Skip to content

chore(deps): bump the npm-minor-patch group with 16 updates - #19

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-40af8cc9de
Closed

chore(deps): bump the npm-minor-patch group with 16 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-40af8cc9de

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 16 updates:

Package From To
@fastify/jwt 10.1.0 10.2.5
@fastify/static 9.1.3 9.3.0
@fastify/swagger 9.7.0 9.9.2
@fastify/swagger-ui 5.2.5 5.2.6
fastify 5.8.5 5.12.7
nanoid 5.1.7 5.1.16
nodemailer 8.0.10 8.0.11
@types/nodemailer 8.0.0 8.0.2
sharp 0.34.5 0.35.5
undici 7.24.7 7.30.1
@playwright/test 1.60.0 1.64.1
@types/node 22.19.15 22.20.5
concurrently 9.2.1 9.2.5
pino-pretty 13.1.3 13.2.0
playwright 1.60.0 1.64.1
vitest 3.2.4 3.2.7

Updates @fastify/jwt from 10.1.0 to 10.2.5

Release notes

Sourced from @​fastify/jwt's releases.

v10.2.5

Full Changelog: fastify/fastify-jwt@v10.2.4...v10.2.5

v10.2.4

Full Changelog: fastify/fastify-jwt@v10.2.3...v10.2.4

v10.2.3

⚠️ Security Release

What's Changed

New Contributors

Full Changelog: fastify/fastify-jwt@v10.2.2...v10.2.3

v10.2.2

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-jwt@v10.2.1...v10.2.2

v10.2.1

What's Changed

New Contributors

Full Changelog: fastify/fastify-jwt@v10.2.0...v10.2.1

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/jwt since your current version.


Updates @fastify/static from 9.1.3 to 9.3.0

Release notes

Sourced from @​fastify/static's releases.

v9.3.0

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v9.2.0...v9.3.0

v9.2.0

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v9.1.3...v9.2.0

Commits
  • ad05a27 Bumped v9.3.0
  • 58811db chore: update fastify-plugin dependency to version 6.0.0 (#594)
  • a343813 Bumped v9.2.0
  • b94c725 docs: clarify precompressed allowedPath behavior (#593)
  • 684a4ea docs: fix broken links (#591)
  • 26e7042 chore: bump @​types/node in the dev-dependencies-typescript group (#592)
  • 070912a chore: bump @​fastify/compress from 8.3.1 to 9.0.0 (#590)
  • 2f792ea chore: update depedabot setting
  • 5b6043c fix: propagate return value from fastify.errorHandler (#582)
  • 040307a refactor(types): migrate from tsd to tstyche (#579)
  • Additional commits viewable in compare view

Updates @fastify/swagger from 9.7.0 to 9.9.2

Release notes

Sourced from @​fastify/swagger's releases.

v9.9.2

What's Changed

New Contributors

Full Changelog: fastify/fastify-swagger@v9.9.1...v9.9.2

v9.9.1

What's Changed

New Contributors

Full Changelog: fastify/fastify-swagger@v9.9.0...v9.9.1

v9.9.0

What's Changed

Full Changelog: fastify/fastify-swagger@v9.8.2...v9.9.0

v9.8.2

What's Changed

Full Changelog: fastify/fastify-swagger@v9.8.1...v9.8.2

v9.8.1

What's Changed

Full Changelog: fastify/fastify-swagger@v9.8.0...v9.8.1

... (truncated)

Commits
  • a072a9a Bumped v9.9.2
  • d7bd51d ci: enable trusted publishing releases
  • f3ecd63 Bumped v9.9.1
  • 697b192 fix(openapi): support untyped oneOf query properties (#945)
  • 50b6f3f fix: convert nullable and keep examples for OpenAPI 3.1+ (#955)
  • 5285637 fix: support $ref to definitions of shared schemas (#952)
  • d31c75e Bumped v9.9.0
  • 74d98db feat: OpenAPI 3.2.0 compatibility (#949)
  • 56b8971 Bumped v9.8.2
  • c1218bc fix(openapi): support null types and type arrays in OpenAPI 3.0 documents
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/swagger since your current version.


Updates @fastify/swagger-ui from 5.2.5 to 5.2.6

Release notes

Sourced from @​fastify/swagger-ui's releases.

v5.2.6

What's Changed

Full Changelog: fastify/fastify-swagger-ui@v5.2.5...v5.2.6

Commits
  • 56ee372 Bumped v5.2.6
  • b1eff32 fix: correct corrupted PNG favicon signatures (#269)
  • 5b951e6 ci: add lock-threads workflow (#265)
  • 04a6271 chore(deps-dev): bump swagger-ui-dist from 5.32.0 to 5.32.1 (#264)
  • ddf5895 chore(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...
  • c546425 chore(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#261)
  • cd4cee7 chore(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#260)
  • 043d556 chore(deps-dev): bump c8 from 10.1.3 to 11.0.0 (#259)
  • 4ff5aa5 chore(deps-dev): bump swagger-ui-dist from 5.31.0 to 5.32.0 (#258)
  • efde3f0 chore(license): standardise license notice (#256)
  • Additional commits viewable in compare view

Updates fastify from 5.8.5 to 5.12.7

Release notes

Sourced from fastify's releases.

v5.12.7

Full Changelog: fastify/fastify@v5.12.6...v5.12.7

v5.12.6

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

v5.12.5

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

What's Changed

... (truncated)

Commits
  • 9f40003 Bumped v5.12.7
  • 16469b9 Bumped v5.12.6
  • 63496de [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 (#7094)
  • 20b55d4 [Backport 5.x] fix: remove error when HTTP QUERY request has empty body (#7060)
  • 38d2b63 [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of...
  • 3241fbd [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/...
  • 1a46b1b [Backport 5.x] perf: use a FIFO cache for parsed content-types (#7072)
  • 7e06676 [Backport 5.x] fix: resolve reply.mediaType from raw response headers (#7067)
  • 1b0eb32 [Backport 5.x] perf: avoid resetting the level of request child loggers (#7058)
  • a636a10 [Backport 5.x] perf: decode string bodies once instead of per chunk (#7053)
  • Additional commits viewable in compare view

Updates nanoid from 5.1.7 to 5.1.16

Release notes

Sourced from nanoid's releases.

5.1.16

5.1.15

  • Fixed random pool corruption on big ID sizes.

5.1.14

  • Fixed npm package size regression.

5.1.13

  • Fixed npm package size regression.

5.1.12

  • Moved to npm Provenance and Staged Publishing.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

5.1.9

  • Fixed npm package size regression.

5.1.8

Changelog

Sourced from nanoid's changelog.

5.1.16

5.1.15

  • Fixed random pool corruption on big ID sizes.

5.1.14

  • Fixed npm package size regression.

5.1.13

  • Fixed npm package size regression.

5.1.12

  • Moved to npm Provenance and Staged Publishing.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

5.1.9

  • Fixed npm package size regression.

5.1.8

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates nodemailer from 8.0.10 to 8.0.11

Release notes

Sourced from nodemailer's releases.

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

  • apply the transport-level newline option in stream and sendmail transports (cb4f904)
  • include icalEvent path/href content in the application/ics attachment (b801c48)
  • parse Ethereal response props without polynomial regex backtracking (067aebe)
  • resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)
  • return the promise from every resolveContent branch (07ffe8c)
  • strip the url scheme from List-ID header values (77e5885)
  • tag AWS SES transport errors with the ESES code (efa647a)
Changelog

Sourced from nodemailer's changelog.

8.0.11 (2026-06-10)

Bug Fixes

  • apply the transport-level newline option in stream and sendmail transports (cb4f904)
  • include icalEvent path/href content in the application/ics attachment (b801c48)
  • parse Ethereal response props without polynomial regex backtracking (067aebe)
  • resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)
  • return the promise from every resolveContent branch (07ffe8c)
  • strip the url scheme from List-ID header values (77e5885)
  • tag AWS SES transport errors with the ESES code (efa647a)
Commits
  • e3b1bda chore(master): release 8.0.11 (#1826)
  • 4358caf refactor: remove dead checks flagged by Code Quality analysis
  • cf5195c chore: harden workflow token permissions and update GitHub Actions
  • 067aebe fix: parse Ethereal response props without polynomial regex backtracking
  • 0cee4fe chore: add CodeQL code scanning workflow
  • cb9da47 chore: update dev dependencies
  • e0a4928 chore: format CLAUDE.md with prettier
  • 8620f2f docs: correct stale timeout defaults in SMTPConnection options JSDoc
  • efa647a fix: tag AWS SES transport errors with the ESES code
  • 07ffe8c fix: return the promise from every resolveContent branch
  • Additional commits viewable in compare view

Updates @types/nodemailer from 8.0.0 to 8.0.2

Commits

Updates sharp from 0.34.5 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract and rotate operations. #4606

  • Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract operation. #4606

... (truncated)

Commits
  • 51a990f Release v0.35.5
  • 96de105 Upgrade to sharp-libvips v1.3.4
  • 3a61390 CI: Configure Dependabot with all package.json locations
  • 4940c50 Improve gain map support for rotate/flip/flop ops
  • 20654aa Prerelease v0.35.5-rc.1
  • ef4f934 CI: Upgrade to Ubuntu 26.04
  • 358df95 Upgrade to libvips v8.18.7
  • 49f4903 Improve gain map support for rotate-then-extract #4606
  • 0e2e55e Silence a couple of compiler/static analysis warnings
  • cef3b8c Improve gain map support for extract operation #4606
  • Additional commits viewable in compare view

Updates undici from 7.24.7 to 7.30.1

Release notes

Sourced from undici's releases.

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

... (truncated)

Commits
  • 7507102 Bumped v7.30.1 (#6022)
  • 7d60c7b [v7.x] fix(cookies): backport #5663, #5808 and #5832 (#6019)
  • 0227d5d fix: avoid unbounded recursion in Set-Cookie attribute parser (#5757) (#5997)
  • 5394462 fix(websocket): bound automatic PONG writes under backpressure
  • 2991627 fix(eventsource): bound retained SSE parser state
  • 18bc8a1 fix(sri): accept non-lowercase algorithm tokens
  • 63cba77 fix(decompress): converge downstream handler throws to per-request errors
  • 07ded49 fix(fetch): abort excessive content encoding responses
  • b20b82a fix(cache): prevent cross-origin redirect cache confusion
  • 04cb74b fix: preserve Agent connection options
  • Additional commits viewable in compare view

Updates @playwright/test from 1.60.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • Additional commits viewable in compare view

Updates @types/node from 22.19.15 to 22.20.5

Commits

Updates @types/nodemailer from 8.0.0 to 8.0.2

Commits

Updates concurrently from 9.2.1 to 9.2.5

Release notes <...

Description has been truncated

@dependabot
chore(deps): bump the npm-minor-patch group with 16 updates
2da7e1c 
Bumps the npm-minor-patch group with 16 updates:

| Package | From | To |
| --- | --- | --- |
| [@fastify/jwt](https://github.com/fastify/fastify-jwt) | `10.1.0` | `10.2.5` |
| [@fastify/static](https://github.com/fastify/fastify-static) | `9.1.3` | `9.3.0` |
| [@fastify/swagger](https://github.com/fastify/fastify-swagger) | `9.7.0` | `9.9.2` |
| [@fastify/swagger-ui](https://github.com/fastify/fastify-swagger-ui) | `5.2.5` | `5.2.6` |
| [fastify](https://github.com/fastify/fastify) | `5.8.5` | `5.12.7` |
| [nanoid](https://github.com/ai/nanoid) | `5.1.7` | `5.1.16` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `8.0.10` | `8.0.11` |
| [@types/nodemailer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/nodemailer) | `8.0.0` | `8.0.2` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.5` |
| [undici](https://github.com/nodejs/undici) | `7.24.7` | `7.30.1` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.64.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.15` | `22.20.5` |
| [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.1` | `9.2.5` |
| [pino-pretty](https://github.com/pinojs/pino-pretty) | `13.1.3` | `13.2.0` |
| [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.64.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `3.2.7` |


Updates `@fastify/jwt` from 10.1.0 to 10.2.5
- [Release notes](https://github.com/fastify/fastify-jwt/releases)
- [Commits](fastify/fastify-jwt@v10.1.0...v10.2.5)

Updates `@fastify/static` from 9.1.3 to 9.3.0
- [Release notes](https://github.com/fastify/fastify-static/releases)
- [Commits](fastify/fastify-static@v9.1.3...v9.3.0)

Updates `@fastify/swagger` from 9.7.0 to 9.9.2
- [Release notes](https://github.com/fastify/fastify-swagger/releases)
- [Commits](fastify/fastify-swagger@v9.7.0...v9.9.2)

Updates `@fastify/swagger-ui` from 5.2.5 to 5.2.6
- [Release notes](https://github.com/fastify/fastify-swagger-ui/releases)
- [Commits](fastify/fastify-swagger-ui@v5.2.5...v5.2.6)

Updates `fastify` from 5.8.5 to 5.12.7
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.8.5...v5.12.7)

Updates `nanoid` from 5.1.7 to 5.1.16
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.1.7...5.1.16)

Updates `nodemailer` from 8.0.10 to 8.0.11
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v8.0.10...v8.0.11)

Updates `@types/nodemailer` from 8.0.0 to 8.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/nodemailer)

Updates `sharp` from 0.34.5 to 0.35.5
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.5)

Updates `undici` from 7.24.7 to 7.30.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.7...v7.30.1)

Updates `@playwright/test` from 1.60.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.64.1)

Updates `@types/node` from 22.19.15 to 22.20.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/nodemailer` from 8.0.0 to 8.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/nodemailer)

Updates `concurrently` from 9.2.1 to 9.2.5
- [Release notes](https://github.com/open-cli-tools/concurrently/releases)
- [Commits](open-cli-tools/concurrently@v9.2.1...v9.2.5)

Updates `pino-pretty` from 13.1.3 to 13.2.0
- [Release notes](https://github.com/pinojs/pino-pretty/releases)
- [Commits](pinojs/pino-pretty@v13.1.3...v13.2.0)

Updates `playwright` from 1.60.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.64.1)

Updates `vitest` from 3.2.4 to 3.2.7
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.7/packages/vitest)

---
updated-dependencies:
- dependency-name: "@fastify/jwt"
  dependency-version: 10.2.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@fastify/static"
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@fastify/swagger"
  dependency-version: 9.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@fastify/swagger-ui"
  dependency-version: 5.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: fastify
  dependency-version: 5.12.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: nanoid
  dependency-version: 5.1.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: nodemailer
  dependency-version: 8.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@types/nodemailer"
  dependency-version: 8.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: sharp
  dependency-version: 0.35.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: undici
  dependency-version: 7.30.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@types/node"
  dependency-version: 22.20.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@types/nodemailer"
  dependency-version: 8.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: concurrently
  dependency-version: 9.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: pino-pretty
  dependency-version: 13.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 3.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 29, 2026
This was referenced Oct 29, 2026
Closed
Closed
@wangzhizhou

wangzhizhou commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

公开切换期间先清理自动依赖 PR。Dependabot 已调整分组与大版本策略，下一次计划任务会按新配置重新生成。

@dependabot @github

dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-40af8cc9de branch October 29, 2026 15:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@wangzhizhou