[dependabot]

Bumps the minor-and-patch group with 17 updates in the /backend directory:

Package	From	To
@nestjs/throttler	6.4.0	6.7.1
@scalar/nestjs-api-reference	1.0.9	1.2.28
class-validator	0.14.2	0.15.1
pg	8.16.3	8.23.1
socket.io	4.8.1	4.8.4
@eslint/eslintrc	3.3.1	3.3.7
@faker-js/faker	10.5.0	10.6.0
@types/express	5.0.3	5.0.6
eslint-plugin-prettier	5.5.4	5.5.6
globals	17.7.0	17.13.0
jest	30.1.3	30.5.2
prettier	3.6.2	3.9.10
supertest	7.1.4	7.3.1
@types/supertest	6.0.3	7.2.1
ts-jest	29.4.1	29.4.14
ts-loader	9.5.4	9.6.2
typescript-eslint	8.42.0	8.71.1

Updates @nestjs/throttler from 6.4.0 to 6.7.1

Release notes

Sourced from @​nestjs/throttler's releases.

v6.7.1

Patch Changes

• e8368b3: Set rate limit headers through res.setHeader() when the response has no res.header() method, so the guard no longer throws res.header is not a function on custom HTTP adapters. The logic lives in a new protected setResponseHeader() method that subclasses can override.
• a482ef9: Coerce numeric strings for limit, ttl and blockDuration to numbers, as returned for example by ConfigService.get<number>() for environment variables. Previously Date.now() + '60000' concatenated instead of adding, which silently corrupted every expiry and X-RateLimit-Reset. A value that is not numeric now fails with an error naming the option and the throttler.
• a9a28b9: Respect an explicit 0 for limit, ttl and blockDuration in @Throttle() and the module options instead of falling back to the default. blockDuration: 0 now means "no extra block": the in-memory storage rejects requests while the window is full and lets them through again as soon as the oldest hit expires, without recording the rejected ones.
• bf81677: Import shared interfaces from the public Nest package entry point for Nest 12 compatibility.
• caaabc9: Stop the in-memory storage from retaining request contexts. It used to schedule one setTimeout per counted hit, and each timer kept the request's AsyncLocalStorage stores (for example an ORM's per-request entity manager) in memory until the TTL expired. It now records when each hit expires and prunes expired hits on access. The idle-record sweep is also no longer tied to the context of the first request. With blockDuration: 0, Retry-After now reports when the oldest hit expires rather than when the window ends.
• 7703c10: Log a warning when no throttler is configured. The guard limits nothing in that case and previously said nothing at boot, so ThrottlerModule.forRoot() and ThrottlerModule.forRoot([]) looked like a working setup.

v6.7.0

Minor Changes

• 7004a97: Normalize IPv6 source addresses in the default tracker, and evict expired records from the in-memory storage.

  The built-in getTracker returned req.ip verbatim, so a client holding an IPv6 allocation could send every request from a different address within its own subnet and never share a counter, defeating the rate limit. Addresses are now masked to a /64 before being used as the tracker; the prefix length is configurable via the new ipv6SubnetPrefix module option. IPv4 addresses, IPv4-mapped addresses, the loopback, and custom getTracker implementations are unaffected.

  ThrottlerStorageService also never removed records, so a stream of requests from distinct trackers grew the internal map for the lifetime of the process. Idle records are now swept out once their window has fully elapsed. Limiting behaviour is unchanged: a record is only dropped after every pending hit has expired and any block has lapsed.

  Note that the tracker string for IPv6 clients changes shape (2001:db8:0:1::/64), so storage keys rotate once on upgrade.

v6.6.0

Minor Changes

• c342bad: Declare the supported Node versions in engines, matching the range the CI matrix tests
• c625e98: Update to allow for support for Nest version 12

v6.5.0

Minor Changes

• 58964d6: Add a setHeaders option to control whether to add headers to the response or not

Minor Changes

• 5cb4254: Update to allow for support for Nest version 11

Changelog

Sourced from @​nestjs/throttler's changelog.

6.7.1

Patch Changes

• e8368b3: Set rate limit headers through res.setHeader() when the response has no res.header() method, so the guard no longer throws res.header is not a function on custom HTTP adapters. The logic lives in a new protected setResponseHeader() method that subclasses can override.
• a482ef9: Coerce numeric strings for limit, ttl and blockDuration to numbers, as returned for example by ConfigService.get<number>() for environment variables. Previously Date.now() + '60000' concatenated instead of adding, which silently corrupted every expiry and X-RateLimit-Reset. A value that is not numeric now fails with an error naming the option and the throttler.
• a9a28b9: Respect an explicit 0 for limit, ttl and blockDuration in @Throttle() and the module options instead of falling back to the default. blockDuration: 0 now means "no extra block": the in-memory storage rejects requests while the window is full and lets them through again as soon as the oldest hit expires, without recording the rejected ones.
• bf81677: Import shared interfaces from the public Nest package entry point for Nest 12 compatibility.
• caaabc9: Stop the in-memory storage from retaining request contexts. It used to schedule one setTimeout per counted hit, and each timer kept the request's AsyncLocalStorage stores (for example an ORM's per-request entity manager) in memory until the TTL expired. It now records when each hit expires and prunes expired hits on access. The idle-record sweep is also no longer tied to the context of the first request. With blockDuration: 0, Retry-After now reports when the oldest hit expires rather than when the window ends.
• 7703c10: Log a warning when no throttler is configured. The guard limits nothing in that case and previously said nothing at boot, so ThrottlerModule.forRoot() and ThrottlerModule.forRoot([]) looked like a working setup.

6.7.0

Minor Changes

• 7004a97: Normalize IPv6 source addresses in the default tracker, and evict expired records from the in-memory storage.

  The built-in getTracker returned req.ip verbatim, so a client holding an IPv6 allocation could send every request from a different address within its own subnet and never share a counter, defeating the rate limit. Addresses are now masked to a /64 before being used as the tracker; the prefix length is configurable via the new ipv6SubnetPrefix module option. IPv4 addresses, IPv4-mapped addresses, the loopback, and custom getTracker implementations are unaffected.

  ThrottlerStorageService also never removed records, so a stream of requests from distinct trackers grew the internal map for the lifetime of the process. Idle records are now swept out once their window has fully elapsed. Limiting behaviour is unchanged: a record is only dropped after every pending hit has expired and any block has lapsed.

  Note that the tracker string for IPv6 clients changes shape (2001:db8:0:1::/64), so storage keys rotate once on upgrade.

6.6.0

Minor Changes

• c342bad: Declare the supported Node versions in engines, matching the range the CI matrix tests
• c625e98: Update to allow for support for Nest version 12

Commits

• 91f4912 Merge pull request #2706 from nestjs/changeset-release/master
• c5e8c90 chore: version packages
• 9ec3aa3 Merge pull request #2668 from nestjs/renovate/major-nest-monorepo
• 5d3b9ae Merge pull request #2712 from nestjs/fix/coerce-numeric-options
• 4335230 Merge pull request #2711 from nestjs/fix/timer-free-storage
• a482ef9 fix(guard): coerce numeric string options
• e082222 chore(deps): update nest monorepo to v12
• caaabc9 fix(storage): do not retain request contexts in timers
• 4ab8c63 Merge pull request #2697 from nestjs/renovate/node-24.x
• c36f011 Merge pull request #2703 from nestjs/renovate/nest-graphql-monorepo
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nestjs/throttler since your current version.

Updates @scalar/nestjs-api-reference from 1.0.9 to 1.2.28

Changelog

Sourced from @​scalar/nestjs-api-reference's changelog.

1.2.28

1.2.27

1.2.26

1.2.25

1.2.24

Patch Changes

• #10375: Raise muted text, code-string blue and the deprecated schema row to the 4.5:1 text contrast minimum across the shipped themes

  An accessibility audit turned up text that is legible in the default theme but not in several of the presets, which pair the default greys and blues with an off-white page background. Nine presets and four integration themes get a hue-preserving nudge:

  • Light --scalar-color-2 now clears 4.5:1 on both the page background and the grey card background in every preset. That covers alternate, bluePlanet, mars and saturn, which paired the default grey with an off-white page, and custom-theme-starter, deepSpace, elysiajs, fastify, kepler and purple, which copied the default grey and were left behind when the default moved.
  • Light --scalar-color-blue, which colours code strings, now clears 4.5:1 on the grey example background in alternate, bluePlanet, deepSpace, elysiajs, fastify, kepler and moon, and in the Docusaurus, NestJS, Next.js and SvelteKit themes.
  • Dark --scalar-color-blue now clears 4.5:1 in purple and saturn, and in the Hono and Docusaurus dark themes.
  • Deprecated schema rows no longer fade their contents to 75% opacity, which had dropped their muted text to 3.0:1. The diagonal stripes, the strikethrough on the property name and the Deprecated badge still mark the row.
  • The AsyncAPI send and receive pills blend their label further toward the body text colour, so they read against the tinted fill in every preset but laserwave.
  • --scalar-focus-color sits further from the accent so a keyboard focus ring clears 3:1 on --scalar-background-3 as well, which some presets use for the selected sidebar item.

  laserwave still misses in light mode, where it reuses its dark accents unchanged; bringing it up is a redesign of the preset rather than a nudge.

1.2.23

1.2.22

1.2.21

1.2.20

1.2.19

1.2.18

1.2.17

1.2.16

Patch Changes

• #9941: Republish every package through npm trusted publishing. No functional changes.

1.2.15

1.2.14

1.2.13

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​scalar/nestjs-api-reference since your current version.

Updates class-validator from 0.14.2 to 0.15.1

Release notes

Sourced from class-validator's releases.

v0.15.1

What's Changed

• chore: publish 0.15.0 for real by @​braaar in typestack/class-validator#2671
• chore: publish 0.15.1 by @​braaar in typestack/class-validator#2672

Full Changelog: typestack/class-validator@v0.15.0...v0.15.1

v0.15.0

What's Changed

• feat: add IsISO31661Numeric decorator for country codes by @​RobinvanderVliet in typestack/class-validator#2657
• feat: validateIf for validation options by @​aoi-umi in typestack/class-validator#1579
• feat: update UUID validation to support versions 1-8, nil, max, and all by @​PleBea in typestack/class-validator#2647
• chore: bump vulnerable dependencies by @​braaar in typestack/class-validator#2669
• feat: add isISO6391 decorator for language codes by @​RobinvanderVliet in typestack/class-validator#2626
• feat(IsIBAN)!: Add IsIBANOptions as argument for IsIBAN decorator by @​LiiaMenke in typestack/class-validator#2618
• fix small grammatical error in README.md by @​igorrocha in typestack/class-validator#2596
• chore: release 0.15.0 by @​braaar in typestack/class-validator#2670

New Contributors

• @​RobinvanderVliet made their first contribution in typestack/class-validator#2657
• @​aoi-umi made their first contribution in typestack/class-validator#1579
• @​PleBea made their first contribution in typestack/class-validator#2647
• @​LiiaMenke made their first contribution in typestack/class-validator#2618
• @​igorrocha made their first contribution in typestack/class-validator#2596

Full Changelog: typestack/class-validator@v0.14.4...v0.15.0

v0.14.4

What's Changed

• build(deps-dev): bump js-yaml from 3.14.1 to 3.14.2 by @​dependabot[bot] in typestack/class-validator#2645
• build(deps): bump validator from 13.15.20 to 13.15.22 by @​dependabot[bot] in typestack/class-validator#2649
• chore: release 0.14.4 by @​braaar in typestack/class-validator#2667

Full Changelog: typestack/class-validator@v0.14.3...v0.14.4

v0.14.3

What's Changed

• build: update validator to 13.15.20 by @​weikangchia in typestack/class-validator#2638
• feat: release 0.14.3 by @​braaar in typestack/class-validator#2643
• docs: update changelog by @​braaar in typestack/class-validator#2644

New Contributors

• @​weikangchia made their first contribution in typestack/class-validator#2638

Full Changelog: typestack/class-validator@v0.14.2...v0.14.3

Changelog

Sourced from class-validator's changelog.

0.15.1 (2026-02-26)

BREAKING CHANGES

• Added options argument to IsIBAN validator (#2618), which breaks any existing usage of this decorator that pass an argument to the decorator, e.g. @IsIBAN({forbidUnknownValues: false})

Fixed

• Updated lockfile to patch vulnerabilities (#2669)
• Fixed a small grammatical error in the docs (#2596)

Added

• Added validateIf option to all validators, providing a lot more flexibility in using conditional validation (#1579)
• Added IsISO31661Numeric validator for country codes (#2657)
• Added IsISO6391 validator for language codes (#2626)
• Added more versions to IsUUID validator options. (#2647)

0.14.4 (2026-02-25)

• Updated validator.js to 13.15.22 (#2649)

0.14.3 (2025-11-24)

• Fixed a vulnerability by bumping validator.js (#2638 by @​weikangchia)

Commits

• 2e1a5c2 chore: publish 0.15.1 (#2672)
• 737d2a7 chore: publish 0.15.0 (#2671)
• 8bc5f96 chore: release 0.15.0 (#2670)
• dc41588 fix small grammatical error in README.md (#2596)
• 2c0ff53 feat(IsIBAN): Add IsIBANOptions as argument for IsIBAN decorator (#2618)
• e0eaa02 feat: add isISO6391 decorator for language codes (#2626)
• a8b2f6e chore: bump vulnerable dependencies (#2669)
• 35e589d feat: update UUID validation to support versions 1-8, nil, max, and all (#2647)
• 042fb57 feat: add validateIf to validation options (#1579)
• 4fcad7b feat: add IsISO31661Numeric decorator for country codes (#2657)
• Additional commits viewable in compare view

Updates pg from 8.16.3 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

pg@8.23.0

• Add support for query pipelineing.

pg@8.22.0

• Add support for sslnegotiation=direct for PostgreSQL 17+.

pg@8.21.0

• Handle SASL SCRAM server error responses properly.
• Add support for node@26.
• Add scramMaxIterations config option.
• Add client.getTransactionStatus() method.

pg@8.20.0

• Add onConnect callback to pg.Pool constructor options allowing for async initialization of newly created & connected pooled clients.

pg@8.19.0

• Deprecate interal query queue.
• Pass connection parameters to password callback.

pg@8.18.0

• Return the client instance as the result of calling connect (previously it was void).

pg@8.17.0

• Throw correct error if database URL parsing fails.

pg@8.16.0

• Add support for min connection pool size.

pg@8.15.0

• Add support for esm importing. CommonJS importing is still also supported.

pg@8.14.0

• Add support for SCRAM-SHA-256-PLUS, i.e. channel binding.

... (truncated)

Commits

• 0980cef Publish
• 2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
• 7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
• 9683053 fix(pg): do not treat Sync as connection ending (#3772)
• 4589038 fix: validate server certificate against host when connecting to an IP addres...
• 9808955 cleanup: Fix typo in comment
• 2b02f64 fix: avoid mutating query config (#3720)
• 0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
• 2991480 Deprecate serializing invalid Dates (#3731)
• c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
• Additional commits viewable in compare view

Updates socket.io from 4.8.1 to 4.8.4

Release notes

Sourced from socket.io's releases.

socket.io@4.8.4

Bug Fixes

• cleanup pending acks on timeout to prevent memory leak (37aad11)
• prevent uWebSockets.js from serving missing client files (dfb5ab3)
• reject stateful regexps for dynamic namespaces (59f4f24)
• types: allow emitWithAck() for events with void callbacks (#5453) (8b93a18)
• types: properly import http module (74599a6)

Dependencies

• engine.io@~6.6.0 (no change)
• ws@~8.21.0 (diff)

socket.io-client@4.8.4

Bug Fixes

• types: export ExtendedError for connect_error event (#5548) (c0d5450)
• types: export reserved event interfaces (#5533) (03945df)

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.21.0 (diff)

socket.io@4.8.3

Bug Fixes

• do not throw when calling io.close() on a stopped server (9581f9b)

Dependencies

• engine.io@~6.6.0 (no change)
• ws@~8.18.3 (no change)

socket.io-client@4.8.3

There were some minor bug fixes on the server side, which mandate a client bump.

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.18.3 (diff)

socket.io@4.8.2

The url.parse() function is now deprecated and has been replaced by new URL() (see 8af7019).

Bug Fixes

... (truncated)

Commits

• c239eb5 chore(release): socket.io@4.8.4
• 11a6f56 chore(release): socket.io-client@4.8.4
• 00e4e73 chore(release): engine.io-client@6.6.7
• e387ab1 chore: use @​rollup/plugin-terser instead of rollup-plugin-terser
• 9738333 chore(release): engine.io@6.6.11
• fc9dd90 docs(eio): rework README
• da008a5 fix(eio): refresh ping timeout on incoming packets
• 3df3fed fix(eio-client): restore default transport resolution
• aaf2af3 test: upgrade WebdriverIO to v9
• b5da079 refactor(sio): simplify packet handling switch
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for socket.io since your current version.

Updates @eslint/eslintrc from 3.3.1 to 3.3.7

Release notes

Sourced from @​eslint/eslintrc's releases.

eslintrc: v3.3.7

3.3.7 (2026-09-01)

Bug Fixes

• Bump js-yaml to 4.3.1 (#239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#243) (bb0d97a)

eslintrc: v3.3.6

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

eslintrc: v3.3.5

3.3.5 (2026-03-04)

Bug Fixes

• update dependency minimatch to ^3.1.5 (#227) (3dc2381)

eslintrc: v3.3.4

3.3.4 (2026-02-22)

Bug Fixes

• update ajv to 6.14.0 to address security vulnerabilities (#221) (9139140)
• update minimatch to 3.1.3 to address security vulnerabilities (#224) (30339d0)

eslintrc: v3.3.3

3.3.3 (2025-11-28)

Bug Fixes

• release v3.3.3 because publishing v3.3.2 failed (#211) (8aa555a)

eslintrc: v3.3.2

3.3.2 (2025-11-25)

Bug Fixes

• Remove name property from all and recommended configs (#200) (344da49)

Changelog

Sourced from @​eslint/eslintrc's changelog.

3.3.7 (2026-09-01)

Bug Fixes

• Bump js-yaml to 4.3.1 (#239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#243) (bb0d97a)

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

3.3.5 (2026-03-04)

Bug Fixes

• update dependency minimatch to ^3.1.5 (#227) (3dc2381)

3.3.4 (2026-02-22)

Bug Fixes

• update ajv to 6.14.0 to address security vulnerabilities (#221) (9139140)
• update minimatch to 3.1.3 to address security vulnerabilities (#224) (30339d0)

3.3.3 (2025-11-28)

Bug Fixes

• release v3.3.3 because publishing v3.3.2 failed (#211) (8aa555a)

3.3.2 (2025-11-25)

Bug Fixes

• Remove name property from all and recommended configs (#200) (344da49)

Commits

• 7943fa6 chore: release 3.3.7 🚀 (#240)
• bb0d97a fix: update js-yaml to 4.3.2 to address security vulnerability (#243)
• 5b4abc9 docs: Update README sponsors
• f27e7c9 fix: Bump js-yaml to 4.3.1 (#239)
• b75e1d2 docs: Update README sponsors
• 302c133 docs: Update README sponsors
• e62e766 docs: Update README sponsors
• cf27f9f docs: Update README sponsors
• c7f4cdf docs: Update README sponsors
• 3319822 docs: Update README sponsors
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​eslint/eslintrc since your current version.

Updates @faker-js/faker from 10.5.0 to 10.6.0

Release notes

Sourced from @​faker-js/faker's releases.

v10.6.0

What's Changed

• fix(locale): exclude forbidden letter combinations from nl postcodes by @​chatman-media in faker-js/faker#3888
• feat(locale): add Norwegian (nb_NO) animal module by @​arvindfroi in faker-js/faker#3901
• feat(locale): add Norwegian (nb_NO) food module by @​arvindfroi in faker-js/faker#3900
• fix(locale): only generate valid French postal codes by @​MahinAnowar in faker-js/faker#3905
• feat(phone): mobile styles for more locales by @​matthewmayer in faker-js/faker#3902
• docs: add Deno to install instructions by @​bartlomieju in faker-js/faker#3907
• refactor(locale): normalize phone_number data by @​xDivisionByZerox in faker-js/faker#3518
• chore(deps): update devdependencies by @​renovate[bot] in faker-js/faker#3909
• chore(deps): update vitest to v4.1.9 by @​renovate[bot] in faker-js/faker#3910
• chore(deps): update actions/checkout action to v7 by @​renovate[bot] in faker-js/faker#3913
• chore(deps): update all non-major dependencies by @​renovate[bot] in faker-js/faker#3911
• chore(deps): update eslint by @​renovate[bot] in faker-js/faker#3912
• chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24 docker digest to 0cbad76 by @​renovate[bot] in faker-js/faker#3908
• infra: ignore tmp folder by @​Shinigami92 in faker-js/faker#3915
• chore(deps): lock file maintenance by @​renovate[bot] in faker-js/faker#3903
• chore: fix typo in helper module by @​hiSandog in faker-js/faker#3918
• docs(science): fix typo in Unit.symbol by @​hiSandog in faker-js/faker#3917
• fix: groupBy handling for prototype property keys by @​hiSandog in faker-js/faker#3906
• refactor(locale): add en_NP and change ne to Devangari by @​matthewmayer in faker-js/faker#3868
• chore(deps): update eslint (major) by @​renovate[bot] in faker-js/faker#3914
• chore: move modules to dedicated files by @​Shinigami92 in faker-js/faker#3890
• docs: merge iata hint into jsdocs by @​ST-DDT in faker-js/faker#3920
• test(science): make definition lookups actually assert by @​hiSandog in faker-js/faker#3919
• feat: introduce NumberRange type by @​Shinigami92 in faker-js/faker#3838
• chore: consistent type import paths by @​ST-DDT in faker-js/faker#3926
• feat(locale): add 060 Japanese mobile phone number formats by @​noritaka1166 in faker-js/faker#3922
• feat(locale): better organize first_name by gender for en by @​matthewmayer in faker-js/faker#3924
• chore: adjust generate:locales to directly import from definitions by @​ST-DDT in faker-js/faker#3927
• chore: fix last remaining import path by @​ST-DDT in faker-js/faker#3934
• feat(locale): better middle names by gender for en locale by @​matthewmayer in faker-js/faker#3932
• docs(datatype): drop the two-decimal-places note from boolean() by @​spokodev in faker-js/faker#3935
• refactor(location): distinguish between street_name_part and street_name by @​ST-DDT in faker-js/faker#3859
• fix(locale): use only common surnames for zh_CN last names by @​MahinAnowar in faker-js/faker#3938
• docs: remove incorrect part from string.sample jsdocs by @​ST-DDT in faker-js/faker#3941
• fix(internet): validate CIDR prefix length and octet range in ipv4() by @​hiSandog in faker-js/faker#3933
• docs(helpers): clarify fake() does not execute javascript by @​Shinigami92 in faker-js/faker#3945
• fix(internet): generate long passwords without stack overflow by @​Shinigami92 in faker-js/faker#3946
• docs: add object type, expand NumberRange param rows by @​Shinigami92 in faker-js/faker#3947
• feat(locale): add vehicle data for de by @​rodrigobnogueira in faker-js/faker#3958
• refactor: extract shared NumberOrRange type by @​Shinigami92 in faker-js/faker#3939
• docs(guide): document native ESM support for Jest 30.4.2+ by @​MahinAnowar in faker-js/faker#3957
• chore: replace import from dist by @​ST-DDT in faker-js/faker#3971
• fix(apidocs): scope code group tab identifiers by @​UlikGames in faker-js/faker#3976
• fix(word): pick nearest length for closest strategy by @​spokodev in faker-js/faker#3943
• fix(locale): use only valid letters in en_CA postcodes by @​MahinAnowar in faker-js/faker#3951
• fix(string): reject refDates that a ULID timestamp cannot encode by @​Jaybhade in faker-js/faker#3982
• refactor: extract shared LengthStrategy type by @​Shinigami92 in faker-js/faker#3940
• fix(internet): exclude reserved port 0 from internet.port() by @​xianjianlf2 in faker-js/faker#3948

... (truncated)

Changelog

Sourced from @​faker-js/faker's changelog.

10.6.0 (2026-08-14)

New Locales

• locale: add 060 Japanese mobile phone number formats (#3922) (afa272d)
• locale: add Norwegian (nb_NO) animal module (#3901) (1232937)
• locale: add Norwegian (nb_NO) food module (#3900) (bd23594)
• locale: add vehicle data for de (#3958) (974490f)
• locale: better middle names by gender for en locale (#3932) (aba3fb1)
• locale: better organize first_name by gender for en (#3924) (119386b)

Features

• introduce NumberRange type (#3838) (acd5fda)
• phone: mobile styles for more locales (#3902) (1107eab)

Changed Locales

• locale: add en_NP and change ne to Devangari (#3868) (fc788cc)
• locale: normalize phone_number data (#3518) (9a1cb7d)

Bug Fixes

• apidocs: scope code group tab identifiers (#3976) (3125eaf)
• color: give the LCH hue its full 360 degree range (#3978) (1ce5994)
• color: stop scaling the HSLA alpha into a percentage (#3979) (1143329)
• groupBy handling for prototype property keys (#3906) (c898ff1)
• internet: exclude reserved port 0 from internet.port() (#3948) (d4b35a4)
• internet: generate long passwords without stack overflow (#3946) (4782978)
• internet: validate CIDR prefix length and octet range in ipv4() (#3933) (15cb8fb)
• locale: exclude forbidden letter combinations from nl postcodes (#3888) (9bebe67)
• locale: only generate valid French postal codes (#3905) (711f36f)
• locale: update nl_BE phone number patterns (#3981) (9616076)
• locale: use only common surnames for zh_CN last names (#3938) (58394eb)
• locale: use only valid letters in en_CA postcodes (#3951) (3b184d6)
• string: reject refDates that a ULID timestamp cannot encode (#3982) (81717bc)
• vehicle: calculate VIN check digit (#3954) (a4c6757)
• word: pick nearest length for closest strategy (#3943) (

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 48f68715-4680-4473-a652-94099565f759

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}