Skip to content

Bump the server-dependencies group across 1 directory with 9 updates - #522

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/server-dependencies-e637fd0198
Open

Bump the server-dependencies group across 1 directory with 9 updates#522
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/server-dependencies-e637fd0198

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the server-dependencies group with 9 updates in the / directory:

Package From To
@types/node 26.1.2 26.2.0
jose 6.2.4 6.2.8
mysql2 3.23.2 3.23.3
ws 8.21.1 8.21.3
@types/better-sqlite3 7.6.13 9.6.0
mocha 11.7.6 11.8.0
mysql-memory-server 1.14.1 1.15.0
webpack 5.109.0 5.109.2
webpack-cli 7.2.1 7.2.2

Updates @types/node from 26.1.2 to 26.2.0

Commits

Updates jose from 6.2.4 to 6.2.8

Release notes

Sourced from jose's releases.

v6.2.8

Fixes

  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Fixes

  • require own JOSE properties for presence checks (90ab09c)

Refactor

v6.2.6

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)
  • stop claiming the JWK "use" parameter is used during import (47a07b2)
  • update CHANGELOG.md (fc51bf5)

Refactor

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.8 (2026-08-03)

Fixes

  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

6.2.7 (2026-08-01)

Fixes

  • require own JOSE properties for presence checks (90ab09c)

Refactor

6.2.6 (2026-07-31)

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)

... (truncated)

Commits
  • 8b768eb chore(release): 6.2.8
  • 1500459 refactor: name the "alg" source in unsupported algorithm failures
  • 714f870 fix: reject a non-string "alg" in EmbeddedJWK
  • 925f3bb refactor: index the JWS and JWE registries without a wrapper
  • 505c383 fix: enforce a single recipient when decrypting dir and ECDH-ES
  • 514831d chore(deps): bump the actions group with 3 updates
  • 45965db chore: cleanup after release
  • 60b941f chore(release): 6.2.7
  • 90ab09c fix: require own JOSE properties for presence checks
  • 767d7f1 refactor: reduce bundle size
  • Additional commits viewable in compare view

Updates mysql2 from 3.23.2 to 3.23.3

Release notes

Sourced from mysql2's releases.

v3.23.3

3.23.3 (2026-08-10)

Bug Fixes

  • honor query-level namedPlaceholders as false (#4460) (20f732b)
  • keep connectTimeout active until the handshake completes (#4458) (508a731)
  • pool: give each pooled connection its own config copy (#4473) (361d232)
  • pool: propagate query dispatch errors instead of throwing (#4459) (7ce6943)
  • replace denque with a local ring buffer queue (#4472) (88f3d9e)
Changelog

Sourced from mysql2's changelog.

3.23.3 (2026-08-10)

Bug Fixes

  • honor query-level namedPlaceholders as false (#4460) (20f732b)
  • keep connectTimeout active until the handshake completes (#4458) (508a731)
  • pool: give each pooled connection its own config copy (#4473) (361d232)
  • pool: propagate query dispatch errors instead of throwing (#4459) (7ce6943)
  • replace denque with a local ring buffer queue (#4472) (88f3d9e)
Commits

Updates ws from 8.21.1 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).
Commits
  • c791e70 [dist] 8.21.3
  • e97a20e [fix] Reject offers with client_max_window_bits below config
  • 787ebf2 [dist] 8.21.2
  • b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
  • e4bb883 [security] Use GitHub PVR as main reporting channel
  • 2eb3be0 [test] Skip test on Node.js versions where it does not apply
  • See full diff in compare view

Updates @types/better-sqlite3 from 7.6.13 to 9.6.0

Commits

Updates mocha from 11.7.6 to 11.8.0

Release notes

Sourced from mocha's releases.

v11.8.0

11.8.0 (2026-08-02)

🌟 Features

  • add --fail-hook-affected-tests option to report skipped tests as failed (#5519) (#6052) (7830309)

🧹 Chores

v11.7.7

11.7.7 (2026-06-13)

🩹 Fixes

Changelog

Sourced from mocha's changelog.

11.8.0 (2026-08-02)

🌟 Features

  • add --fail-hook-affected-tests option to report skipped tests as failed (#5519) (#6052) (7830309)

🧹 Chores

11.7.7 (2026-06-13)

🩹 Fixes

Commits
  • 90c1bb3 chore(v11.x): release 11.8.0 (#6076)
  • 05aec43 chore(CI): bump Node from 22 to 24 in publish action (#6206)
  • 1f44d5f chore: change site title to Mocha 11, update index note (#6086)
  • 26deb23 chore: add modern Netlify to v11.x branch (#6082)
  • 7830309 feat: add --fail-hook-affected-tests option to report skipped tests as failed...
  • 41f2b95 chore(v11.x): release 11.7.7 (#6068)
  • 3477563 fix: surface ts-node compile errors (#6045)
  • See full diff in compare view

Updates mysql-memory-server from 1.14.1 to 1.15.0

Release notes

Sourced from mysql-memory-server's releases.

v1.15.0

What's Changed

Features

Chores

Full Changelog: Sebastian-Webster/mysql-memory-server-nodejs@v1.14.1...v1.15.0

Commits
  • fafb906 properly require getBinaryURL in versions test
  • f03f554 build 2 - v1.15.0
  • b3fa12a Log CLI invocation error as is without UnhandledPromiseException (#277)
  • a5a7a7d build - v1.15.0
  • 4620c62 Update devDependencies dependencies
  • 77dc54c Update devDependencies to latest (#273)
  • bdd7d3c Merge pull request #275 from Sebastian-Webster/274-add-support-for-mysql-849-...
  • 3011b2f Merge pull request #271 from Sebastian-Webster/update-semver-to-785
  • 3ae3f0a Use glibc 2.28 for MySQL 8.4.11
  • 10c4d29 Merge branch 'main' into update-semver-to-785
  • Additional commits viewable in compare view

