Skip to content

Bump the proxy-dependencies group across 1 directory with 10 updates - #24

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/render-proxy/proxy-dependencies-70dc01d5cc
Open

Bump the proxy-dependencies group across 1 directory with 10 updates#24
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/render-proxy/proxy-dependencies-70dc01d5cc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 16, 2026

Copy link
Copy Markdown

Bumps the proxy-dependencies group with 10 updates in the /render-proxy directory:

Package From To
@napi-rs/canvas 0.1.69 1.0.6
express 4.22.2 5.2.1
express-rate-limit 7.5.1 8.6.2
helmet 7.2.0 8.3.0
mammoth 1.12.0 1.12.1
multer 1.4.5-lts.2 2.2.0
pdf-parse 1.1.4 2.4.5
pdfjs-dist 4.2.67 6.2.108
redis 4.7.1 6.2.1
tesseract.js 5.1.1 7.0.0

Updates @napi-rs/canvas from 0.1.69 to 1.0.6

Release notes

Sourced from @​napi-rs/canvas's releases.

v1.0.6

What's Changed

Full Changelog: Brooooooklyn/canvas@v1.0.5...v1.0.6

v1.0.5

What's Changed

Full Changelog: Brooooooklyn/canvas@v1.0.4...v1.0.5

v1.0.4

What's Changed

Full Changelog: Brooooooklyn/canvas@v1.0.3...v1.0.4

v1.0.3

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from @​napi-rs/canvas's changelog.

1.0.6 (2026-08-13)

Bug Fixes

1.0.5 (2026-08-09)

Bug Fixes

1.0.4 (2026-08-01)

Bug Fixes

  • shadow: restore blur rendering performance (#1305) (4dddd0d)

1.0.3 (2026-07-28)

Bug Fixes

  • deps: update rust crate imagesize to 0.15 (#1290) (2ad119e)
  • deps: update rust crate infer to 0.22 (#1294) (dc3377f)
  • shadow: align Canvas2D shadows with Chromium (#1300) (5646339)
  • shadow: apply shadowColor alpha once instead of squaring it (#1298) (2cd4e1a), closes #1297

Features

1.0.2 (2026-06-30)

Features

1.0.1 (2026-06-24)

Bug Fixes

  • link aarch64-pc-windows-msvc against static CRT (#1276) (8483662)
  • missing icudtl.dat in win32-arm64 package (#1278) (e1a75d1)

1.0.0 (2026-05-04)

0.1.100 (2026-04-26)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​napi-rs/canvas since your current version.


Updates express from 4.22.2 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

5.1.0 / 2025-03-31

  • Add support for Uint8Array in res.send()
  • Add support for ETag option in res.sendFile()
  • Add support for multiple links with the same rel in res.links()
  • Add funding field to package.json
  • perf: use loop for acceptParams
  • refactor: prefix built-in node module imports
  • deps: remove setprototypeof
  • deps: remove safe-buffer
  • deps: remove utils-merge
  • deps: remove methods
  • deps: remove depd
  • deps: debug@^4.4.0
  • deps: body-parser@^2.2.0
  • deps: router@^2.2.0
  • deps: content-type@^1.0.5
  • deps: finalhandler@^2.1.0
  • deps: qs@^6.14.0
  • deps: server-static@2.2.0
  • deps: type-is@2.0.1

5.0.1 / 2024-10-08

5.0.0 / 2024-09-10

  • remove:
    • path-is-absolute dependency - use path.isAbsolute instead
  • breaking:
    • res.status() accepts only integers, and input must be greater than 99 and less than 1000
      • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
      • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
    • deps: send@1.0.0

... (truncated)

Commits

Updates express-rate-limit from 7.5.1 to 8.6.2

Release notes

Sourced from express-rate-limit's releases.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

v8.5.2

You can view the changelog here.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

v8.4.1

You can view the changelog here.

v8.4.0

You can view the changelog here.

v8.3.2

You can view the changelog here.

v8.3.1

You can view the changelog here.

v8.3.0

You can view the changelog here.

v8.2.1

You can view the changelog here.

v8.2.0

You can view the changelog here.

v8.1.0

You can view the changelog here.

v8.0.1

You can view the changelog here.

v8.0.0

You can view the changelog here.

