commits](nestjs/schematics@11.0.9...11.1.0) Updates `@nestjs/testing` from 11.1.13 to 11.1.19 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.19/packages/testing) Updates `@types/node` from 25.2.3 to 25.6.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `ts-loader` from 9.5.4 to 9.5.7 - [Release notes](https://github.com/TypeStrong/ts-loader/releases) - [Changelog](https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md) - [Commits](TypeStrong/ts-loader@v9.5.4...v9.5.7) --- updated-dependencies: - dependency-name: "@clickhouse/client" dependency-version: 1.18.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@ipld/car" dependency-version: 5.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@ipld/dag-pb" dependency-version: 4.1.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@nestjs/common" dependency-version: 11.1.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@nestjs/config" dependency-version: 4.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@nestjs/core" dependency-version: 11.1.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@nestjs/platform-express" dependency-version: 11.1.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@nestjs/schedule" dependency-version: 6.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@nestjs/swagger" dependency-version: 11.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@nestjs/typeorm" dependency-version: 11.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@willsoto/nestjs-prometheus" dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: axios dependency-version: 1.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: class-validator dependency-version: 0.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: joi dependency-version: 18.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: pg dependency-version: 8.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: pg-boss dependency-version: 12.18.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: typeorm dependency-version: 0.3.29 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@nestjs/cli" dependency-version: 11.0.21 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@nestjs/schematics" dependency-version: 11.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@nestjs/testing" dependency-version: 11.1.19 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@types/node" dependency-version: 25.6.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: ts-loader dependency-version: 9.5.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 13, 2026

FilOzzy added this to FOC May 13, 2026

github-project-automation Bot moved this to 📌 Triage in FOC May 13, 2026

BigLep moved this from 📌 Triage to 🐱 Todo in FOC May 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm-dependencies group across 1 directory with 22 updates#533

chore(deps): bump the npm-dependencies group across 1 directory with 22 updates#533
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/backend/npm-dependencies-402b2ce8f2

dependabot Bot commented on behalf of github May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github May 13, 2026

1.18.4

1.18.3

Improvements

v5.4.4

5.4.4 (2026-05-07)

Dependencies

v5.4.3

5.4.3 (2026-04-02)

Trivial Changes

Dependencies

5.4.4 (2026-05-07)

Dependencies

5.4.3 (2026-04-02)

Trivial Changes

Dependencies

v4.1.6

4.1.6 (2026-05-07)

Dependencies

4.1.6 (2026-05-07)

Dependencies

v11.1.19 (2026-04-13)

Bug fixes

Committers: 2

v11.1.18 (2026-04-03)

Bug fixes

Dependencies

Committers: 6

v11.1.17 (2026-03-16)

Enhancements

Bugs

Release 4.0.4

v11.1.19 (2026-04-13)

Bug fixes

Committers: 2

v11.1.18 (2026-04-03)

Bug fixes

Dependencies

Committers: 6

v11.1.17 (2026-03-16)

Enhancements

Bugs

v11.1.19 (2026-04-13)

Bug fixes

Committers: 2

v11.1.18 (2026-04-03)

Bug fixes

Dependencies

Committers: 6

v11.1.17 (2026-03-16)

Enhancements

Bugs

6.1.3

What's Changed

Release 6.1.2

Release 11.4.2

11.4.2 (2026-04-27)

Bug fixes

Committers: 2

Release 11.4.1

11.4.1 (2026-04-22)

Bug fixes

Committers: 1

Release 11.4.0

11.4.0 (2026-04-22)

Features

Bug fixes

Enhancements

Committers: 4

Release 11.3.2

What's Changed

New Contributors

Release 11.0.1

What's Changed

New Contributors

v6.1.0

6.1.0 (2026-03-28)

Features

6.1.0 (2026-03-28)