Dependency Dashboard

[renovate[bot]]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Deprecations / Replacements

[!WARNING] These dependencies are either deprecated or have replacements available:

Datasource	Name	Replacement PR?
npm	@shopify/address
npm	@simplewebauthn/types
npm	chai-subset

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• [ ] fix(deps): update dependency errorhandler to v1.5.2
• [ ] fix(deps): update dependency express to v4.22.1
• [ ] fix(deps): update dependency jsonwebtoken to v9.0.3
• [ ] fix(deps): update dependency lru-cache to v11.2.4
• [ ] fix(deps): update dependency sharp to v0.34.5
• [ ] fix(deps): update dependency validator to v13.15.23
• [ ] chore(deps): update dependency prettier to v3.7.4
• [ ] chore(deps): update postgres docker tag to v16.11
• [ ] fix(deps): update aws-sdk-js-v3 monorepo to v3.952.0 (@aws-sdk/client-s3, @aws-sdk/s3-request-presigner)
• [ ] fix(deps): update dependency @peculiar/asn1-schema to v2.6.0
• [ ] fix(deps): update dependency redis to v5.10.0
• [ ] fix(deps): update dependency winston to v3.19.0
• [ ] fix(deps): update dependency zod to v4.2.0
• [ ] fix(deps): update opentelemetry-js monorepo to ^0.208.0 (@opentelemetry/exporter-trace-otlp-proto, @opentelemetry/instrumentation)
• [ ] fix(deps): update sentry-javascript monorepo to v9.47.1 (@sentry/node, @sentry/profiling-node)
• [ ] chore(deps): update actions/cache action to v5
• [ ] chore(deps): update actions/upload-artifact action to v6
• [ ] chore(deps): update dependency chokidar to v5
• [ ] chore(deps): update node.js to v24 (node, @types/node)
• [ ] chore(deps): update postgres docker tag to v18
• [ ] fix(deps): update dependency @simplewebauthn/server to v13
• [ ] fix(deps): update dependency csv-parse to v6
• [ ] fix(deps): update dependency plaid to v40
• [ ] fix(deps): update dependency stripe to v20
• [ ] fix(deps): update opentelemetry-js monorepo to v2 (major) (@opentelemetry/resources, @opentelemetry/sdk-trace-base, @opentelemetry/sdk-trace-node)
• [ ] 🔐 Create all rate-limited PRs at once 🔐

PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

• [ ] fix(deps): update dependency express to v5

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• [ ] fix(deps): update octokit monorepo (@octokit/auth-oauth-app, @octokit/rest)
• [ ] chore(deps): update dependency @opentelemetry/auto-instrumentations-node to ^0.67.0
• [ ] fix(deps): update dependency @apollo/server to v5.2.0
• [ ] fix(deps): update dependency @peculiar/asn1-x509 to v2.6.0
• [ ] chore(deps): update actions/checkout action to v6
• [ ] chore(deps): update dependency nock to v14
• [ ] fix(deps): update dependency @node-oauth/oauth2-server to v5
• [ ] fix(deps): update dependency cloudflare to v5
• [ ] fix(deps): update sentry-javascript monorepo to v10 (major) (@sentry/node, @sentry/profiling-node)
• [ ] Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• [ ] fix(deps): update dependency gqlmin to v0.3.1
• [ ] chore(deps): update dependency chai-as-promised to v8
• [ ] chore(deps): update dependency fake-tag to v5
• [ ] chore(deps): update dependency markdown-table to v3
• [ ] chore(deps): update dependency sinon-chai to v4
• [ ] chore(deps): update npm to v11
• [ ] fix(deps): update dependency @simplewebauthn/types to v12
• [ ] fix(deps): update dependency crypto-random-string to v5
• [ ] fix(deps): update dependency get-urls to v12
• [ ] fix(deps): update dependency graphql-upload to v17 (graphql-upload, @types/graphql-upload)
• [ ] fix(deps): update dependency node-fetch to v3
• [ ] fix(deps): update dependency p-map to v7
• [ ] fix(deps): update dependency p-queue to v9

Detected Dependencies

github-actions (3)

.github/workflows/ci.yml (43)

• actions/checkout v5
• actions/setup-node v6
• actions/cache v4
• actions/checkout v5
• actions/setup-node v6
• actions/cache v4
• actions/checkout v5
• actions/setup-node v6
• actions/cache v4
• actions/checkout v5
• actions/setup-node v6
• actions/cache v4
• actions/checkout v5
• actions/setup-node v6
• actions/cache v4
• actions/cache v4
• actions/checkout v5
• actions/setup-node v6
• actions/cache v4
• actions/cache v4
• actions/checkout v5
• actions/setup-node v6
• actions/cache v4
• codecov/codecov-action v5
• codecov/test-results-action v1
• actions/checkout v5
• actions/setup-node v6
• actions/cache v4
• codecov/codecov-action v5
• codecov/test-results-action v1
• actions/checkout v5
• actions/setup-node v6
• actions/cache v4
• actions/checkout v5
• kamilkisiela/graphql-inspector v3.4.0
• kamilkisiela/graphql-inspector v3.4.0
• postgres 16.10
• ubuntu 24.04
• postgres 16.10
• opensearchproject/opensearch 3
• ubuntu 24.04
• postgres 16.10
• postgres 16.10

.github/workflows/codeql-analysis.yml (3)

• actions/checkout v5
• github/codeql-action v4
• github/codeql-action v4

.github/workflows/e2e.yml (17)

• actions/checkout v5
• actions/setup-node v6
• actions/checkout v5
• actions/checkout v5
• actions/checkout v5
• actions/checkout v5
• actions/cache v4
• actions/cache v4
• actions/cache v4
• actions/cache v4
• actions/cache v4
• actions/cache v4
• actions/cache v4
• actions/cache v4
• actions/upload-artifact v5
• postgres 16.10
• ubuntu 24.04

npm (1)

package.json (166)

• @apollo/server 5.0.0
• @as-integrations/express4 1.1.2
• @aws-sdk/client-s3 3.914.0
• @aws-sdk/s3-request-presigner 3.914.0
• @babel/core 7.28.5
• @babel/node 7.28.0
• @babel/plugin-transform-typescript 7.28.5
• @babel/preset-env 7.28.5
• @escape.tech/graphql-armor 3.1.7
• @hyperwatch/hyperwatch 4.2.0
• @json2csv/plainjs ^7.0.6
• @node-oauth/oauth2-server 4.3.3
• @octokit/auth-oauth-app 9.0.2
• @octokit/rest 22.0.0
• @opencollective/taxes 5.3.0
• @opensearch-project/opensearch ^3.4.0
• @opentelemetry/context-async-hooks 2.2.0
• @opentelemetry/instrumentation 0.200.0
• @opentelemetry/sdk-trace-base 1.30.1
• @paypal/payouts-sdk 1.1.1
• @peculiar/asn1-schema 2.5.0
• @peculiar/asn1-x509 2.3.15
• @sentry/node 9.46.0
• @sentry/profiling-node 9.46.0
• @shopify/address 4.3.0
• @simplewebauthn/server 11.0.0
• @simplewebauthn/types 11.0.0
• argparse 2.0.1
• async-mutex 0.5.0
• axios 1.13.2
• babel-plugin-add-module-exports 1.0.4
• bayes 1.0.0
• bcrypt 6.0.0
• blurhash 2.0.5
• cloudflare 4.5.0
• cloudflare-ip 0.0.7
• commander 14.0.2
• config 4.1.1
• connect-redis 9.0.0
• cookie-parser 1.4.7
• cors 2.8.5
• crypto-js 4.2.0
• crypto-random-string 3.3.1
• csv-parse 5.6.0
• dataloader 2.2.3
• dataloader-sequelize 2.3.3
• debug 4.4.3
• deepmerge 4.3.1
• dotenv 17.2.3
• errorhandler 1.5.1
• express 4.22.0
• express-basic-auth 1.2.1
• express-session 1.18.2
• express-ws 5.0.2
• fast-levenshtein 3.0.0
• fast-redact 3.5.0
• fs-extra 11.3.2
• get-urls 10.0.1
• gqlmin 0.1.1
• graphql 16.12.0
• graphql-scalars 1.25.0
• graphql-upload 15.0.2
• handlebars 4.7.8
• hashids 2.3.0
• hcaptcha 0.2.0
• helmet 8.1.0
• html-to-text 9.0.5
• ics 3.8.1
• jsonwebtoken 9.0.2
• juice 11.0.3
• limax 4.2.1
• lodash 4.17.21
• lru-cache 11.2.2
• moment 2.30.1
• moment-timezone 0.6.0
• multer 2.0.2
• node-fetch 2.7.0
• nodemailer 7.0.11
• nordigen-node 1.4.1
• p-map 4.0.0
• p-queue 6.6.2
• passport 0.7.0
• passport-github 1.1.0
• paypal-adaptive 0.4.2
• pg 8.16.3
• pg-connection-string 2.9.1
• pg-format 1.0.4
• pg-listen 1.7.0
• plaid 31.1.0
• redis 5.8.3
• sanitize-html 2.17.0
• sequelize 6.37.7
• sequelize-cli 6.6.3
• sequelize-temporal 2.1.1
• sharp 0.34.4
• spdx-license-list 6.10.0
• speakeasy 2.0.0
• stripe 17.7.0
• throng 5.0.0
• tweetnacl 1.0.3
• tweetnacl-util 0.15.1
• uuid 13.0.0
• validator 13.15.22
• winston 3.18.3
• zod 4.1.13
• @babel/cli ^7.23.4
• @babel/register ^7.23.7
• @graphql-eslint/eslint-plugin ^4.0.0
• @opentelemetry/api ^1.7.0
• @opentelemetry/auto-instrumentations-node ^0.62.0
• @opentelemetry/exporter-trace-otlp-proto ^0.200.0
• @opentelemetry/resources ^1.20.0
• @opentelemetry/sdk-trace-node ^1.20.0
• @types/express ^5.0.0
• @types/graphql-upload 16.0.7
• @types/jsonwebtoken ^9.0.5
• @types/lodash ^4.14.202
• @types/mocha ^10.0.6
• @types/node ^20.17.9
• @types/node-fetch ^2.6.10
• @types/nodemailer ^7.0.0
• @types/validator ^13.11.8
• @typescript-eslint/parser ^8.13.0
• babel-plugin-istanbul ^7.0.0
• chai ^6.0.0
• chai-as-promised ^7.1.1
• chai-jest-snapshot ^2.0.0
• chai-sorted ^0.2.0
• chai-subset ^1.6.0
• cheerio ^1.1.2
• chokidar ^4.0.1
• commitizen ^4.3.0
• cz-conventional-changelog ^3.3.0
• eslint ^9.14.0
• eslint-config-opencollective ^6.0.0
• eslint-import-resolver-typescript ^4.0.0
• eslint-plugin-import ^2.31.0
• eslint-plugin-mocha 11.2.0
• eslint-plugin-n ^17.11.1
• eslint-plugin-react ^7.37.2
• eslint-plugin-simple-import-sort ^12.1.1
• exif-reader ^2.0.1
• fake-tag ^3.0.0
• geoip-lite ^1.4.9
• globals ^16.0.0
• husky ^9.0.10
• lint-staged ^16.0.0
• markdown-table ^2.0.0
• mocha ^11.0.0
• mocha-junit-reporter ^2.2.1
• nock ^13.5.0
• node-mocks-http ^1.16.1
• nodemon ^3.0.2
• npm-run-all2 ^8.0.0
• nyc ^17.0.0
• opentelemetry-instrumentation-sequelize ^0.41.0
• prettier 3.6.2
• sinon ^21.0.0
• sinon-chai ^3.7.0
• supertest ^7.0.0
• ts-unused-exports ^11.0.0
• typescript 5.9.3
• typescript-eslint ^8.13.0
• ws ^8.18.0
• node 20.x
• npm 10.x

nvm (1)

.nvmrc (1)

• node 20

renovate-config-presets (1)

renovate.json

---

• [ ] Check this box to trigger a request for Renovate to run again on this repository