Commits
  • c416f78 8.6.2
  • defb334 v8.6.2 changelog
  • 7dd82cf fix: key IPv4-in-IPv6 addresses by range, not notation (#667)
  • 4e23dbb chore(deps): bump ip-address from 10.3.1 to 10.4.0 (#666)
  • 607ef1f chore(deps): bump ip-address from 10.2.0 to 10.3.1 (#664)
  • d2370f6 chore(deps-dev): bump the development-dependencies group with 5 updates (#663)
  • c7fced5 8.6.1
  • b21110e chore: deprecate millisecond-based time constants (#662)
  • fad3d85 chore(deps-dev): bump the development-dependencies group with 4 updates (#660)
  • fffb3c4 8.6.0
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates helmet from 7.2.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

  • Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
  • Content-Security-Policy: improved error handling for invalid directive names

Fixed

  • Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
  • Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
  • Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

  • Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
  • Improve error message when passing duplicate options

8.1.0 - 2025-03-17

Changed

  • Content-Security-Policy gives a better error when a directive value, like self, should be quoted. See #482

8.0.0 - 2024-09-28

Changed

  • Breaking: Strict-Transport-Security now has a max-age of 365 days, up from 180
  • Breaking: Content-Security-Policy middleware now throws an error if a directive should have quotes but does not, such as self instead of 'self'. See #454
  • Breaking: Content-Security-Policy's getDefaultDirectives now returns a deep copy. This only affects users who were mutating the result
  • Breaking: Strict-Transport-Security now throws an error when "includeSubDomains" option is misspelled. This was previously a warning

Removed

  • Breaking: Drop support for Node 16 and 17. Node 18+ is now required
Commits
  • 75f1a98 8.3.0
  • f03f70d Update changelog for 8.3.0 release
  • a307fce Fix capitalization in CSP package changelog
  • 5347b43 Format default CSP in README for readability
  • 9afc570 CSP: fix middleware-specific README missing link
  • 266c95c Minor speedups to project setups test
  • 7a4196c CSP: update package-specific changelog
  • 02716b4 CSP: improve performance when there are no dynamic directives
  • 3f511ed CSP: move utility functions to separate file
  • 80338af CSP: disabling defaults with no directives is now an error
  • Additional commits viewable in compare view

Updates mammoth from 1.12.0 to 1.12.1

Changelog

Sourced from mammoth's changelog.

1.12.1

  • Fix: on Windows, when an image's content type includes a backslash in the subpart, files may be written outside of the directory set by --output-dir.

  • Detect and ignore numbering levels that use numStyleLink to refer to themselves.

Commits
  • e3b9cec Bump version to 1.12.1
  • c69ea62 Ignore numbering levels that use numStyleLink to refer to themselves
  • fbf5e22 Check image content type for backslashes
  • 1a495a9 Add note on performance
  • ee59684 Remove donations section
  • See full diff in compare view

Updates multer from 1.4.5-lts.2 to 2.2.0

Release notes

Sourced from multer's releases.

v2.2.0

Important

What's Changed

New Contributors

Full Changelog: expressjs/multer@v2.1.1...v2.2.0

v2.1.1

Important

What's Changed

New Contributors

Full Changelog: expressjs/multer@v2.1.0...v2.1.1

v2.1.0

Important

What's Changed

... (truncated)

Changelog

Sourced from multer's changelog.

2.2.0

2.1.1

2.1.0

2.0.2

2.0.1

2.0.0

Commits
  • 2e2af08 2.2.0 (#1412)
  • a192b52 feat: add fieldNestingDepth limit option
  • 9c801c7 fix: clean up in-progress disk writes on abort
  • 0adb21d ci: add Node 26 to test matrix (#1404)
  • f5e17c3 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1410)
  • de1fefd chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 (#1409)
  • 67abfc8 chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1397)
  • 368c8a1 2.1.1 (#1380)
  • 7e66481 🐛 fix recursion issue
  • 643571e ✅ add explicit test for client able to send body without abrupt disconnect
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for multer since your current version.


Updates pdf-parse from 1.1.4 to 2.4.5

Release notes

Sourced from pdf-parse's releases.

