Skip to content

chore(deps): bump the npm-minor-patch group with 16 updates - #23

Merged
wangzhizhou merged 3 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-355d3283c2
Nov 6, 2026
Merged

chore(deps): bump the npm-minor-patch group with 16 updates#23
wangzhizhou merged 3 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-355d3283c2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 16 updates:

Package From To
@fastify/jwt 10.1.0 10.2.6
@fastify/static 9.1.3 9.3.0
@fastify/swagger 9.7.0 9.9.3
@fastify/swagger-ui 5.2.5 5.2.6
fastify 5.8.5 5.12.8
nanoid 5.1.7 5.1.16
nodemailer 8.0.10 8.0.11
@types/nodemailer 8.0.0 8.0.2
sharp 0.34.5 0.35.5
undici 7.24.7 7.30.1
@playwright/test 1.60.0 1.64.1
@types/node 22.19.15 22.20.5
concurrently 9.2.1 9.2.5
pino-pretty 13.1.3 13.2.0
playwright 1.60.0 1.64.1
vitest 3.2.4 3.2.7

Updates @fastify/jwt from 10.1.0 to 10.2.6

Release notes

Sourced from @​fastify/jwt's releases.

v10.2.6

What's Changed

Note for TypeScript users

The trusted option is now typed as (request, decodedToken) => boolean | Promise<boolean>. Its return value has never been used as request.user (since #278), so if you were returning an object, return a boolean instead (e.g. Boolean(record)) and use formatUser to shape the claims exposed on request.user. No runtime change.

Full Changelog: fastify/fastify-jwt@v10.2.5...v10.2.6

v10.2.5

Full Changelog: fastify/fastify-jwt@v10.2.4...v10.2.5

v10.2.4

Full Changelog: fastify/fastify-jwt@v10.2.3...v10.2.4

v10.2.3

⚠️ Security Release

What's Changed

New Contributors

Full Changelog: fastify/fastify-jwt@v10.2.2...v10.2.3

v10.2.2

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-jwt@v10.2.1...v10.2.2

v10.2.1

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/jwt since your current version.


Updates @fastify/static from 9.1.3 to 9.3.0

Release notes

Sourced from @​fastify/static's releases.

v9.3.0

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v9.2.0...v9.3.0

v9.2.0

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v9.1.3...v9.2.0

Commits
  • ad05a27 Bumped v9.3.0
  • 58811db chore: update fastify-plugin dependency to version 6.0.0 (#594)
  • a343813 Bumped v9.2.0
  • b94c725 docs: clarify precompressed allowedPath behavior (#593)
  • 684a4ea docs: fix broken links (#591)
  • 26e7042 chore: bump @​types/node in the dev-dependencies-typescript group (#592)
  • 070912a chore: bump @​fastify/compress from 8.3.1 to 9.0.0 (#590)
  • 2f792ea chore: update depedabot setting
  • 5b6043c fix: propagate return value from fastify.errorHandler (#582)
  • 040307a refactor(types): migrate from tsd to tstyche (#579)
  • Additional commits viewable in compare view

Updates @fastify/swagger from 9.7.0 to 9.9.3

Release notes

Sourced from @​fastify/swagger's releases.

v9.9.3

What's Changed

Full Changelog: fastify/fastify-swagger@v9.9.2...v9.9.3

v9.9.2

What's Changed

New Contributors

Full Changelog: fastify/fastify-swagger@v9.9.1...v9.9.2

v9.9.1

What's Changed

New Contributors

Full Changelog: fastify/fastify-swagger@v9.9.0...v9.9.1

v9.9.0

What's Changed

Full Changelog: fastify/fastify-swagger@v9.8.2...v9.9.0

v9.8.2

What's Changed

Full Changelog: fastify/fastify-swagger@v9.8.1...v9.8.2

... (truncated)

Commits
  • 5a553c2 Bumped v9.9.3
  • 2ef6f87 fix: emit the schemas with an nested in the route schemas (#956)
  • 9847ca8 chore: bump fastify/workflows/.github/workflows/reusable-release.yml
  • a072a9a Bumped v9.9.2
  • d7bd51d ci: enable trusted publishing releases
  • f3ecd63 Bumped v9.9.1
  • 697b192 fix(openapi): support untyped oneOf query properties (#945)
  • 50b6f3f fix: convert nullable and keep examples for OpenAPI 3.1+ (#955)
  • 5285637 fix: support $ref to definitions of shared schemas (#952)
  • d31c75e Bumped v9.9.0
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/swagger since your current version.


Updates @fastify/swagger-ui from 5.2.5 to 5.2.6

Release notes

Sourced from @​fastify/swagger-ui's releases.

v5.2.6

What's Changed

Full Changelog: fastify/fastify-swagger-ui@v5.2.5...v5.2.6

Commits
  • 56ee372 Bumped v5.2.6
  • b1eff32 fix: correct corrupted PNG favicon signatures (#269)
  • 5b951e6 ci: add lock-threads workflow (#265)
  • 04a6271 chore(deps-dev): bump swagger-ui-dist from 5.32.0 to 5.32.1 (#264)
  • ddf5895 chore(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...
  • c546425 chore(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#261)
  • cd4cee7 chore(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#260)
  • 043d556 chore(deps-dev): bump c8 from 10.1.3 to 11.0.0 (#259)
  • 4ff5aa5 chore(deps-dev): bump swagger-ui-dist from 5.31.0 to 5.32.0 (#258)
  • efde3f0 chore(license): standardise license notice (#256)
  • Additional commits viewable in compare view

Updates fastify from 5.8.5 to 5.12.8

Release notes

Sourced from fastify's releases.

v5.12.8

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.12.7...v5.12.8

v5.12.7

Full Changelog: fastify/fastify@v5.12.6...v5.12.7

v5.12.6

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

... (truncated)

Commits
  • 0c7413a Bumped v5.12.8
  • 0ffe18f test: make handlerTimeout ended-but-not-finished test deterministic
  • 8e7c2b7 test: restore 100% coverage for handlerTimeout abort paths
  • 15fbadf [Backport 5.x] fix: abort streaming response when handlerTimeout fires after ...
  • 18a7049 docs: fix syntax errors in code examples (#7159)
  • c410867 docs: clarify that maxParamLength does not prevent ReDoS (#7140)
  • 0fa6bc2 [Backport 5.x] fix(decorators): evaluate instance getters once in getDecorato...
  • 0873d55 perf(request): hoist port regex to module level (#7110)
  • 25cd11e [Backport 5.x] docs: remove plugins that do not support Fastify v5 (#7152)
  • d60a57b [Backport 5.x] docs(reply): reorganize Reply reference by properties and meth...
  • Additional commits viewable in compare view

Updates nanoid from 5.1.7 to 5.1.16

Release notes

Sourced from nanoid's releases.

5.1.16

5.1.15

  • Fixed random pool corruption on big ID sizes.

5.1.14

  • Fixed npm package size regression.

5.1.13

  • Fixed npm package size regression.

5.1.12

  • Moved to npm Provenance and Staged Publishing.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

5.1.9

  • Fixed npm package size regression.

5.1.8

Changelog

Sourced from nanoid's changelog.

5.1.16

5.1.15

  • Fixed random pool corruption on big ID sizes.

5.1.14

  • Fixed npm package size regression.

5.1.13

  • Fixed npm package size regression.

5.1.12

  • Moved to npm Provenance and Staged Publishing.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

5.1.9

  • Fixed npm package size regression.

5.1.8

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates nodemailer from 8.0.10 to 8.0.11

Release notes

Sourced from nodemailer's releases.

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

  • apply the transport-level newline option in stream and sendmail transports (cb4f904)
  • include icalEvent path/href content in the application/ics attachment (b801c48)
  • parse Ethereal response props without polynomial regex backtracking (067aebe)
  • resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)
  • return the promise from every resolveContent branch (07ffe8c)
  • strip the url scheme from List-ID header values (77e5885)
  • tag AWS SES transport errors with the ESES code (efa647a)
Changelog

Sourced from nodemailer's changelog.

8.0.11 (2026-06-10)

Bug Fixes

  • apply the transport-level newline option in stream and sendmail transports (cb4f904)
  • include icalEvent path/href content in the application/ics attachment (b801c48)
  • parse Ethereal response props without polynomial regex backtracking (067aebe)
  • resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)
  • return the promise from every resolveContent branch (07ffe8c)
  • strip the url scheme from List-ID header values (77e5885)
  • tag AWS SES transport errors with the ESES code (efa647a)
Commits
  • e3b1bda chore(master): release 8.0.11 (#1826)
  • 4358caf refactor: remove dead checks flagged by Code Quality analysis
  • cf5195c chore: harden workflow token permissions and update GitHub Actions
  • 067aebe fix: parse Ethereal response props without polynomial regex backtracking
  • 0cee4fe chore: add CodeQL code scanning workflow
  • cb9da47 chore: update dev dependencies
  • e0a4928 chore: format CLAUDE.md with prettier
  • 8620f2f docs: correct stale timeout defaults in SMTPConnection options JSDoc
  • efa647a fix: tag AWS SES transport errors with the ESES code
  • 07ffe8c fix: return the promise from every resolveContent branch
  • Additional commits viewable in compare view

Updates @types/nodemailer from 8.0.0 to 8.0.2

Commits

Updates sharp from 0.34.5 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract and rotate operations. #4606

  • Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract operation. #4606

... (truncated)

Commits
  • 51a990f Release v0.35.5
  • 96de105 Upgrade to sharp-libvips v1.3.4
  • 3a61390 CI: Configure Dependabot with all package.json locations
  • 4940c50 Improve gain map support for rotate/flip/flop ops
  • 20654aa Prerelease v0.35.5-rc.1
  • ef4f934 CI: Upgrade to Ubuntu 26.04
  • 358df95 Upgrade to libvips v8.18.7
  • 49f4903 Improve gain map support for rotate-then-extract #4606
  • 0e2e55e Silence a couple of compiler/static analysis warnings
  • cef3b8c Improve gain map support for extract operation #4606
  • Additional commits viewable in compare view

Updates undici from 7.24.7 to 7.30.1

Release notes

Sourced from undici's releases.

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

... (truncated)

Commits
  • 7507102 Bumped v7.30.1 (#6022)
  • 7d60c7b [v7.x] fix(cookies): backport #5663, #5808 and #5832 (#6019)
  • 0227d5d fix: avoid unbounded recursion in Set-Cookie attribute parser (#5757) (#5997)
  • 5394462 fix(websocket): bound automatic PONG writes under backpressure
  • 2991627 fix(eventsource): bound retained SSE parser state
  • 18bc8a1 fix(sri): accept non-lowercase algorithm tokens
  • 63cba77 fix(decompress): converge downstream handler throws to per-request errors
  • 07ded49 fix(fetch): abort excessive content encoding responses
  • b20b82a fix(cache): prevent cross-origin redirect cache confusion
  • 04cb74b fix: preserve Agent connection options
  • Additional commits viewable in compare view

Updates @playwright/test from 1.60.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

@dependabot
chore(deps): bump the npm-minor-patch group with 16 updates
3a937ce 
Bumps the npm-minor-patch group with 16 updates:

| Package | From | To |
| --- | --- | --- |
| [@fastify/jwt](https://github.com/fastify/fastify-jwt) | `10.1.0` | `10.2.6` |
| [@fastify/static](https://github.com/fastify/fastify-static) | `9.1.3` | `9.3.0` |
| [@fastify/swagger](https://github.com/fastify/fastify-swagger) | `9.7.0` | `9.9.3` |
| [@fastify/swagger-ui](https://github.com/fastify/fastify-swagger-ui) | `5.2.5` | `5.2.6` |
| [fastify](https://github.com/fastify/fastify) | `5.8.5` | `5.12.8` |
| [nanoid](https://github.com/ai/nanoid) | `5.1.7` | `5.1.16` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `8.0.10` | `8.0.11` |
| [@types/nodemailer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/nodemailer) | `8.0.0` | `8.0.2` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.5` |
| [undici](https://github.com/nodejs/undici) | `7.24.7` | `7.30.1` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.64.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.15` | `22.20.5` |
| [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.1` | `9.2.5` |
| [pino-pretty](https://github.com/pinojs/pino-pretty) | `13.1.3` | `13.2.0` |
| [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.64.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `3.2.7` |


Updates `@fastify/jwt` from 10.1.0 to 10.2.6
- [Release notes](https://github.com/fastify/fastify-jwt/releases)
- [Commits](fastify/fastify-jwt@v10.1.0...v10.2.6)

Updates `@fastify/static` from 9.1.3 to 9.3.0
- [Release notes](https://github.com/fastify/fastify-static/releases)
- [Commits](fastify/fastify-static@v9.1.3...v9.3.0)

Updates `@fastify/swagger` from 9.7.0 to 9.9.3
- [Release notes](https://github.com/fastify/fastify-swagger/releases)
- [Commits](fastify/fastify-swagger@v9.7.0...v9.9.3)

Updates `@fastify/swagger-ui` from 5.2.5 to 5.2.6
- [Release notes](https://github.com/fastify/fastify-swagger-ui/releases)
- [Commits](fastify/fastify-swagger-ui@v5.2.5...v5.2.6)

Updates `fastify` from 5.8.5 to 5.12.8
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.8.5...v5.12.8)

Updates `nanoid` from 5.1.7 to 5.1.16
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.1.7...5.1.16)

Updates `nodemailer` from 8.0.10 to 8.0.11
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v8.0.10...v8.0.11)

Updates `@types/nodemailer` from 8.0.0 to 8.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/nodemailer)

Updates `sharp` from 0.34.5 to 0.35.5
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.5)

Updates `undici` from 7.24.7 to 7.30.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.7...v7.30.1)

Updates `@playwright/test` from 1.60.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.64.1)

Updates `@types/node` from 22.19.15 to 22.20.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/nodemailer` from 8.0.0 to 8.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/nodemailer)

Updates `concurrently` from 9.2.1 to 9.2.5
- [Release notes](https://github.com/open-cli-tools/concurrently/releases)
- [Commits](open-cli-tools/concurrently@v9.2.1...v9.2.5)

Updates `pino-pretty` from 13.1.3 to 13.2.0
- [Release notes](https://github.com/pinojs/pino-pretty/releases)
- [Commits](pinojs/pino-pretty@v13.1.3...v13.2.0)

Updates `playwright` from 1.60.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.64.1)

Updates `vitest` from 3.2.4 to 3.2.7
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.7/packages/vitest)

---
updated-dependencies:
- dependency-name: "@fastify/jwt"
  dependency-version: 10.2.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@fastify/static"
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@fastify/swagger"
  dependency-version: 9.9.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@fastify/swagger-ui"
  dependency-version: 5.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: fastify
  dependency-version: 5.12.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: nanoid
  dependency-version: 5.1.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: nodemailer
  dependency-version: 8.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@types/nodemailer"
  dependency-version: 8.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: sharp
  dependency-version: 0.35.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: undici
  dependency-version: 7.30.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@types/node"
  dependency-version: 22.20.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@types/nodemailer"
  dependency-version: 8.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: concurrently
  dependency-version: 9.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: pino-pretty
  dependency-version: 13.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 3.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 5, 2026
@wangzhizhou
fix(pack): 适配 sharp 0.35 格式类型
c82e672 
sharp 0.35 的 FormatEnum 不再包含 jpg，metadata().format 返回 jpeg，
因此 image/${format} 已能生成正确的 image/jpeg MIME 类型。
@wangzhizhou
test: 修复损坏的 1×1 PNG 测试夹具
3468d0e 
新的 sharp/libpng 会严格校验 PNG，原先的 base64 缺少 IDAT 尾部与 CRC，
导致导入接口返回 500。改用完整的 RGBA PNG 夹具。
@wangzhizhou

wangzhizhou commented Nov 6, 2026

Copy link
Copy Markdown
Contributor

已修复 CI，全部检查通过 ✅

改动：

  • src/services/pack/service.ts：适配 sharp 0.35 的 FormatEnum（不再包含 jpg），直接使用 metadata().format 生成 MIME，JPEG 仍为 image/jpeg。
  • test/e2e/platforms.spec.ts、test/fixtures/lazy-http-provider-server.mjs：替换损坏的 1×1 PNG base64 夹具。原夹具 IDAT 被截断且 CRC 错误，旧版 libpng 容忍，sharp 0.35 的新 libpng 会严格拒绝并导致导入 500。

本地验证：npm test（222 tests）、npm run web:build 通过；CI 的单元测试/构建、E2E、CodeQL、静态安全分析全部通过。

@wangzhizhou
wangzhizhou merged commit 2c897f2 into main Nov 6, 2026
4 checks passed
@wangzhizhou
wangzhizhou deleted the dependabot/npm_and_yarn/npm-minor-patch-355d3283c2 branch November 6, 2026 14:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@wangzhizhou