[dependabot]

Bumps the backend-patches group with 8 updates in the /server/api directory:

Package	From	To
@grpc/grpc-js	1.14.5	1.14.7
express	5.2.1	5.3.0
express-rate-limit	8.7.0	8.7.2
pg	8.23.0	8.23.1
pgsql-parser	18.2.9	18.3.1
redis	6.2.1	6.3.1
ws	8.21.3	8.22.0
js-yaml	5.4.1	5.5.0

Updates @grpc/grpc-js from 1.14.5 to 1.14.7

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.14.7

• Fix a bug causing automatic retries to continue after a call is cancelled (#3102 contributed by @​phyous)
• Fix a bug causing automatic retries to fail to trigger in some cases (#3111 contributed by @​kahirokunn)

@​grpc/grpc-js 1.14.6

• Address remaining instances of advisory GHSA-f596-whhp-79r4 (#3105)
• Avoid Date allocations on request and channelz tracking paths (#3090 contributed by @​olavloite)
• Avoid throwaway timer allocation in ResolvingCall (#3092 contributed by @​olavloite)
• Avoid building metadata map when parsing trailers (#3093 contributed by @​olavloite)
• Lazily allocate Metadata opaqueData map (#3095 contributed by @​olavloite)
• Cache precomputed serviceUrl in InternalChannel (#3097 contributed by @​olavloite)
• Memoize method config lookup in default config selector (#3098 contributed by @​olavloite)
• Avoid array allocation for single-value metadata headers (#3099 contributed by @​olavloite)
• Avoid allocations for empty CallCredentials on the RPC hot path (#3100 contributed by @​olavloite)
• Avoid redundant metadata clone in RetryingCall on initial attempt (#3101 contributed by @​olavloite)

Commits

• 5e0c170 Merge pull request #3119 from murgatroid99/grpc-js_1.14.7
• 4fdb028 Merge commit from fork
• 870fd2b Merge commit from fork
• d3d1649 Merge pull request #3110 from murgatroid99/grpc-js-xds_authority_validation
• 387fcf3 grpc-js(-xds): Bump patch version (1.14.x)
• ea73ef5 Merge pull request #3118 from murgatroid99/grpc-js_refused_stream_fix_1.14_at...
• a167b2f grpc-js: Preserve HTTP/2 reset codes on write errors
• 5f932bf Merge pull request #3117 from murgatroid99/grpc-js_retry_cancel_backoff_fix_1.14
• e7b81e7 fix(grpc-js): stop retry attempts after the call is cancelled
• 99b5008 grpc-js-xds: Fix bug causing clients to accept resources from the wrong autho...
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

• cf6722b 5.3.0 (#7468)
• 8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
• 9efc29e docs: fix pass-through typos (#7509)
• 2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
• de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
• 9169cbe docs: add missing apostrophe in example (#7483)
• 7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
• 3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
• 98bd4cd deps: proxy-addr@^2.0.8 (#7474)
• 9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates express-rate-limit from 8.7.0 to 8.7.2

Release notes

Sourced from express-rate-limit's releases.

v8.7.2

You can view the changelog here.

v8.7.1

You can view the changelog here.

Commits

• 3fa4577 8.7.2
• 7427a5c v8.7.2 changelog
• da5b115 fix: don't un-count requests that complete after the window resets (#707)
• 28331a7 docs: Restore hyphenated anchor links for error codes (#705)
• 404bc3a docs: show how to reset the key of an IPv6 client (#704)
• e0b3886 docs: fix inverted skipSuccessfulRequests and ipv6Subnet descriptions (#703)
• 97bc073 chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 (#702)
• 991c16d chore(deps): bump ip-address from 10.7.1 to 10.7.3 (#699)
• a6ace2a chore(deps-dev): bump the development-dependencies group with 9 updates (#698)
• 518a0d5 chore(deps): bump ip-address from 10.7.0 to 10.7.1 (#696)
• Additional commits viewable in compare view

Updates pg from 8.23.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

Commits

• 0980cef Publish
• 2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
• 7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
• 9683053 fix(pg): do not treat Sync as connection ending (#3772)
• 4589038 fix: validate server certificate against host when connecting to an IP addres...
• 9808955 cleanup: Fix typo in comment
• 2b02f64 fix: avoid mutating query config (#3720)
• 0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
• 2991480 Deprecate serializing invalid Dates (#3731)
• c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
• Additional commits viewable in compare view

Updates pgsql-parser from 18.2.9 to 18.3.1

Commits

• e30cff7 chore(release): publish
• 8ac1a45 Merge pull request #363 from constructive-io/devin/1792896940-libpg-query-18-2-1
• edb98cc fix(deps): @​pgsql/parser ^1.6.2 (ESM import fix)
• 5c0cc33 fix(deps): bump libpg-query to 18.2.1 and @​pgsql/parser to ^1.6.1
• 2335550 chore(release): publish
• 5f11bc3 Merge pull request #362 from constructive-io/devin/1792798896-libpg-query-18-2-0
• 54703fd chore: leave config/versions.json unchanged; only the 18 line is republished
• 46ae9bd fix(deps): bump libpg-query to 18.2.0 and the 13-17 lines to their new releases
• b4605c2 chore(release): publish
• cf81016 Merge pull request #359 from constructive-io/fix/edge-case-literals
• Additional commits viewable in compare view

Updates redis from 6.2.1 to 6.3.1

Commits

• 5f86747 Release redis@6.3.1
• 12bcff0 Release entraid@6.3.1
• 0f57a03 Release time-series@6.3.1
• 63a9b6d Release search@6.3.1
• d0f8bbf Release json@6.3.1
• 2c23509 Release bloom@6.3.1
• 9902897 Release client@6.3.1
• 492cb2e fix(entraid): bump @​azure/msal-node to 7.1 for CVE-2026-109461 (#3543)
• c8ff8cc Release redis@6.3.0
• c3e8b53 Release entraid@6.3.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for redis since your current version.

Updates ws from 8.21.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

• Introduced the protocols option (8b918b01).

Bug fixes

• Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

Commits

• 297202c [dist] 8.22.0
• 8b918b0 [feature] Introduce the protocols option
• 73e03eb [ci] Update actions/setup-node action to v7
• d9b8954 [fix] Change the ready state after validating the arguments (#2337)
• See full diff in compare view

Updates js-yaml from 5.4.1 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
zecblock	Ready	Preview	Nov 2, 2026 3:18pm UTC

2 Skipped Deployments

Project	Deployment	Actions	Updated
zecblock-crosslink	Ignored	Preview	Nov 2, 2026 3:18pm UTC
zecblock-testnet	Ignored	Preview	Nov 2, 2026 3:18pm UTC

[dependabot]

Labels

The following labels could not be found: backend, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.