Release v2.4.5

What's Changed

🚨 Breaking Changes

📚 Documentation

Full Changelog: mehmet-kozan/pdf-parse@v2.4.4...v2.4.5

Release v2.4.4

What's Changed

🚨 Breaking Changes

✨ New Features

📚 Documentation

🧰 Other Changes

Full Changelog: mehmet-kozan/pdf-parse@v2.4.3...v2.4.4

Release v2.4.4-beta.1

What's Changed

🚨 Breaking Changes

✨ New Features

📚 Documentation

🧰 Other Changes

... (truncated)

Commits
  • e8e800b Remove Tidelift funding option
  • 614e669 Integration test dependency fix (#38)
  • cff0ae1 For browser build, set the background web worker explicitly. (#37)
  • 54937b6 Update README.md
  • 1e87edd Update API Extractor config and rename API docs
  • c153bf7 Release v2.4.4 and update README formatting
  • 69eec3e NPM publish workflow now triggers only on published releases. (#33)
  • 1bfae05 Command-line interface for quick PDF processing implemented. (#32)
  • 8a7a044 CDN urls updated pdf-parse/utils replaced with pdf-parse/node (#31)
  • 4b6c46e getTable() return type changed. (#30)
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates pdfjs-dist from 4.2.67 to 6.2.108

Release notes

Sourced from pdfjs-dist's releases.

v6.2.108

This release contains improvements for annotation rendering, annotation editing, font conversion, image conversion, performance, SMask handling and text selection.

Changes since v6.1.200

@dependabot
Bump the proxy-dependencies group across 1 directory with 10 updates
76621d2 
Bumps the proxy-dependencies group with 10 updates in the /render-proxy directory:

| Package | From | To |
| --- | --- | --- |
| [@napi-rs/canvas](https://github.com/Brooooooklyn/canvas) | `0.1.69` | `1.0.6` |
| [express](https://github.com/expressjs/express) | `4.22.2` | `5.2.1` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `7.5.1` | `8.6.2` |
| [helmet](https://github.com/helmetjs/helmet) | `7.2.0` | `8.3.0` |
| [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.12.0` | `1.12.1` |
| [multer](https://github.com/expressjs/multer) | `1.4.5-lts.2` | `2.2.0` |
| [pdf-parse](https://github.com/mehmet-kozan/pdf-parse) | `1.1.4` | `2.4.5` |
| [pdfjs-dist](https://github.com/mozilla/pdf.js) | `4.2.67` | `6.2.108` |
| [redis](https://github.com/redis/node-redis) | `4.7.1` | `6.2.1` |
| [tesseract.js](https://github.com/naptha/tesseract.js) | `5.1.1` | `7.0.0` |



Updates `@napi-rs/canvas` from 0.1.69 to 1.0.6
- [Release notes](https://github.com/Brooooooklyn/canvas/releases)
- [Changelog](https://github.com/Brooooooklyn/canvas/blob/main/CHANGELOG.md)
- [Commits](Brooooooklyn/canvas@v0.1.69...v1.0.6)

Updates `express` from 4.22.2 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v4.22.2...v5.2.1)

Updates `express-rate-limit` from 7.5.1 to 8.6.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.6.2)

Updates `helmet` from 7.2.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v7.2.0...v8.3.0)

Updates `mammoth` from 1.12.0 to 1.12.1
- [Release notes](https://github.com/mwilliamson/mammoth.js/releases)
- [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS)
- [Commits](mwilliamson/mammoth.js@1.12.0...1.12.1)

Updates `multer` from 1.4.5-lts.2 to 2.2.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v1.4.5-lts.2...v2.2.0)

Updates `pdf-parse` from 1.1.4 to 2.4.5
- [Release notes](https://github.com/mehmet-kozan/pdf-parse/releases)
- [Commits](mehmet-kozan/pdf-parse@v1.1.4...v2.4.5)

Updates `pdfjs-dist` from 4.2.67 to 6.2.108
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](mozilla/pdf.js@v4.2.67...v6.2.108)

Updates `redis` from 4.7.1 to 6.2.1
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@4.7.1...redis@6.2.1)

Updates `tesseract.js` from 5.1.1 to 7.0.0
- [Release notes](https://github.com/naptha/tesseract.js/releases)
- [Commits](naptha/tesseract.js@v5.1.1...v7.0.0)

---
updated-dependencies:
- dependency-name: "@napi-rs/canvas"
  dependency-version: 1.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.6.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: mammoth
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: proxy-dependencies
- dependency-name: multer
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: pdf-parse
  dependency-version: 2.4.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: pdfjs-dist
  dependency-version: 6.2.108
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: redis
  dependency-version: 6.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
- dependency-name: tesseract.js
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: proxy-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants