Skip to content

build(deps): bump the dependencies group with 17 updates#276

Merged
elizabetheonoja-art merged 1 commit intomainfrom
dependabot/npm_and_yarn/dependencies-7daf7f9df2
Apr 30, 2026
Merged

build(deps): bump the dependencies group with 17 updates#276
elizabetheonoja-art merged 1 commit intomainfrom
dependabot/npm_and_yarn/dependencies-7daf7f9df2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 30, 2026

Bumps the dependencies group with 17 updates:

Package From To
@apollo/server 4.13.0 5.5.0
@sentry/node 10.50.0 10.51.0
archiver 6.0.2 7.0.1
bullmq 5.76.3 5.76.4
date-fns 3.6.0 4.1.0
dotenv 16.6.1 17.4.2
express-rate-limit 7.5.1 8.4.1
node-vault 0.10.10 0.12.0
rate-limiter-flexible 4.0.1 11.0.1
redis 4.7.1 5.12.1
stripe 17.7.0 22.1.0
@opentelemetry/sdk-node 0.215.0 0.216.0
@opentelemetry/auto-instrumentations-node 0.73.0 0.74.0
@opentelemetry/exporter-trace-otlp-http 0.215.0 0.216.0
@opentelemetry/sdk-trace-base 2.7.0 2.7.1
@types/jest 29.5.14 30.0.0
commander 13.1.0 14.0.3

Updates @apollo/server from 4.13.0 to 5.5.0

Release notes

Sourced from @​apollo/server's releases.

@​apollo/server-integration-testsuite@​5.5.0

Minor Changes

  • #8191 ada1200 - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

Patch Changes

  • Updated dependencies [ada1200]:
    • @​apollo/server@​5.5.0

@​apollo/server@​5.5.0

Minor Changes

  • #8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

@​apollo/server-integration-testsuite@​5.4.0

Patch Changes

  • Updated dependencies [d25a5bd]:
    • @​apollo/server@​5.4.0

@​apollo/server@​5.4.0

Minor Changes

... (truncated)

Changelog

Sourced from @​apollo/server's changelog.

5.5.0

Minor Changes

  • #8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

5.4.0

Minor Changes

  • d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

    The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

    In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8. Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now. In a future major release, we may tighten this restriction further to only allow UTF-8.

    If you were not using startStandaloneServer, you were not affected by this vulnerability.

    Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server. For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

5.3.0

Minor Changes

  • #8062 8e54e58 Thanks @​cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)

    const server = new ApolloServer({
  typeDefs,
  resolvers,
  executionOptions: {
    maxCoercionErrors: 50,
  },

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​apollo/server since your current version.


Updates @sentry/node from 10.50.0 to 10.51.0

Release notes

Sourced from @​sentry/node's releases.

10.51.0

Important Changes

  • feat(cloudflare): Add trace propagation for RPC method calls (#20343)

    Trace context is now propagated across Cloudflare Workers RPC calls, connecting traces between Workers and Durable Objects. This feature is opt-in and requires setting enableRpcTracePropagation: true in your SDK configuration:

    // Worker
export default Sentry.withSentry(
  env => ({
    dsn: env.SENTRY_DSN,
    enableRpcTracePropagation: true,
  }),
  handler,
);
// Durable Object
export const MyDurableObject = Sentry.instrumentDurableObjectWithSentry(
env => ({
dsn: env.SENTRY_DSN,
enableRpcTracePropagation: true,
}),
MyDurableObjectBase,
);

  • feat(hono)!: Change setup for @sentry/hono/node (init in external file) (#20497)

    To improve Node.js instrumentation, the sentry() middleware exported from @sentry/hono/node no longer accepts configuration options. Instead, you must configure the SDK by calling Sentry.init() in a dedicated instrumentation file that runs before your application code (read more in the Hono SDK readme:

    // instrument.mjs (or instrument.ts)
import * as Sentry from '@sentry/hono/node';
Sentry.init({
dsn: 'DSN',
tracesSampleRate: 1.0,
});

  • feat(nitro): Add @sentry/nitro SDK (#19224)

    A new @sentry/nitro package provides first-class Sentry support for Nitro applications, with HTTP handler and error instrumentation, middleware tracing, request isolation, and build-time source map uploading via withSentryConfig. Read more in the Nitro SDK docs and the Nitro SDK readme.

Other Changes

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.51.0

Important Changes

  • feat(cloudflare): Add trace propagation for RPC method calls (#20343)

    Trace context is now propagated across Cloudflare Workers RPC calls, connecting traces between Workers and Durable Objects. This feature is opt-in and requires setting enableRpcTracePropagation: true in your SDK configuration:

    // Worker
export default Sentry.withSentry(
  env => ({
    dsn: env.SENTRY_DSN,
    enableRpcTracePropagation: true,
  }),
  handler,
);
// Durable Object
export const MyDurableObject = Sentry.instrumentDurableObjectWithSentry(
env => ({
dsn: env.SENTRY_DSN,
enableRpcTracePropagation: true,
}),
MyDurableObjectBase,
);

  • feat(hono)!: Change setup for @sentry/hono/node (init in external file) (#20497)

    To improve Node.js instrumentation, the sentry() middleware exported from @sentry/hono/node no longer accepts configuration options. Instead, you must configure the SDK by calling Sentry.init() in a dedicated instrumentation file that runs before your application code (read more in the Hono SDK readme:

    // instrument.mjs (or instrument.ts)
import * as Sentry from '@sentry/hono/node';
Sentry.init({
dsn: 'DSN',
tracesSampleRate: 1.0,
});

  • feat(nitro): Add @sentry/nitro SDK (#19224)

    A new @sentry/nitro package provides first-class Sentry support for Nitro applications, with HTTP handler and error instrumentation, middleware tracing, request isolation, and build-time source map uploading via withSentryConfig. Read more in the Nitro SDK docs and the Nitro SDK readme.

Other Changes

... (truncated)

Commits
  • dc0b839 release: 10.51.0
  • b3cabee Merge pull request #20599 from getsentry/prepare-release/10.51.0
  • 3be99a9 meta(changelog): Update changelog for 10.51.0
  • bea1aad test(browser): Unflake some more tests (#20591)
  • 50aa085 test(node): Unflake postgres tests (#20593)
  • 1166839 fix(hono): Distinguish .use() middleware in sub-apps from .all() handlers...
  • 217ad4a test(node): Fix flaky ANR test (#20592)
  • 91ffb3f test(node): Fix flaky worker thread integration test (#20588)
  • c4e3902 chore(ci): Do not report flaky test issues if we cannot find a test name (#20...
  • c0005cd test(node): Update timeout for cron integration tests (#20586)
  • Additional commits viewable in compare view

Updates archiver from 6.0.2 to 7.0.1

Release notes

Sourced from archiver's releases.

7.0.1

What’s changed

Maintenance

Dependency updates

7.0.0

What’s changed

Breaking changes

Dependency updates

Changelog

Sourced from archiver's changelog.

Changelog

8.0.0 - October 17, 2024 — Diff

7.0.1 - March 9, 2024 — Diff

7.0.0 - February 28, 2024 — Diff

6.0.2 - February 27, 2024 — Diff

6.0.1 - September 3, 2023 — Diff

6.0.0 - August 17, 2023 — Diff

Release Archive

Commits

Updates bullmq from 5.76.3 to 5.76.4

Release notes

Sourced from bullmq's releases.

v5.76.4

5.76.4 (2026-04-29)

Bug Fixes

  • flow-producer: surface ParentJobNotExist errors from add() (#3264) (#4058) (7ed0eec)
Commits

Updates date-fns from 3.6.0 to 4.1.0

Release notes

Sourced from date-fns's releases.

v4.1.0

This release adds time zone support to format functions (that I somehow missed when working on the feature) and fixes a few bugs.

Make sure also upgrade TZDate to v1.0.2 as it includes a bunch of critical bug fixes.

Fixed

  • Fixed internal constructFrom throwing an exception on null arguments. While null isn't allowed, the functions should rather return Invalid Date or NaN in such cases. See #3885.

Added

  • Added missing time zone support to format, formatISO, formatISO9075, formatRelative and formatRFC3339. See #3886.

v4.0.0

I have great news! First, ten years after its release, date-fns finally gets first-class time zone support.

Another great news is that there aren't many breaking changes in this release. All of them are type-related and will affect only those explicitly using internal date-fns types. Finally, it has been less than a year since the last major release, which is an improvement over the previous four years between v2 and v3. I plan on keeping the pace and minimizing breaking changes moving forward.

Read more about the release in the announcement blog post.

- Sasha @​kossnocorp

Added

  • Added time zones support via @date-fns/tz's TZDate class and tz helper function. See its README for the details about the API.

  • All relevant functions now accept the context in option, which allows to specify the time zone to make the calculations in. If the function also returns a date, it will be in the specified time zone:

    import { addDays, startOfDay } from "date-fns";
import { tz } from "@date-fns/tz";
startOfDay(addDays(Date.now(), 5, { in: tz("Asia/Singapore") }));
//=> "2024-09-16T00:00:00.000+08:00"

    In the example, addDays will get the current date and time in Singapore and add 5 days to it. startOfDay will inherit the date type and return the start of the day in Singapore.

Changed

  • The function arguments, as well as Interval's start and end, now can be of different types, allowing you to mix UTCDate, TZDate, Date, and other extensions, as well as primitives (strings and numbers).

    The functions will normalize these values, make calculations, and return the result in the same type, preventing any bugs caused by the discrepancy. If passed, the type will be inferred from the context in option or the first encountered argument object type. The Interval's start and end will be considered separately, starting from start.

    In the given example, the result will be in the TZDate as the first argument is a number, and the start takes precedence over the end.

    clamp(Date.now(), {
  start: new TZDate(start, "Asia/Singapore"),
  end: new UTCDate(),

... (truncated)

Changelog

Sourced from date-fns's changelog.

v4.1.0 - 2024-09-17

This release adds time zone support to format functions (that I somehow missed when working on the feature) and fixes a few bugs.

Make sure also upgrade TZDate to v1.0.2 as it includes a bunch of critical bug fixes.

Fixed

  • Fixed internal constructFrom throwing an exception on null arguments. While null isn't allowed, the functions should rather return Invalid Date or NaN in such cases. See #3885.

Added

  • Added missing time zone support to format, formatISO, formatISO9075, formatRelative and formatRFC3339. See #3886.

v4.0.0 - 2024-09-16

I have great news! First, ten years after its release, date-fns finally gets first-class time zone support.

Another great news is that there aren't many breaking changes in this release. All of them are type-related and will affect only those explicitly using internal date-fns types. Finally, it has been less than a year since the last major release, which is an improvement over the previous four years between v2 and v3. I plan on keeping the pace and minimizing breaking changes moving forward.

Read more about the release in the announcement blog post.

- Sasha @​kossnocorp

Added

  • Added time zones support via @date-fns/tz's TZDate class and tz helper function. See its README for the details about the API.

  • All relevant functions now accept the context in option, which allows to specify the time zone to make the calculations in. If the function also returns a date, it will be in the specified time zone:

    import { addDays, startOfDay } from "date-fns";
import { tz } from "@date-fns/tz";
startOfDay(addDays(Date.now(), 5, { in: tz("Asia/Singapore") }));
//=> "2024-09-16T00:00:00.000+08:00"

    In the example, addDays will get the current date and time in Singapore and add 5 days to it. startOfDay will inherit the date type and return the start of the day in Singapore.

Changed

  • The function arguments, as well as Interval's start and end, now can be of different types, allowing you to mix UTCDate, TZDate, Date, and other extensions, as well as primitives (strings and numbers).

    The functions will normalize these values, make calculations, and return the result in the same type, preventing any bugs caused by the discrepancy. If passed, the type will be inferred from the context in option or the first encountered argument object type. The Interval's start and end will be considered separately, starting from start.

    In the given example, the result will be in the TZDate as the first argument is a number, and the start takes precedence over the end.

    clamp(Date.now(), {

... (truncated)

Commits
  • 313b902 Fix v4.1.0 change log entry
  • 26cd336 Promote to v4.1.0
  • 97b53b9 Cover time zone edge cases
  • 59b7563 Add missing time zone support to format, formatISO, formatISO9075, formatRela...
  • 0121164 Prevent constructFrom from throwing an error on null
  • bd87ef5 Update @​date-fns/docs
  • 99b4e67 Prepare v4.0
  • 8df1706 Rewrite the time zones doc
  • e351977 Promote to v4.0.0-beta.1
  • 8523656 Fix scripts/test/types.sh
  • Additional commits viewable in compare view

Updates dotenv from 16.6.1 to 17.4.2

Changelog

Sourced from dotenv's changelog.

17.4.2 (2026-04-12)

Changed

  • Improved skill files - tightened up details (#1009)

17.4.1 (2026-04-05)

Changed

  • Change text injecting to injected (#1005)

17.4.0 (2026-04-01)

Added

  • Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

  • Tighten up logs: ◇ injecting env (14) from .env (#1003)

17.3.1 (2026-02-12)

Changed

  • Fix as2 example command in README and update spanish README

17.3.0 (2026-02-12)

Added

  • Add a new README section on dotenv’s approach to the agentic future.

Changed

  • Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

17.2.4 (2026-02-05)

Changed

  • Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)
  • Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

17.2.3 (2025-09-29)

Changed

  • Fixed typescript error definition (#912)

... (truncated)

Commits

Updates express-rate-limit from 7.5.1 to 8.4.1

Release notes

Sourced from express-rate-limit's releases.

v8.4.1

You can view the changelog here.

v8.4.0

You can view the changelog here.

v8.3.2

You can view the changelog here.

v8.3.1

You can view the changelog here.

v8.3.0

You can view the changelog here.

v8.2.1

You can view the changelog here.

v8.2.0

You can view the changelog here.

v8.1.0

You can view the changelog here.

v8.0.1

You can view the changelog here.

v8.0.0

You can view the changelog here.

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates node-vault from 0.10.10 to 0.12.0

Commits
  • c62849a Merge pull request #294 from nodevault/aviadhahami-patch-1
  • c6d577b Bump version from 0.11.1 to 0.12.0
  • 8952580 Merge pull request #293 from nodevault/copilot/add-support-for-kv-v2-destroy-...
  • a5b1efc Merge branch 'master' into copilot/add-support-for-kv-v2-destroy-command
  • 7ad67a9 Merge pull request #292 from nodevault/copilot/add-dynamic-credentials-support
  • c392917 Address code review: add empty string leaseId test, improve test comments
  • b4b44b6 Add dynamic credential management: token and lease auto-renewal with EventEmi...
  • 9a0d56b Add KV v2 destroySecretVersions command
  • bc6a973 Initial plan
  • 8120dc4 Initial plan
  • Additional commits viewable in compare view

Updates rate-limiter-flexible from 4.0.1 to 11.0.1

Release notes

Sourced from rate-limiter-flexible's releases.

Fix msBeforeNext delayed response

What's Changed

Full Changelog: animir/node-rate-limiter-flexible@v11.0.0...v11.0.1

👀

Wrappers don't require points and duration options

What's Changed

  • #356 fix do not require points and duration options in wrappers by @​animir in animir/node-rate-limiter-flexible#357
  • RateLimiterCompatibleAbstract lightweight base class for custom wrappers Added a minimal abstract class that defines the core interface (consume, get, set, delete, penalty, reward, block, getKey) without requiring the full RateLimiterAbstract implementation. This makes it easy to build custom wrappers that work seamlessly with RateLimiterUnion, RLWrapperTimeouts, and insurance limiters.
  • Fixed RateLimiterStoreAbstract.set() incorrectly calling _block instead of _set
  • Fixed key parsing when keyPrefix is empty

[BREAKING CHANGES] RLWrapperBlackAndWhite now extends RateLimiterCompatibleAbstract, and all union/wrapper/insurance classes accept both abstract types via a new isRateLimiterCompatible helper.

⏲️

Full Changelog: animir/node-rate-limiter-flexible@v10.0.1...v11.0.0

AI docs fix

Full Changelog: animir/node-rate-limiter-flexible@v10.0.0...v10.0.1

Require points and duration opts

What's Changed

[BREAKING CHANGES]

  • Require points and duration options by @​animir in animir/node-rate-limiter-flexible#354

    No default values are set for points and duration options starting from v10. Negative points will not be replaced by default points value 4. Validation rules apply.

    Error is thrown during limiter creation if points or duration is invalid:

    1. points must be number.

      Any limiter accepts negative points as valid option starting from v10. If you migrate from older version, be careful: If in your code points option is set to negative value and that works for your project now then you should review the logic in your project. After update to version 10, negative points value will not be replaced by 4 by default as it was prior to version 10.

      When your limiter has negative or zero points consume method call is always rejected since there is always not enough points to consume. You can set points to negative and play with reward and consume calls, that could be useful sometimes.

    2. duration must be non-negative number >= 0. Error is thrown during limiter creation if duration option has invalid value.

    Requiring points and duration seems logical for security package. We don't want our apps working not as we expect even if there is no security threat. This update removes uncertaincy about negative duration and zero points.

[OTHER UPDATES]

... (truncated)

Commits

Updates redis from 4.7.1 to 5.12.1

Release notes

Sourced from redis's releases.

redis@5.12.0

✨ What's Changed

🚀 Features

🐛 Fixes

@dependabot
build(deps): bump the dependencies group with 17 updates
2bc3ddc 
Bumps the dependencies group with 17 updates:

| Package | From | To |
| --- | --- | --- |
| [@apollo/server](https://github.com/apollographql/apollo-server/tree/HEAD/packages/server) | `4.13.0` | `5.5.0` |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.50.0` | `10.51.0` |
| [archiver](https://github.com/archiverjs/node-archiver) | `6.0.2` | `7.0.1` |
| [bullmq](https://github.com/taskforcesh/bullmq) | `5.76.3` | `5.76.4` |
| [date-fns](https://github.com/date-fns/date-fns) | `3.6.0` | `4.1.0` |
| [dotenv](https://github.com/motdotla/dotenv) | `16.6.1` | `17.4.2` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `7.5.1` | `8.4.1` |
| [node-vault](https://github.com/nodevault/node-vault) | `0.10.10` | `0.12.0` |
| [rate-limiter-flexible](https://github.com/animir/node-rate-limiter-flexible) | `4.0.1` | `11.0.1` |
| [redis](https://github.com/redis/node-redis) | `4.7.1` | `5.12.1` |
| [stripe](https://github.com/stripe/stripe-node) | `17.7.0` | `22.1.0` |
| [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.215.0` | `0.216.0` |
| [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.73.0` | `0.74.0` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.215.0` | `0.216.0` |
| [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) | `2.7.0` | `2.7.1` |
| [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest) | `29.5.14` | `30.0.0` |
| [commander](https://github.com/tj/commander.js) | `13.1.0` | `14.0.3` |


Updates `@apollo/server` from 4.13.0 to 5.5.0
- [Release notes](https://github.com/apollographql/apollo-server/releases)
- [Changelog](https://github.com/apollographql/apollo-server/blob/main/packages/server/CHANGELOG.md)
- [Commits](https://github.com/apollographql/apollo-server/commits/@apollo/server@5.5.0/packages/server)

Updates `@sentry/node` from 10.50.0 to 10.51.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.50.0...10.51.0)

Updates `archiver` from 6.0.2 to 7.0.1
- [Release notes](https://github.com/archiverjs/node-archiver/releases)
- [Changelog](https://github.com/archiverjs/node-archiver/blob/master/CHANGELOG.md)
- [Commits](archiverjs/node-archiver@6.0.2...7.0.1)

Updates `bullmq` from 5.76.3 to 5.76.4
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v5.76.3...v5.76.4)

Updates `date-fns` from 3.6.0 to 4.1.0
- [Release notes](https://github.com/date-fns/date-fns/releases)
- [Changelog](https://github.com/date-fns/date-fns/blob/main/CHANGELOG.md)
- [Commits](date-fns/date-fns@v3.6.0...v4.1.0)

Updates `dotenv` from 16.6.1 to 17.4.2
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v16.6.1...v17.4.2)

Updates `express-rate-limit` from 7.5.1 to 8.4.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.4.1)

Updates `node-vault` from 0.10.10 to 0.12.0
- [Release notes](https://github.com/nodevault/node-vault/releases)
- [Commits](nodevault/node-vault@v0.10.10...v0.12.0)

Updates `rate-limiter-flexible` from 4.0.1 to 11.0.1
- [Release notes](https://github.com/animir/node-rate-limiter-flexible/releases)
- [Commits](animir/node-rate-limiter-flexible@v4.0.1...v11.0.1)

Updates `redis` from 4.7.1 to 5.12.1
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@4.7.1...redis@5.12.1)

Updates `stripe` from 17.7.0 to 22.1.0
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-node@v17.7.0...v22.1.0)

Updates `@opentelemetry/sdk-node` from 0.215.0 to 0.216.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.215.0...experimental/v0.216.0)

Updates `@opentelemetry/auto-instrumentations-node` from 0.73.0 to 0.74.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.74.0/packages/auto-instrumentations-node)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.215.0 to 0.216.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.215.0...experimental/v0.216.0)

Updates `@opentelemetry/sdk-trace-base` from 2.7.0 to 2.7.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.7.0...v2.7.1)

Updates `@types/jest` from 29.5.14 to 30.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest)

Updates `commander` from 13.1.0 to 14.0.3
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](tj/commander.js@v13.1.0...v14.0.3)

---
updated-dependencies:
- dependency-name: "@apollo/server"
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@sentry/node"
  dependency-version: 10.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: archiver
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: bullmq
  dependency-version: 5.76.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: date-fns
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: dotenv
  dependency-version: 17.4.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.4.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: node-vault
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: rate-limiter-flexible
  dependency-version: 11.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: redis
  dependency-version: 5.12.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: stripe
  dependency-version: 22.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.216.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@opentelemetry/auto-instrumentations-node"
  dependency-version: 0.74.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.216.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@opentelemetry/sdk-trace-base"
  dependency-version: 2.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/jest"
  dependency-version: 30.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: commander
  dependency-version: 14.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 30, 2026
@elizabetheonoja-art elizabetheonoja-art merged commit aa067e5 into main Apr 30, 2026
0 of 4 checks passed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/dependencies-7daf7f9df2 branch April 30, 2026 18:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@elizabetheonoja-art