Updates webpack from 5.109.0 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

v5.109.1

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

  • Encode the persistent cache with V8's value serializer. (by @​avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

5.109.1

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

... (truncated)

Commits
  • 6a24bd6 chore(release): new release (#21534)
  • d1b5b6d fix: resolve aliases pointing at a package directory ending in .js (#21542)
  • 9cdcc57 fix(target): report "universal" as the loader target (#21540)
  • 774e7e4 feat: annotate schema options with added keywords (#21473)
  • ff07bdc fix(css): name CSS sources in source maps by their resource path (#21536)
  • d56d82d fix(cache): reclaim stale filesystem cache files reliably (#21539)
  • ae67e2a chore(readme): add codspeed (#21497)
  • 964bbfa fix: delete no longer referenced files from the filesystem cache directory (#...
  • 075d0cd feat: skip require().prop in dead branches (#21517)
  • ec39088 chore(release): new release (#21493)
  • Additional commits viewable in compare view

Updates webpack-cli from 7.2.1 to 7.2.2

Release notes

Sourced from webpack-cli's releases.

webpack-cli@7.2.2

Patch Changes

  • perf: enable the Node.js compile cache (module.enableCompileCache, available on Node.js >= 22.8.0) to speed up CLI startup (by @​bjohansebas in #4818)
Changelog

Sourced from webpack-cli's changelog.

7.2.2

Patch Changes

  • perf: enable the Node.js compile cache (module.enableCompileCache, available on Node.js >= 22.8.0) to speed up CLI startup (by @​bjohansebas in #4818)
Commits
  • 191fa9f chore(release): new release (#4820)
  • 1082235 chore(deps-dev): bump js-yaml from 5.2.1 to 5.2.2 (#4821)
  • e36ae82 chore: add publish workflow and script for pkg.pr.new integration (#4819)
  • b0a2024 perf: enable the Node.js compile cache (#4818)
  • 53f6d72 chore(deps): bump actions/checkout in the dependencies group (#4816)
  • 8856346 chore: add allowscripts to work with npm 12 (#4811)
  • 0b0f1ee chore(deps): bump fast-uri from 3.1.2 to 3.1.4 (#4815)
  • d60a777 chore(deps-dev): bump postcss from 8.5.10 to 8.5.22 (#4814)
  • 8c1719a chore(deps): bump shell-quote from 1.8.4 to 1.10.0 (#4813)
  • 8c2473c chore(deps): bump immutable from 5.1.5 to 5.1.9 (#4812)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the server-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` |
| [jose](https://github.com/panva/jose) | `6.2.4` | `6.2.8` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.2` | `3.23.3` |
| [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` |
| [@types/better-sqlite3](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/better-sqlite3) | `7.6.13` | `9.6.0` |
| [mocha](https://github.com/mochajs/mocha) | `11.7.6` | `11.8.0` |
| [mysql-memory-server](https://github.com/Sebastian-Webster/mysql-memory-server-nodejs) | `1.14.1` | `1.15.0` |
| [webpack](https://github.com/webpack/webpack) | `5.109.0` | `5.109.2` |
| [webpack-cli](https://github.com/webpack/webpack-cli) | `7.2.1` | `7.2.2` |



Updates `@types/node` from 26.1.2 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `jose` from 6.2.4 to 6.2.8
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.4...v6.2.8)

Updates `mysql2` from 3.23.2 to 3.23.3
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.23.2...v3.23.3)

Updates `ws` from 8.21.1 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.1...8.21.3)

Updates `@types/better-sqlite3` from 7.6.13 to 9.6.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/better-sqlite3)

Updates `mocha` from 11.7.6 to 11.8.0
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/v11.8.0/CHANGELOG.md)
- [Commits](mochajs/mocha@v11.7.6...v11.8.0)

Updates `mysql-memory-server` from 1.14.1 to 1.15.0
- [Release notes](https://github.com/Sebastian-Webster/mysql-memory-server-nodejs/releases)
- [Commits](Sebastian-Webster/mysql-memory-server-nodejs@v1.14.1...v1.15.0)

Updates `webpack` from 5.109.0 to 5.109.2
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.109.0...v5.109.2)

Updates `webpack-cli` from 7.2.1 to 7.2.2
- [Release notes](https://github.com/webpack/webpack-cli/releases)
- [Changelog](https://github.com/webpack/webpack-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webpack/webpack-cli/compare/webpack-cli@7.2.1...webpack-cli@7.2.2)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-dependencies
- dependency-name: jose
  dependency-version: 6.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-dependencies
- dependency-name: mysql2
  dependency-version: 3.23.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-dependencies
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-dependencies
- dependency-name: "@types/better-sqlite3"
  dependency-version: 9.6.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: server-dependencies
- dependency-name: mocha
  dependency-version: 11.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: server-dependencies
- dependency-name: mysql-memory-server
  dependency-version: 1.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: server-dependencies
- dependency-name: webpack
  dependency-version: 5.109.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: server-dependencies
- dependency-name: webpack-cli
  dependency-version: 7.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: server-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants