Skip to content

build(deps): bump the production-dependencies group across 1 directory with 12 updates - #2372

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-1631441d8e
Open

build(deps): bump the production-dependencies group across 1 directory with 12 updates#2372
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-1631441d8e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 11 updates in the / directory:

Package From To
@sentry/node 10.70.0 10.73.0
express-rate-limit 8.6.2 8.7.0
@aws-sdk/client-cloudwatch 3.1116.0 3.1126.0
@aws-sdk/client-s3 3.1121.0 3.1126.0
@aws-sdk/s3-request-presigner 3.1121.0 3.1126.0
axios 1.19.0 1.20.0
groq-sdk 1.5.0 1.6.0
posthog-node 5.50.0 5.51.6
sharp 0.35.3 0.35.4
@anthropic-ai/sdk 0.120.0 0.123.0
@aws-sdk/client-ses 3.1116.0 3.1126.0

Updates @sentry/node from 10.70.0 to 10.73.0

Release notes

Sourced from @​sentry/node's releases.

10.73.0

Important Changes

  • feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

    withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

    // next.config.mjs
- import { withSentryConfig } from '@sentry/nextjs';
+ import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

  • feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)
  • fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)
  • test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

Bundle size 📦

Path Size
@​sentry/browser 27.1 KB
@​sentry/browser - with treeshaking flags 25.58 KB
@​sentry/browser (incl. Tracing) 45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.28 KB
@​sentry/browser (incl. Tracing, Profiling) 50.17 KB
@​sentry/browser (incl. Tracing, Replay) 83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.83 KB
@​sentry/browser (incl. Feedback) 43.87 KB
@​sentry/browser (incl. sendFeedback) 31.78 KB
@​sentry/browser (incl. FeedbackAsync) 36.79 KB
@​sentry/browser (incl. Metrics) 28.16 KB
@​sentry/browser (incl. Logs) 28.38 KB
@​sentry/browser (incl. Metrics & Logs) 29.06 KB
@​sentry/react 28.86 KB
@​sentry/react (incl. Tracing) 47.74 KB
@​sentry/vue 32.4 KB
@​sentry/vue (incl. Tracing) 47.46 KB
@​sentry/svelte 27.12 KB
CDN Bundle 29.43 KB

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.73.0

Important Changes

  • feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

    withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

    // next.config.mjs
- import { withSentryConfig } from '@sentry/nextjs';
+ import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

  • feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)
  • fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)
  • test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

10.72.0

Important Changes

  • AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

    Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

  • feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

    The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

  • fix(v10/astro): support astro v7 route patterns properly (#23657)
  • fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
  • fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
  • fix(v10/node): Only end the process session when it is still ok (#23731)
  • fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
  • fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
  • fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
  • fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
  • fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
  • fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

... (truncated)

Commits
  • f109d92 release: 10.73.0
  • 1a3e04e meta(changelog): Update changelog for 10.73.0 (#23778)
  • da8d769 test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)
  • bea4d38 feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler a...
  • 605caaf feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)
  • da17307 fix(v10/cloudflare): Instrument Durable Object handlers installed as read-onl...
  • 2c4ca38 Merge branch 'release/10.72.0' into v10
  • 0d23628 release: 10.72.0
  • ac2094d meta(changelog): Update changelog for 10.72.0 (#23743)
  • f325434 feat(v10/cloudflare): Derive rpcTracePropagationBindings from the wrangler co...
  • Additional commits viewable in compare view

Updates express-rate-limit from 8.6.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

Commits
  • 48db09e 8.7.0
  • dce5871 v8.7.0 changelog
  • 2f08044 Add inspect.software health badge (#673)
  • a29757c feat: add retryAfter option (#661)
  • 146e88b chore: rename license
  • 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
  • 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
  • 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
  • 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
  • 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
  • Additional commits viewable in compare view

Updates @aws-sdk/client-cloudwatch from 3.1116.0 to 3.1126.0

Release notes

Sourced from @​aws-sdk/client-cloudwatch's releases.

v3.1126.0

3.1126.0(2026-09-03)

Documentation Changes
  • client-sfn: Updates Step Functions API documentation around CloudTrail, Execution name reuse and sort order of ListExecutions API (8dda8b4b)
  • client-elastic-load-balancing-v2: This release adds support for sending TCP resets for Gateway Load Balancer when a flow's idle timeout expires, or when a target becomes unhealthy or is deregistered. This adds updates the CLI documentation. (a16f1659)
New Features
  • client-socialmessaging: Adding support for WhatsApp Flows with endpoints. (3a3a6205)
  • client-transfer: AWS Transfer Family SFTP Connectors now support specifying an ordered list of AWS Secrets Manager version stages for secret retrieval. This enables seamless credential rotation workflows where external partners may take time to update their systems with new credentials. (e4bf3ecc)
  • client-transcribe: Amazon Transcribe now supports specifying up to 29 PII entity types in the ContentRedaction configuration of a StartTranscriptionJob request, allowing all supported entity types to be redacted in a single batch transcription job. (5fb0b9a5)
  • client-connect: This release enables TagOnCreate for Rule resource on CreateRule API. It also introduces a new field called PreEvaluationFilters to Rule resource, thereby impacting all Create, Update, Describe and Search APIs for Rules (18bb14bc)
  • client-ecs: Adds a critical parameter to the Amazon ECS managed daemon APIs that controls whether a daemon task failure drains the container instance. Non-critical daemon failures no longer drain the instance or block instance registration. (2e6a07d5)
  • client-evs: Amazon EVS now allows users to set, update, and retrieve values for parameters that apply across all EVS Environments in their account at a regional level, such as the VCF License portability core count. (803b694c)
  • client-drs: AWS Elastic Disaster Recovery now includes source server architecture in SourceProperties to identify x86 and ARM64 systems. (20f19e0e)
  • client-bedrock-agentcore: Adds log group name prefix trace source selection, custom or source log group result destinations, and metrics namespace customization (823b2d33)
  • client-bedrock-agentcore-control: AgentCore Identity adds Consent Portal APIs to manage portals that let end users grant OAuth authorization for agents to access resources. AgentCore Evaluation adds trace source selection by log group prefix, custom or source log group result destinations, and metrics namespace customization. (2f826477)
  • client-eks: Deprecate EncryptionConfig resources field. Amazon EKS encrypts all Kubernetes API data with envelope encryption by default for clusters running Kubernetes version 1.28 or higher, so this field no longer affects which resources are encrypted. (c66ca41b)
  • client-guardduty: Adding support for Sequence Activities in GuardDuty Findings (5c12a0eb)
  • lib-transfer-manager: add download directory functionality (#8274) (6e591ee8)

For list of updated packages, view updated-packages.md in assets-3.1126.0.zip

v3.1125.0

3.1125.0(2026-09-02)

New Features
  • client-ec2: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. (336c7896)
  • client-sagemaker-featurestore-runtime: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . (71920960)
  • client-sagemaker: Amazon SageMaker Feature Store now supports the Standard V2 online store type, which enables feature-level writes to feature groups. You can select Standard V2 when creating a feature group, and update the storage type of an existing feature group via UpdateFeatureGroup. (5287db7f)
  • client-odb: Adds the ListFlexComponents API for listing the flex components available for a given DB system shape. (551174bf)
  • client-mgn: AWS Transform for migrations adds a second network migration option - apply your source security posture to existing VPCs. Upload a source network file with firewall rules, tag the in-scope VPCs, and AWS Transform matches source subnets to them by CIDR and generates the security groups. (822144b2)
  • client-mwaa: Enabled customers to clear optional S3 paths (plugins, requirements, and startup script) for their Amazon MWAA environments by accepting empty strings for the associated fields in UpdateEnvironment requests. (9fa2e0c1)
  • client-bedrock-agentcore: Batch evaluation now supports up to 10 CloudWatch log groups per CloudWatchLogsSource (cebd3179)
  • client-medialive: AWS Elemental MediaLive now supports AB forensic video watermarking (d48e9e15)
  • client-appintegrations: This release adds a force parameter to DeleteApplication and a ConflictException to UpdateApplication, letting customers delete applications with existing associations in one call and get a clear error when an update conflicts with the application's current state. (62b7304c)
Bug Fixes
  • cloudfront-signer: preserve plus in query strings when signing URLs (#8283) (dd76a0dd)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-cloudwatch's changelog.

3.1126.0 (2026-09-03)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1124.0 (2026-09-01)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1123.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1122.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1121.0 (2026-08-28)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1120.0 (2026-08-27)

... (truncated)

Commits

Updates @aws-sdk/client-s3 from 3.1121.0 to 3.1126.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1126.0

3.1126.0(2026-09-03)

Documentation Changes
  • client-sfn: Updates Step Functions API documentation around CloudTrail, Execution name reuse and sort order of ListExecutions API (8dda8b4b)
  • client-elastic-load-balancing-v2: This release adds support for sending TCP resets for Gateway Load Balancer when a flow's idle timeout expires, or when a target becomes unhealthy or is deregistered. This adds updates the CLI documentation. (a16f1659)
New Features
  • client-socialmessaging: Adding support for WhatsApp Flows with endpoints. (3a3a6205)
  • client-transfer: AWS Transfer Family SFTP Connectors now support specifying an ordered list of AWS Secrets Manager version stages for secret retrieval. This enables seamless credential rotation workflows where external partners may take time to update their systems with new credentials. (e4bf3ecc)
  • client-transcribe: Amazon Transcribe now supports specifying up to 29 PII entity types in the ContentRedaction configuration of a StartTranscriptionJob request, allowing all supported entity types to be redacted in a single batch transcription job. (5fb0b9a5)
  • client-connect: This release enables TagOnCreate for Rule resource on CreateRule API. It also introduces a new field called PreEvaluationFilters to Rule resource, thereby impacting all Create, Update, Describe and Search APIs for Rules (18bb14bc)
  • client-ecs: Adds a critical parameter to the Amazon ECS managed daemon APIs that controls whether a daemon task failure drains the container instance. Non-critical daemon failures no longer drain the instance or block instance registration. (2e6a07d5)
  • client-evs: Amazon EVS now allows users to set, update, and retrieve values for parameters that apply across all EVS Environments in their account at a regional level, such as the VCF License portability core count. (803b694c)
  • client-drs: AWS Elastic Disaster Recovery now includes source server architecture in SourceProperties to identify x86 and ARM64 systems. (20f19e0e)
  • client-bedrock-agentcore: Adds log group name prefix trace source selection, custom or source log group result destinations, and metrics namespace customization (823b2d33)
  • client-bedrock-agentcore-control: AgentCore Identity adds Consent Portal APIs to manage portals that let end users grant OAuth authorization for agents to access resources. AgentCore Evaluation adds trace source selection by log group prefix, custom or source log group result destinations, and metrics namespace customization. (2f826477)
  • client-eks: Deprecate EncryptionConfig resources field. Amazon EKS encrypts all Kubernetes API data with envelope encryption by default for clusters running Kubernetes version 1.28 or higher, so this field no longer affects which resources are encrypted. (c66ca41b)
  • client-guardduty: Adding support for Sequence Activities in GuardDuty Findings (5c12a0eb)
  • lib-transfer-manager: add download directory functionality (#8274) (6e591ee8)

For list of updated packages, view updated-packages.md in assets-3.1126.0.zip

v3.1125.0

3.1125.0(2026-09-02)

New Features
  • client-ec2: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. (336c7896)
  • client-sagemaker-featurestore-runtime: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . (71920960)
  • client-sagemaker: Amazon SageMaker Feature Store now supports the Standard V2 online store type, which enables feature-level writes to feature groups. You can select Standard V2 when creating a feature group, and update the storage type of an existing feature group via UpdateFeatureGroup. (5287db7f)
  • client-odb: Adds the ListFlexComponents API for listing the flex components available for a given DB system shape. (551174bf)
  • client-mgn: AWS Transform for migrations adds a second network migration option - apply your source security posture to existing VPCs. Upload a source network file with firewall rules, tag the in-scope VPCs, and AWS Transform matches source subnets to them by CIDR and generates the security groups. (822144b2)
  • client-mwaa: Enabled customers to clear optional S3 paths (plugins, requirements, and startup script) for their Amazon MWAA environments by accepting empty strings for the associated fields in UpdateEnvironment requests. (9fa2e0c1)
  • client-bedrock-agentcore: Batch evaluation now supports up to 10 CloudWatch log groups per CloudWatchLogsSource (cebd3179)
  • client-medialive: AWS Elemental MediaLive now supports AB forensic video watermarking (d48e9e15)
  • client-appintegrations: This release adds a force parameter to DeleteApplication and a ConflictException to UpdateApplication, letting customers delete applications with existing associations in one call and get a clear error when an update conflicts with the application's current state. (62b7304c)
Bug Fixes
  • cloudfront-signer: preserve plus in query strings when signing URLs (#8283) (dd76a0dd)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1126.0 (2026-09-03)

Note: Version bump only for package @​aws-sdk/client-s3

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/client-s3

3.1124.0 (2026-09-01)

Note: Version bump only for package @​aws-sdk/client-s3

3.1123.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/client-s3

3.1122.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

Updates @aws-sdk/s3-request-presigner from 3.1121.0 to 3.1126.0

Release notes

Sourced from @​aws-sdk/s3-request-presigner's releases.

v3.1126.0

3.1126.0(2026-09-03)

Documentation Changes
  • client-sfn: Updates Step Functions API documentation around CloudTrail, Execution name reuse and sort order of ListExecutions API (8dda8b4b)
  • client-elastic-load-balancing-v2: This release adds support for sending TCP resets for Gateway Load Balancer when a flow's idle timeout expires, or when a target becomes unhealthy or is deregistered. This adds updates the CLI documentation. (a16f1659)
New Features
  • client-socialmessaging: Adding support for WhatsApp Flows with endpoints. (3a3a6205)
  • client-transfer: AWS Transfer Family SFTP Connectors now support specifying an ordered list of AWS Secrets Manager version stages for secret retrieval. This enables seamless credential rotation workflows where external partners may take time to update their systems with new credentials. (e4bf3ecc)
  • client-transcribe: Amazon Transcribe now supports specifying up to 29 PII entity types in the ContentRedaction configuration of a StartTranscriptionJob request, allowing all supported entity types to be redacted in a single batch transcription job. (5fb0b9a5)
  • client-connect: This release enables TagOnCreate for Rule resource on CreateRule API. It also introduces a new field called PreEvaluationFilters to Rule resource, thereby impacting all Create, Update, Describe and Search APIs for Rules (18bb14bc)
  • client-ecs: Adds a critical parameter to the Amazon ECS managed daemon APIs that controls whether a daemon task failure drains the container instance. Non-critical daemon failures no longer drain the instance or block instance registration. (2e6a07d5)
  • client-evs: Amazon EVS now allows users to set, update, and retrieve values for parameters that apply across all EVS Environments in their account at a regional level, such as the VCF License portability core count. (803b694c)
  • client-drs: AWS Elastic Disaster Recovery now includes source server architecture in SourceProperties to identify x86 and ARM64 systems. (20f19e0e)
  • client-bedrock-agentcore: Adds log group name prefix trace source selection, custom or source log group result destinations, and metrics namespace customization (823b2d33)
  • client-bedrock-agentcore-control: AgentCore Identity adds Consent Portal APIs to manage portals that let end users grant OAuth authorization for agents to access resources. AgentCore Evaluation adds trace source selection by log group prefix, custom or source log group result destinations, and metrics namespace customization. (2f826477)
  • client-eks: Deprecate EncryptionConfig resources field. Amazon EKS encrypts all Kubernetes API data with envelope encryption by default for clusters running Kubernetes version 1.28 or higher, so this field no longer affects which resources are encrypted. (c66ca41b)
  • client-guardduty: Adding support for Sequence Activities in GuardDuty Findings (5c12a0eb)
  • lib-transfer-manager: add download directory functionality (#8274) (6e591ee8)

For list of updated packages, view updated-packages.md in assets-3.1126.0.zip

v3.1125.0

3.1125.0(2026-09-02)

New Features
  • client-ec2: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. (336c7896)
  • client-sagemaker-featurestore-runtime: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . (71920960)
  • client-sagemaker: Amazon SageMaker Feature Store now supports the Standard V2 online store type, which enables feature-level writes to feature groups. You can select Standard V2 when creating a feature group, and update the storage type of an existing feature group via UpdateFeatureGroup. (5287db7f)
  • client-odb: Adds the ListFlexComponents API for listing the flex components available for a given DB system shape. (551174bf)
  • client-mgn: AWS Transform for migrations adds a second network migration option - apply your source security posture to existing VPCs. Upload a source network file with firewall rules, tag the in-scope VPCs, and AWS Transform matches source subnets to them by CIDR and generates the security groups. (822144b2)
  • client-mwaa: Enabled customers to clear optional S3 paths (plugins, requirements, and startup script) for their Amazon MWAA environments by accepting empty strings for the associated fields in UpdateEnvironment requests. (9fa2e0c1)
  • client-bedrock-agentcore: Batch evaluation now supports up to 10 CloudWatch log groups per CloudWatchLogsSource (cebd3179)
  • client-medialive: AWS Elemental MediaLive now supports AB forensic video watermarking (d48e9e15)
  • client-appintegrations: This release adds a force parameter to DeleteApplication and a ConflictException to UpdateApplication, letting customers delete applications with existing associations in one call and get a clear error when an update conflicts with the application's current state. (62b7304c)
Bug Fixes
  • cloudfront-signer: preserve plus in query strings when signing URLs (#8283) (dd76a0dd)

... (truncated)

Changelog

Sourced from @​aws-sdk/s3-request-presigner's changelog.

3.1126.0 (2026-09-03)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1124.0 (2026-09-01)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1123.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1122.0 (2026-08-31)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

Commits

Updates axios from 1.19.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

  • Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
  • Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
  • Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
  • CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

Changelog

Sourced from axios's changelog.

Changelog

Commits
  • 84a9f3b chore(release): prepare release 1.20.0 (#11152)
  • e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
  • d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
  • 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
  • d19040b fix: harden runtime option handling (#11141)
  • e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
  • d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
  • 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
  • 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
  • ba98559 docs: add ScrapingBee sponsor (#11137)
  • Additional commits viewable in compare view

Updates groq-sdk from 1.5.0 to 1.6.0

Release notes

Sourced from groq-sdk's releases.

v1.6.0

1.6.0 (2026-08-25)

Full Changelog: v1.5.0...v1.6.0

Features

  • chat: add Qwen3.8 reasoning guidance (c2b0264)

Chores

  • GitHub Terraform: Create/Update .github/workflows/code-freeze-bypass.yaml [skip ci] (99fc8ef)
  • GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci] (8d224a0)
  • GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci] (2c5b7aa)
  • internal: allow the mock server port to be set with STAINLESS_MOCK_PORT (90cec2d)

Styles

  • chat: format completion params union (91d9de9)
Changelog

Sourced from groq-sdk's changelog.

1.6.0 (2026-08-25)

Full Changelog: v1.5.0...v1.6.0

Features

  • chat: add Qwen3.8 reasoning guidance (c2b0264)

Chores

  • GitHub Terraform: Create/Update .github/workflows/code-freeze-bypass.yaml [skip ci] (99fc8ef)
  • GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci] (8d224a0)
  • GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci] (2c5b7aa)
  • internal: allow the mock server port to be set with STAINLESS_MOCK_PORT (90cec2d)

Styles

  • chat: format completion params union (91d9de9)
Commits
  • 6de8d02 release: 1.6.0 (#273)
  • 8d224a0 chore: GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci]
  • 2c5b7aa chore: GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci]
  • 99fc8ef chore: GitHub Terraform: Create/Update .github/workflows/code-freeze-bypass.y...
  • See full diff in compare view

Updates posthog-node from 5.50.0 to 5.51.6

Release notes

Sourced from posthog-node's releases.

posthog-node@5.51.6

5.51.6

Patch Changes

posthog-node@5.51.5

5.51.5

Patch Changes

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 6, 2026
@dependabot
build(deps): bump the production-dependencies group across 1 director…
b81943d 
…y with 12 updates

Bumps the production-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.70.0` | `10.73.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.2` | `8.7.0` |
| [@aws-sdk/client-cloudwatch](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-cloudwatch) | `3.1116.0` | `3.1126.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1121.0` | `3.1126.0` |
| [@aws-sdk/s3-request-presigner](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/s3-request-presigner) | `3.1121.0` | `3.1126.0` |
| [axios](https://github.com/axios/axios) | `1.19.0` | `1.20.0` |
| [groq-sdk](https://github.com/groq/groq-typescript) | `1.5.0` | `1.6.0` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.50.0` | `5.51.6` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.4` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.120.0` | `0.123.0` |
| [@aws-sdk/client-ses](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ses) | `3.1116.0` | `3.1126.0` |



Updates `@sentry/node` from 10.70.0 to 10.73.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.73.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.70.0...10.73.0)

Updates `express-rate-limit` from 8.6.2 to 8.7.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.6.2...v8.7.0)

Updates `@aws-sdk/client-cloudwatch` from 3.1116.0 to 3.1126.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-cloudwatch/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1126.0/clients/client-cloudwatch)

Updates `@aws-sdk/client-s3` from 3.1121.0 to 3.1126.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1126.0/clients/client-s3)

Updates `@aws-sdk/s3-request-presigner` from 3.1121.0 to 3.1126.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/s3-request-presigner/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1126.0/packages/s3-request-presigner)

Updates `axios` from 1.19.0 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.19.0...v1.20.0)

Updates `groq-sdk` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/groq/groq-typescript/releases)
- [Changelog](https://github.com/groq/groq-typescript/blob/main/CHANGELOG.md)
- [Commits](groq/groq-typescript@v1.5.0...v1.6.0)

Updates `posthog-node` from 5.50.0 to 5.51.6
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.51.6/packages/node)

Updates `sharp` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.4)

Updates `@anthropic-ai/sdk` from 0.120.0 to 0.123.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.120.0...sdk-v0.123.0)

Updates `@aws-sdk/client-ses` from 3.1116.0 to 3.1126.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ses/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1126.0/clients/client-ses)

Updates `@sentry/core` from 10.70.0 to 10.73.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.73.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.70.0...10.73.0)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.123.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-cloudwatch"
  dependency-version: 3.1125.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1125.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-ses"
  dependency-version: 3.1125.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/s3-request-presigner"
  dependency-version: 3.1125.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/core"
  dependency-version: 10.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/node"
  dependency-version: 10.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: groq-sdk
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: posthog-node
  dependency-version: 5.51.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-1631441d8e branch from 2aa9dbd to b81943d Compare September 6, 2026 20:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants