chore(deps): bump the server-minor-and-patch group across 1 directory with 4 updates

[dependabot]

Bumps the server-minor-and-patch group with 4 updates in the /server directory: @ast-grep/napi, @supabase/supabase-js, axios and express-rate-limit.

Updates @ast-grep/napi from 0.45.0 to 0.45.2

Release notes

Sourced from @​ast-grep/napi's releases.

0.45.2

• chore(deps): update astral-sh/setup-uv action to v10 [#2892](https://github.com/ast-grep/ast-grep/issues/2892)
• chore(deps): update rust crate terminal-light to v1.9.1 [#2905](https://github.com/ast-grep/ast-grep/issues/2905)
• chore(deps): update dependency web-tree-sitter to v0.26.13 [#2903](https://github.com/ast-grep/ast-grep/issues/2903)
• chore(deps): update rust crate tree-sitter to v0.26.13 [#2904](https://github.com/ast-grep/ast-grep/issues/2904)
• chore(deps): update dependency dprint to v0.56.1 [#2901](https://github.com/ast-grep/ast-grep/issues/2901)
• chore(deps): update dependency @​napi-rs/cli to v3.8.6 [#2882](https://github.com/ast-grep/ast-grep/issues/2882)
• fix(deps): update rust-wasm-bindgen monorepo [#2878](https://github.com/ast-grep/ast-grep/issues/2878)
• chore(deps): update dependency dprint to v0.56.0 [#2896](https://github.com/ast-grep/ast-grep/issues/2896)
• chore(deps): update dependency oxlint to v1.79.0 [#2897](https://github.com/ast-grep/ast-grep/issues/2897)
• chore(deps): update dependency @​ast-grep/napi to v0.45.1 [#2876](https://github.com/ast-grep/ast-grep/issues/2876)
• chore(deps): update dependency web-tree-sitter to v0.26.12 [#2880](https://github.com/ast-grep/ast-grep/issues/2880)
• fix: exit quietly on broken pipe instead of erroring [#2887](https://github.com/ast-grep/ast-grep/issues/2887)
• feat(outline): extract embedded language symbols [#2883](https://github.com/ast-grep/ast-grep/issues/2883)
• chore(deps): update dependency oxlint to v1.78.0 [#2888](https://github.com/ast-grep/ast-grep/issues/2888)
• feat: add namedChildren support to wasm [#2893](https://github.com/ast-grep/ast-grep/issues/2893)
• feat: add namedChildren to napi [#2893](https://github.com/ast-grep/ast-grep/issues/2893)
• feat: add named_children to pyo3 4dc0d36
• fix: bump down napi 61f1b98
• chore: bump deps 912da32

0.45.1

• fix: match root metavariables against comments [#2868](https://github.com/ast-grep/ast-grep/issues/2868)
• feat(outline): add C# multiline member signatures [#2861](https://github.com/ast-grep/ast-grep/issues/2861)
• chore(deps): update rust crate ignore to v0.4.32 [#2864](https://github.com/ast-grep/ast-grep/issues/2864)
• chore(deps): update dependency oxlint to v1.77.0 [#2865](https://github.com/ast-grep/ast-grep/issues/2865)
• chore(deps): update dependency typescript to v7 [#2833](https://github.com/ast-grep/ast-grep/issues/2833)
• chore(deps): update astral-sh/setup-uv action to v9 [#2839](https://github.com/ast-grep/ast-grep/issues/2839)
• chore(deps): update dependency smol-toml to v1.7.1 [#2848](https://github.com/ast-grep/ast-grep/issues/2848)
• chore(deps): update dependency @​napi-rs/cli to v3.8.2 [#2854](https://github.com/ast-grep/ast-grep/issues/2854)
• chore(deps): update dependency chalk to v6 [#2849](https://github.com/ast-grep/ast-grep/issues/2849)
• chore(deps): update rust crate clap to v4.6.5 [#2860](https://github.com/ast-grep/ast-grep/issues/2860)
• chore(deps): update rust crate clap_complete to v4.6.8 [#2850](https://github.com/ast-grep/ast-grep/issues/2850)
• chore(deps): update rust crate schemars to v1.2.2 [#2851](https://github.com/ast-grep/ast-grep/issues/2851)
• chore(deps): update dependency oxlint to v1.76.0 [#2852](https://github.com/ast-grep/ast-grep/issues/2852)
• chore(deps): update rust crate napi to v3.12.0 [#2855](https://github.com/ast-grep/ast-grep/issues/2855)
• chore(deps): update rust crate napi-derive to v3.6.2 [#2853](https://github.com/ast-grep/ast-grep/issues/2853)
• Use std::io::IsTerminal over atty [#2857](https://github.com/ast-grep/ast-grep/issues/2857)
• chore(deps): update dependency @​ast-grep/napi to v0.45.0 [#2844](https://github.com/ast-grep/ast-grep/issues/2844)
• chore: bump deps 2ac18ca

Changelog

Sourced from @​ast-grep/napi's changelog.

0.45.2

23 August 2026

• chore(deps): update astral-sh/setup-uv action to v10 [#2892](https://github.com/ast-grep/ast-grep/issues/2892)
• chore(deps): update rust crate terminal-light to v1.9.1 [#2905](https://github.com/ast-grep/ast-grep/issues/2905)
• chore(deps): update dependency web-tree-sitter to v0.26.13 [#2903](https://github.com/ast-grep/ast-grep/issues/2903)
• chore(deps): update rust crate tree-sitter to v0.26.13 [#2904](https://github.com/ast-grep/ast-grep/issues/2904)
• chore(deps): update dependency dprint to v0.56.1 [#2901](https://github.com/ast-grep/ast-grep/issues/2901)
• chore(deps): update dependency @​napi-rs/cli to v3.8.6 [#2882](https://github.com/ast-grep/ast-grep/issues/2882)
• fix(deps): update rust-wasm-bindgen monorepo [#2878](https://github.com/ast-grep/ast-grep/issues/2878)
• chore(deps): update dependency dprint to v0.56.0 [#2896](https://github.com/ast-grep/ast-grep/issues/2896)
• chore(deps): update dependency oxlint to v1.79.0 [#2897](https://github.com/ast-grep/ast-grep/issues/2897)
• chore(deps): update dependency @​ast-grep/napi to v0.45.1 [#2876](https://github.com/ast-grep/ast-grep/issues/2876)
• chore(deps): update dependency web-tree-sitter to v0.26.12 [#2880](https://github.com/ast-grep/ast-grep/issues/2880)
• fix: exit quietly on broken pipe instead of erroring [#2887](https://github.com/ast-grep/ast-grep/issues/2887)
• feat(outline): extract embedded language symbols [#2883](https://github.com/ast-grep/ast-grep/issues/2883)
• chore(deps): update dependency oxlint to v1.78.0 [#2888](https://github.com/ast-grep/ast-grep/issues/2888)
• feat: add namedChildren support to wasm [#2893](https://github.com/ast-grep/ast-grep/issues/2893)
• feat: add namedChildren to napi [#2893](https://github.com/ast-grep/ast-grep/issues/2893)
• feat: add named_children to pyo3 4dc0d36
• fix: bump down napi 61f1b98
• chore: bump deps 912da32

0.45.1

7 August 2026

• fix: match root metavariables against comments [#2868](https://github.com/ast-grep/ast-grep/issues/2868)
• feat(outline): add C# multiline member signatures [#2861](https://github.com/ast-grep/ast-grep/issues/2861)
• chore(deps): update rust crate ignore to v0.4.32 [#2864](https://github.com/ast-grep/ast-grep/issues/2864)
• chore(deps): update dependency oxlint to v1.77.0 [#2865](https://github.com/ast-grep/ast-grep/issues/2865)
• chore(deps): update dependency typescript to v7 [#2833](https://github.com/ast-grep/ast-grep/issues/2833)
• chore(deps): update astral-sh/setup-uv action to v9 [#2839](https://github.com/ast-grep/ast-grep/issues/2839)
• chore(deps): update dependency smol-toml to v1.7.1 [#2848](https://github.com/ast-grep/ast-grep/issues/2848)
• chore(deps): update dependency @​napi-rs/cli to v3.8.2 [#2854](https://github.com/ast-grep/ast-grep/issues/2854)
• chore(deps): update dependency chalk to v6 [#2849](https://github.com/ast-grep/ast-grep/issues/2849)
• chore(deps): update rust crate clap to v4.6.5 [#2860](https://github.com/ast-grep/ast-grep/issues/2860)
• chore(deps): update rust crate clap_complete to v4.6.8 [#2850](https://github.com/ast-grep/ast-grep/issues/2850)
• chore(deps): update rust crate schemars to v1.2.2 [#2851](https://github.com/ast-grep/ast-grep/issues/2851)
• chore(deps): update dependency oxlint to v1.76.0 [#2852](https://github.com/ast-grep/ast-grep/issues/2852)
• chore(deps): update rust crate napi to v3.12.0 [#2855](https://github.com/ast-grep/ast-grep/issues/2855)
• chore(deps): update rust crate napi-derive to v3.6.2 [#2853](https://github.com/ast-grep/ast-grep/issues/2853)
• Use std::io::IsTerminal over atty [#2857](https://github.com/ast-grep/ast-grep/issues/2857)
• chore(deps): update dependency @​ast-grep/napi to v0.45.0 [#2844](https://github.com/ast-grep/ast-grep/issues/2844)
• chore: bump deps 2ac18ca

Commits

• c41e023 0.45.2
• ca4c005 fix: change default test arch for macos
• 354492b chore(deps): update astral-sh/setup-uv action to v10 (#2892)
• 2da70f8 chore(deps): update rust crate terminal-light to v1.9.1 (#2905)
• d018191 chore(deps): update dependency web-tree-sitter to v0.26.13 (#2903)
• 038264c chore(deps): update rust crate tree-sitter to v0.26.13 (#2904)
• 777b9ba chore(deps): update dependency dprint to v0.56.1 (#2901)
• 91d249b chore(deps): update dependency @​napi-rs/cli to v3.8.6 (#2882)
• e2f6308 fix: fix linting
• e01da36 fix: address pyo3 deprecation
• Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.110.8 to 2.112.4

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.112.4

2.112.4 (2026-08-24)

🩹 Fixes

• auth: convert stolen-lock AbortError when acquireTimeout is 0 (#2616)
• auth: warn on deprecated lock option and prevent unhandled refresh rejection (#2627)
• postgrest: move override fixtures out of generated types, repair codegen (#2605)
• realtime: respect custom logger for send() REST fallback warning (#2612)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• mmustafasenoglu @​mmustafasenoglu

v2.112.4-canary.3

2.112.4-canary.3 (2026-08-24)

🩹 Fixes

• auth: warn on deprecated lock option and prevent unhandled refresh rejection (#2627)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.112.4-canary.2

2.112.4-canary.2 (2026-08-24)

🩹 Fixes

• auth: convert stolen-lock AbortError when acquireTimeout is 0 (#2616)
• realtime: respect custom logger for send() REST fallback warning (#2612)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• mmustafasenoglu @​mmustafasenoglu

v2.112.4-canary.1

2.112.4-canary.1 (2026-08-12)

This was a version bump only, there were no code changes.

v2.112.4-canary.0

2.112.4-canary.0 (2026-08-11)

🩹 Fixes

• postgrest: move override fixtures out of generated types, repair codegen (#2605)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.3 (2026-08-11)

🩹 Fixes

• supabase: improve trace propagation sampling and diagnostics (#2604)
• supabase: add trace context headers to canonical CORS allow-list (#2603)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.112.2 (2026-08-06)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.1 (2026-08-05)

🩹 Fixes

• realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

• Eduardo Gurgel

2.112.0 (2026-08-03)

🚀 Features

• supabase: move OpenTelemetry tracing to opt-in /tracing subpath (#2583)

🩹 Fixes

• supabase: forward db retry option (#2571)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• Vaibhav @​7ttp

2.111.0 (2026-07-28)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.9 (2026-07-27)

... (truncated)

Commits

• c7397c1 chore(supabase): bump supabase cli to 2.113.0 (#2606)
• bbc167c chore(release): version 2.112.3 changelogs (#2608)
• e44447c fix(supabase): improve trace propagation sampling and diagnostics (#2604)
• 9f0358c fix(supabase): add trace context headers to canonical CORS allow-list (#2603)
• 84beab1 chore(release): version 2.112.2 changelogs (#2599)
• 07b27ee chore(release): version 2.112.1 changelogs (#2593)
• 1831402 fix(realtime): ensure setAuth doesn't disable token refresh (#2592)
• 0136f34 chore(release): version 2.112.0 changelogs (#2589)
• 2877b5b test(supabase): replace test-tracing harness with real-OTel unit and e2e cove...
• a413544 feat(supabase): move OpenTelemetry tracing to opt-in /tracing subpath (#2583)
• Additional commits viewable in compare view

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

• HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

• Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

• Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
• Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
• XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
• Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
• Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

• Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
• Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
• Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
• CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​yens1 (#11109)
• @​Sasireddy001 (#11113)
• @​ari-token-security (#11094)
• @​timothyokooboh (#11097)
• @​gi9439041-png (#11119)
• @​Hashim1999164 (#11082)
• @​v-dev-cl (#11091)
• @​r0h1tb (#11118)
• @​ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)

... (truncated)

Commits

• 84a9f3b chore(release): prepare release 1.20.0 (#11152)
• e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
• d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
• 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
• d19040b fix: harden runtime option handling (#11141)
• e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
• d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
• 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
• 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
• ba98559 docs: add ScrapingBee sponsor (#11137)
• Additional commits viewable in compare view

Updates express-rate-limit from 8.6.0 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

Commits

• 48db09e 8.7.0
• dce5871 v8.7.0 changelog
• 2f08044 Add inspect.software health badge (#673)
• a29757c feat: add retryAfter option (#661)
• 146e88b chore: rename license
• 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
• 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
• 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
• 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
• 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
codeverse	Ready	Preview	Sep 2, 2026 9:45pm UTC