Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 5 updates - #941

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/server/main/minor-and-patch-1eef6a7803
Open

chore(deps): bump the minor-and-patch group across 1 directory with 5 updates#941
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/server/main/minor-and-patch-1eef6a7803

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 5 updates in the /server directory:

Package From To
@upstash/redis 1.38.0 1.38.2
express-rate-limit 8.6.0 8.6.2
mongoose 9.8.0 9.9.1
nodemailer 9.0.3 9.0.4
redis 6.1.0 6.2.0

Updates @upstash/redis from 1.38.0 to 1.38.2

Release notes

Sourced from @​upstash/redis's releases.

@​upstash/redis@​1.38.2

Patch Changes

  • c0f5ad7: Deduplicate telemetry header values so repeated mergeTelemetry calls no longer append the same sdk, platform or runtime tag multiple times

@​upstash/redis@​1.38.1

Patch Changes

  • bd7a19f: Add a quick tip about creating a database via https://upstash.com/start-redis to the warnings shown when the Redis url or token is missing. On Cloudflare, the warning shown when both the url and the token are missing now names both wrangler secret put commands instead of only one.
Commits
  • fc3089b chore: version packages (#1441)
  • c0f5ad7 fix: deduplicate telemetry header values in mergeTelemetry (#1440)
  • e45fb78 chore: version packages (#1439)
  • bd7a19f DX-2866: add start-redis tip to missing url/token warnings (#1438)
  • 8cf6209 fix: stabilize flaky evalshaRo test by waiting for script replication
  • 3024bb2 DX-2750: add ai sdk telemetry to redis search example (#1437)
  • bf3f48a chore: add resource section to README (#1435)
  • 27f7253 docs: add quick tip for fast Redis database setup
  • e93fef5 fix: add allowBuilds for pnpm 11 compatibility (#1434)
  • See full diff in compare view

Updates express-rate-limit from 8.6.0 to 8.6.2

Release notes

Sourced from express-rate-limit's releases.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

Commits
  • c416f78 8.6.2
  • defb334 v8.6.2 changelog
  • 7dd82cf fix: key IPv4-in-IPv6 addresses by range, not notation (#667)
  • 4e23dbb chore(deps): bump ip-address from 10.3.1 to 10.4.0 (#666)
  • 607ef1f chore(deps): bump ip-address from 10.2.0 to 10.3.1 (#664)
  • d2370f6 chore(deps-dev): bump the development-dependencies group with 5 updates (#663)
  • c7fced5 8.6.1
  • b21110e chore: deprecate millisecond-based time constants (#662)
  • fad3d85 chore(deps-dev): bump the development-dependencies group with 4 updates (#660)
  • See full diff in compare view

Updates mongoose from 9.8.0 to 9.9.1

Release notes

Sourced from mongoose's releases.

9.9.1 / 2026-07-31

  • fix(query): avoid path collision when excluding subdocuments with nested select: false paths #12798
  • types(model): support overriding schema-level lean with lean: false #16413

9.9.0 / 2026-07-30

  • perf(document): improve toObject perf with faster string checks and avoiding unnecessary isSelected on paths with no getters #16407 #16373 #16385
  • perf(model): improve insertMany() performance and general change tracking performance #16370
  • perf(timestamps): avoid adding $setOnInsert for createdAt unless upsert set #16411
  • perf: improve toObject() performance #16408 #16405 #16378 #14394 BIGSUS24
  • types: add discriminator key to each member of embedded discriminator enum- #16412 #16045

9.8.1 / 2026-07-27

  • perf(document): avoid rebuilding modified paths during required path validation #16379 xianjianlf2
  • perf(document): avoid clearing the required paths cache on every document instantiation #16404 #16377
  • fix(query): reject update modifiers without paths #16387 AbdelrahmanHafez
  • perf: cache toString() results in array.unique to avoid redundant allocations #16390 vivek180905
  • types: respect the _id option when inferring StandardSchema types #16402
  • types(model): keep Model.schema typed when TSchema is omitted samuelmbabhazi
  • docs(guide): clarify strictQuery handling of filter paths not in the schema #16397 MuhammadFarhantahir
Changelog

Sourced from mongoose's changelog.

9.9.1 / 2026-07-31

  • fix(query): avoid path collision when excluding subdocuments with nested select: false paths #12798 BIGSUS24
  • types(model): apply schema-level lean to find() #16413
  • types(model): support overriding schema-level lean with lean: false #16413

9.9.0 / 2026-07-30

  • perf(document): improve toObject perf with faster string checks and avoiding unnecessary isSelected on paths with no getters #16407 #16373 #16385
  • perf(model): improve insertMany() performance and general change tracking performance #16370
  • perf(timestamps): avoid adding $setOnInsert for createdAt unless upsert set #16411
  • perf: improve toObject() performance #16408 #16405 #16378 #14394 BIGSUS24
  • types: add discriminator key to each member of embedded discriminator enum- #16412 #16045

8.24.2 / 2026-07-27

9.8.1 / 2026-07-27

  • perf(document): avoid rebuilding modified paths during required path validation #16379 xianjianlf2
  • perf(document): avoid clearing the required paths cache on every document instantiation #16404 #16377
  • fix(query): reject update modifiers without paths #16387 AbdelrahmanHafez
  • perf: cache toString() results in array.unique to avoid redundant allocations #16390 vivek180905
  • types: respect the _id option when inferring StandardSchema types #16402
  • types(model): keep Model.schema typed when TSchema is omitted samuelmbabhazi
  • docs(guide): clarify strictQuery handling of filter paths not in the schema #16397 MuhammadFarhantahir
Commits
  • a510d89 chore: release 9.9.1
  • 1287a37 Merge pull request #16414 from Automattic/vkarpov15/gh-16413
  • cddce69 types: add lean: false overrides for remaining find operations
  • 3d301c9 types(model): support lean: false overriding schema-level lean option re: #16413
  • 95935a7 Merge pull request #16409 from BIGSUS24/fix/subdocument-select-false-projecti...
  • e970583 types(model): handle { lean: true } schema option on Model.find() types
  • c14e17e docs: add missing changelog entry
  • 650c286 chore: release 9.9.0
  • 0b4ef8a test: improve flakey test
  • 2ccf221 Merge pull request #16412 from Automattic/vkarpov15/gh-16045-3
  • Additional commits viewable in compare view

Updates nodemailer from 9.0.3 to 9.0.4

Release notes

Sourced from nodemailer's releases.

v9.0.4

9.0.4 (2026-08-04)

Bug Fixes

  • mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
  • mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
  • mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
  • mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
  • mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)
Changelog

Sourced from nodemailer's changelog.

9.0.4 (2026-08-04)

Bug Fixes

  • mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
  • mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
  • mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
  • mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
  • mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)
Commits
  • 2a0e8c3 chore(master): release 9.0.4 (#1841)
  • 78f4aa2 fix(mime-funcs): percent encode unpaired surrogates in header parameter values
  • 182d39a refactor(mime-node): quote the Content-Type name parameter with JSON.stringify
  • 9797f7f fix(mime-funcs): do not let an unpaired surrogate consume the next character
  • adcfc4f fix(mime-node): escape backslash and quote in the Content-Type name parameter...
  • 5bd3a65 fix(mime-funcs): keep any surrogate pair intact when chunking base64 mime wor...
  • eaf12a0 chore(services): add TurboSMTP (#1839)
  • b27d300 test(mime-node): assert the Content-Type name= output for line break filenames
  • 5bc9cab fix(mime): encode HT/CR/LF in header parameter values instead of quoting them...
  • acc2b43 chore(deps): update dev dependencies
  • Additional commits viewable in compare view

Updates redis from 6.1.0 to 6.2.0

Release notes

Sourced from redis's releases.

redis@6.2.0

6.2.0

✨ Highlights

Cluster commands now follow the server's request/response policies. node-redis reads each command's routing policy from the server's COMMAND metadata and routes and aggregates accordingly, so the cluster client behaves much more like a single server. Multi-key commands that span hash slots — MGET, MSET, DEL, EXISTS, TOUCH, UNLINK — are transparently split per slot and their replies reassembled in caller order, so cross-slot calls that previously failed with CROSSSLOT now just work. Fan-out commands such as KEYS, DBSIZE, FLUSHALL, PING, WAIT, SCRIPT EXISTS and CONFIG SET run across every shard (or every node) and their replies are aggregated per the server's policy, SCAN walks the whole cluster behind a per-client virtual cursor, and RANDOMKEY / FT.CURSOR get correct cluster-aware routing. Replica read-scaling was also aligned with the server flags, so read-only keyless commands (DBSIZE, KEYS, SCAN, RANDOMKEY, and the RediSearch / time-series reads) can be served from replicas again.

⚠️ Behavior change for the raw sendCommand path: a table-recognized command sent raw — e.g. cluster.sendCommand(['DBSIZE']) — now follows its policy (fan-out and aggregate) instead of hitting a single node. Callers who relied on raw commands for per-node operations should target a specific node with cluster.nodeClient(node).sendCommand(...).

This release also brings a broad wave of new command coverage across the client and modules. The time-series package gains the most: new TS.NRANGE/TS.NREVRANGE multi-key pivot commands, a TS.READ cursor reader, TS.QUERYLABELS, EXCLUDEEMPTY on MRANGE/MREVRANGE, and multi-aggregator support. RediSearch adds FT.ALIASLIST, a COLLECT reducer for FT.AGGREGATE, HNSW RERANK, timeout warnings on the FT.SEARCH family, and the full set of stemmer languages. The core client adds SUNIONCARD/SDIFFCARD, LMOVEM/BLMOVEM, ZREVRANK WITHSCORE, COMMAND DOCS, and XREAD MAXCOUNT/MAXSIZE. A large batch of correctness fixes lands for zero-valued optional arguments (LIMIT 0, DB 0, SAMPLES 0, ENTRIESREAD 0, IDLETIME/FREQ 0, ENTRIESADDED 0) that were previously dropped from the wire, alongside several cluster and sentinel connection-lifecycle fixes.

The new HIMPORT command family (managed fieldset lifecycle) ships as experimental — see the warning below.

🚀 New Features

⚠️ Experimental

  • feat(client): add HIMPORT command family with managed fieldset lifecycle (#3381) — @​nkaradzhov. The HIMPORT family and its FieldsetRegistry/PreparedFieldsets API are experimental and unstable; the surface may change or be removed in a future release. Do not depend on it in production.

🐛 Bug Fixes

  • fix(cluster): reject commands before the cluster topology is ready (#3321) — @​GiHoon1123
  • fix(cluster): rebind abort/timeout listeners when a command moves to another queue (#3367) — @​GiHoon1123
  • fix(cluster): make extractAllCommands drain the write queue (#3364) — @​GiHoon1123
  • fix(sentinel): reject connect() instead of hanging when the resolved master is unreachable (#3331) — @​GiHoon1123
  • fix(client): include the acquire-timeout duration in the pool timeout error message (#3382) — @​Piyush0049
  • fix(client): reject the in-flight connect attempt when the socket dies during the initiator (#3374) — @​nkaradzhov
  • fix(client): correct DoublyLinkedList head removal (#3320) — @​abhijeet117
  • fix(client): XADD/XTRIM with LIMIT 0 must emit the argument (#3342) — @​Develop-KIM
  • fix(client): XGROUP CREATE/SETID with ENTRIESREAD 0 must emit the argument (#3333) — @​Develop-KIM
  • fix(client): XSETID with ENTRIESADDED 0 must emit the argument (#3324) — @​spokodev
  • fix(client): MEMORY USAGE must emit SAMPLES when 0 (#3328) — @​Develop-KIM
  • fix(client): RESTORE with IDLETIME/FREQ 0 must emit the argument (#3323) — @​spokodev
  • fix(client): GETEX PXAT with a Date must encode milliseconds (#3317) — @​spokodev
  • fix(client): COPY with DB 0 must emit the DB argument (#3318) — @​spokodev

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 5…
cc5bec6 
… updates

Bumps the minor-and-patch group with 5 updates in the /server directory:

| Package | From | To |
| --- | --- | --- |
| [@upstash/redis](https://github.com/upstash/redis-js) | `1.38.0` | `1.38.2` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.0` | `8.6.2` |
| [mongoose](https://github.com/Automattic/mongoose) | `9.8.0` | `9.9.1` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.3` | `9.0.4` |
| [redis](https://github.com/redis/node-redis) | `6.1.0` | `6.2.0` |



Updates `@upstash/redis` from 1.38.0 to 1.38.2
- [Release notes](https://github.com/upstash/redis-js/releases)
- [Commits](https://github.com/upstash/redis-js/compare/@upstash/redis@1.38.0...@upstash/redis@1.38.2)

Updates `express-rate-limit` from 8.6.0 to 8.6.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.6.0...v8.6.2)

Updates `mongoose` from 9.8.0 to 9.9.1
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@9.8.0...9.9.1)

Updates `nodemailer` from 9.0.3 to 9.0.4
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.3...v9.0.4)

Updates `redis` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@6.1.0...redis@6.2.0)

---
updated-dependencies:
- dependency-name: "@upstash/redis"
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: express-rate-limit
  dependency-version: 8.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: mongoose
  dependency-version: 9.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: nodemailer
  dependency-version: 9.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: redis
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

backend dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants