chore(deps)(deps): bump the major-dependencies group with 11 updates by dependabot[bot] · Pull Request #128 · airlinklabs/panel

dependabot · 2026-09-15T08:23:01Z

Bumps the major-dependencies group with 11 updates:

Package	From	To
@dicebear/core	`9.4.3`	`10.7.0`
@simplewebauthn/browser	`13.3.0`	`14.0.0`
@simplewebauthn/server	`13.3.3`	`14.0.1`
@xterm/xterm	`5.5.0`	`6.0.0`
chalk	`5.6.2`	`6.0.0`
connect-redis	`9.0.0`	`10.0.0`
ioredis	`5.11.1`	`6.0.0`
nodemailer	`9.1.1`	`10.0.8`
@types/node	`25.9.5`	`26.5.1`
typescript	`6.0.3`	`7.0.2`
vitest	`4.1.11`	`5.0.0`

Updates @dicebear/core from 9.4.3 to 10.7.0

Release notes

Sourced from @dicebear/core's releases.

DiceBear 10.7 - Release Notes

DiceBear 10.7 adds six new styles and takes the collection from 55 to 61. It also adds a seventh language: the core runs in C# now, which is what a Godot or Unity game needs to draw an avatar without asking a server first.

🎨 Six new avatar styles

All six ship in @dicebear/styles 10.6.0 as DiceBear originals under CC0 1.0, so use them wherever you want, commercial projects included, no attribution needed.

Cameo

A head with hair and a mouth, and no eyes at all. Everything is painted in one body color under a translucent black or white overlay, so a portrait holds a single hue in two tones.

Gaze

A pair of eyes on a colored body, and nothing else. Eleven silhouettes, eleven eye pairs, five spacings, and the eyes take whichever ink holds up against the body color.

Gaze is the only animated one of the six, which brings that count to 19 of 61. Switch it on with animationVariant or tags=animation, and the eyes wander and blink while the body hops:

Marbles

A small face on a colored sphere. Three blurred ellipses do the shading, so the ball reads as round without a single gradient definition, and twenty tops cover hats, headphones, hair, a bow and an antenna.

Shadows

A bust as one filled silhouette, all of it in a single ink on a pale ground. The hat or the hairstyle sits behind the head, so the two merge into one outline.

Slice

One silhouette, cut into three to six horizontal bands that shift sideways against each other. Each band carries a different amount of white over the body color, so the shape runs through one hue from light to dark.

Stack

A balanced pile of stones. Eleven layouts set how many stones lie on each other and how far they lean, and each one squashes one of seven stone shapes to its own width and height.

🎮 The core in C#

... (truncated)

Changelog

Sourced from @dicebear/core's changelog.

[10.7.0] - 2026-08-26

Changed

Styles: Bumped @dicebear/styles to 10.6.0 for the CLI, the docs, and the editor. The release adds cameo, gaze, marbles, shadows, slice, and stack, which take the collection from 55 to 61 styles. gaze is animated, which takes that count from 18 to 19. Each of the six has a style page with its own preview row and a preset gallery, and the four the docs list under Characters are in the editor too.

Editor: Option labels can now differ per style. They are one flat map per language, because an option key almost always means the same thing wherever it appears. German was the exception: it gave the head and the piece sitting on top of it the same word, "Kopf", in bottts and croodles, which put two identical tabs in one strip, while English and Portuguese already told the two apart. A style that needs a different word now overrides that one label under styles.<styleName> in the message file, and only the language that deviates carries an override. marbles and cameo took one too, for a highlight that German and Portuguese called a flower and for a body color on a style that draws no body. npm run validate:messages now fails the build on a missing label, on two keys resolving to the same word inside one style, and on an override whose key or style is gone.

Fixed

Core (C#): Validation and rendering now agree with the other cores in several places where 10.7.0-rc.1 did not. Schema patterns are rewritten before they are compiled, because .NET reads $ as matching before a trailing newline and narrows \s to ASCII, which let a trailing newline through every anchored pattern and let non-ASCII whitespace past the javascript: and url() filters. A seed or title holding an unpaired surrogate keeps it instead of becoming U+FFFD, which used to produce a different avatar. The JSON envelope writes supplementary-plane characters literally. Avatar.FromJson rejects JSON that is not an object. A component that references itself raises CircularComponentReferenceException instead of overflowing the stack.

The color helpers are no longer public. DiceBear.Color collided with Godot.Color, UnityEngine.Color and System.Drawing.Color, so a file with using DiceBear; stopped compiling. This is a breaking change for anyone on 10.7.0-rc.1 who called them.

[10.7.0-rc.1] - 2026-08-22

Added

Core: A C# port, published to NuGet as DiceBear.Core. It renders SVG byte-identical to the JavaScript reference and the PHP, Python, Rust, Go, and Dart ports, and runs the shared parity fixtures to prove it. The package targets netstandard2.0 and net8.0, which covers .NET 8 and newer, .NET

... (truncated)

Commits

e870a5a v10.7.0
b5bb252 feat: add the six styles from 10.6.0 to the docs and the editor
15eb533 docs: give Godot and Unity their own framework guides
918fd7f chore: deploy the website only on demand
a153f97 fix: move to schema 1.5.1 and drop the pattern workarounds
6a44369 fix: match the reference's ASCII word boundary when randomizing ids
9ec2776 perf(csharp): cut the allocations out of the render path
5ee386e chore: fix the C# contributor commands and narrow the prettier ignore
0063b39 docs: count seven languages after the C# port
9a5fca7 fix(csharp): match the reference on schema patterns, unicode and recursion
Additional commits viewable in compare view

Updates @simplewebauthn/browser from 13.3.0 to 14.0.0

Release notes

Sourced from @simplewebauthn/browser's releases.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @agektmr)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

[server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

[server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

[server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

[server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

[browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

v13.3.3

Changes:

[server] Updated MDS blob signature verification to support more algorithms (#788)

[server] Updated MetadataService to know about the new FIDO MDS blob trust anchor certificate (#789)

v13.3.2

This update fixes a CVSS v4 Low (2.0) security vulnerability identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Fixed an issue with verifyRegistrationResponse() allowing a maliciously-crafted attestation statement's x5c to contain a self-signed "root certificate" instead of chaining back to an RP-specified trust anchor (GHSA-6hxq-p678-4hr2)

v13.3.1

Changes:

... (truncated)

Changelog

Sourced from @simplewebauthn/browser's changelog.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info

... (truncated)

Commits

3e2dc0c Update version to v14.0.0
618c0e9 Merge v14.0.0 milestone to master (#792)
See full diff in compare view

Updates @simplewebauthn/server from 13.3.3 to 14.0.1

Release notes

Sourced from @simplewebauthn/server's releases.

v14.0.1

[server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @agektmr)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

[server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

[server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

[server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

[server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

[browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

Changelog

Sourced from @simplewebauthn/server's changelog.

v14.0.1

Changes:

[server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

... (truncated)

Commits

0bfdc3b Update server version to v14.0.1
4831ce2 Fix X.509 parsing to support PQC use in attestation statements (#800)
3e2dc0c Update version to v14.0.0
618c0e9 Merge v14.0.0 milestone to master (#792)
See full diff in compare view

Updates @xterm/xterm from 5.5.0 to 6.0.0

Release notes

Sourced from @xterm/xterm's releases.

6.0.0

Features

#5453 Add synchronized output support (DEC mode 2026)

#5436 add range to IHTMLSerializeOptions

#5334 Support shadow dom in webgl renderer

#5285 Support detailed ligatures and variants

#5251 progress-addon

#5234 Add reflowCursorLine option

#5224 putty-style ED2 sequence handling as terminal option

#5107 Add top/bottom border overview ruler options

⚠️ This is a breaking change, ITerminalOptions.overviewRulerWidth is now a property of ITerminalOptions.overviewRuler

#5096 Integrate base/ platform from VS Code and adopt scroll bar

⚠️ This is a potential breaking change, the viewport/scroll bar works very differently now

#5092 Add support for ESM via esbuild

#5034 Expose onWriteParsed on API

#4220 Add support to ANSI OSC52

Fixes

#5445 Prefer performance.now() over Date.now()

#5437 Prevent entire page from scrolling when scrolling in alt buffer with mouse event off

#5423 Clear selection on vertical resize

#5411 Fix teleport when exiting out of alt buffer. v2

#5391 Bring back partial wheel tracking

#5390 Fix scrollbar teleport after exiting alt buffer

#5386 fix: ensure that currentRow can not go out of the range

#5385 Fix terminal find when wrapped

#5355 Add note about reverse tabnapping

#5346 Remove alt -> ctrl+arrow hack in favor of embedder-specific solutions

⚠️ This is a breaking change, you will need to add keybindings in your code if you want alt to map to ctrl still

#5337 Fix finding terms across wrapped lines

#5335 webgl: Ignore alpha channel when allowTransparency is false

#5328 Refresh viewport after clear or ED

#5305 Fix issue where listeners remain after WebglRenderer throws

#5291 Make ProgressAddon.onChange non undefined

#5282 Fixed CapsLock triggering input twice in MacOS.

#5279 Fixes: #5270 regex case-sensitive should behave like monaco

#5278 Handle glyph widths up to the maximum device texture size

#5277 Disable ligatures when cursor is in range

#5276 Fix selection rendering on ligatures in both renderers

#5265 Revert to cursor options after DECSCUSR 0

#5263 Make textarea readonly when disableStdin is set

#5262 Blend cursorAccent with background too

#5260 Blend cursor with background to support alpha in webgl

#5253 bug: properly render the terminal when open() is called again

#5249 Fix click event bug caused by DomRenderer replaceChildren behavior

#5209 Ensure last ligature cell is updated

#5208 Set liga font feature when ligatures is enabled

#5182 fix #5181

... (truncated)

Commits

f447274 Merge pull request #5463 from Tyriar/tyriar/v6
f68d1e5 Skip sync output tests for now
30691e8 v6.0.0, bump addon versions, publish unicode graphemes
5fa6325 Merge pull request #5462 from Tyriar/tyriar/deprecated
3571d1f Remove windowsMode in favor of windowsPty
ebc0d83 Remove deprecated/unused fastScrollModifier
d1c50c1 Merge pull request #5461 from Tyriar/tyriar/glob
92b43bd Remove only
a9d3ca1 Merge pull request #5449 from iSuslov/exports/esm-headless-node
cb4d1ef Merge pull request #5453 from chrislloyd/feat/synchronized-output
Additional commits viewable in compare view

Updates chalk from 5.6.2 to 6.0.0

Release notes

Sourced from chalk's releases.

v6.0.0

Breaking

Require Node.js 22 8a94e0e

Improvements

Add underline styles and underline colors (#689) 4c304dd

Improve performance 5729845 fa5cff2

Fixes

Treat a numeric FORCE_COLOR as an exact level (#688) e912931

Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687) ff549c5

chalk/chalk@v5.6.2...v6.0.0

Commits

661317e 6.0.0
5729845 Improve performance
4c304dd Add extended underline styles and underline colors (#689)
e912931 Fix: Treat a numeric FORCE_COLOR as an exact level (#688)
8a94e0e Require Node.js 22
fa5cff2 Optimize 2-argument calls (#670)
ff549c5 Fix: Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687)
678e550 Tweaks
aa06bb5 Fix typos (#664)
See full diff in compare view

Updates connect-redis from 9.0.0 to 10.0.0

Release notes

Sourced from connect-redis's releases.

v10.0.0

Breaking changes

#439 - Fix broken windows (@wavded)

Maintenance

#439 - Fix broken windows (@wavded)

#435 - Fix broken windows (@wavded)

Commits

559183d 10.0.0
51e2f01 Fix broken windows (#439)
8d733b3 Fix broken windows: (#435)
See full diff in compare view

Updates ioredis from 5.11.1 to 6.0.0

Release notes

Sourced from ioredis's releases.

v6.0.0

6.0.0 (2026-07-31)

Add RESP3 (#2127) (5d0862e)

Bug Fixes

clear stale socket timeout on reconnect (#2148) (6455dbe)

cluster: recreate stale connection on circular MOVED (#2135) (08c8967)

cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267

command: serialize large integer arguments in decimal notation (#2136) (09b8d04)

redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)

sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)

tracing: redact values for GETSET and PSETEX (#2134) (832765d)

types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

add LMOVEM and BLMOVEM command support (#2144) (c26af46)

add Redis 8.10 set cardinality commands (#2143) (301099b)

himport managed fieldsets (#2159) (729f174)

improve default connection resilience (#2160) (6d0716e)

support MAXCOUNT and MAXSIZE for stream reads (#2142) (ae5e41b)

BREAKING CHANGES

ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

Add RESP3 (#2127) (5d0862e)

Bug Fixes

clear stale socket timeout on reconnect (#2148) (6455dbe)

cluster: recreate stale connection on circular MOVED (#2135) (08c8967)

cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267

command: serialize large integer arguments in decimal notation (#2136) (09b8d04)

redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)

sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)

tracing: redact values for GETSET and PSETEX (#2134) (832765d)

... (truncated)

Changelog

Sourced from ioredis's changelog.

6.0.0 (2026-07-31)

Add RESP3 (#2127) (5d0862e)

Bug Fixes

clear stale socket timeout on reconnect (#2148) (6455dbe)

cluster: recreate stale connection on circular MOVED (#2135) (08c8967)

cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267

command: serialize large integer arguments in decimal notation (#2136) (09b8d04)

redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)

sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)

tracing: redact values for GETSET and PSETEX (#2134) (832765d)

types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

add LMOVEM and BLMOVEM command support (#2144) (c26af46)

add Redis 8.10 set cardinality commands (#2143) (301099b)

himport managed fieldsets (#2159) (729f174)

improve default connection resilience (#2160) (6d0716e)

support MAXCOUNT and MAXSIZE for stream reads (#2142) (ae5e41b)

BREAKING CHANGES

ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

Commits

8ed2946 chore(release): 6.0.0 [skip ci]
3b410f8 docs: clarify managed HIMPORT fieldset behavior (#2161)
729f174 feat: himport managed fieldsets (#2159)
6d0716e feat: improve default connection resilience (#2160)
cf3bf71 fix(types): export ScanStreamOptions, RedisStatus and ClusterStatus (#2158)
aac171b ci: update Redis test image (#2156)
807bb1c chore(release): update repository URL (#2154)
6c889e7 docs: add security policy (#2153)
6455dbe fix: clear stale socket timeout on reconnect (#2148)
9618206 fix(cluster): validate MOVED slot to prevent Array.prototype pollution (#2151)
Additional commits viewable in compare view

Updates nodemailer from 9.1.1 to 10.0.8

Release notes

Sourced from nodemailer's releases.

v10.0.8

10.0.8 (2026-09-11)

Bug Fixes

mime-node: clean the boundary where it is written, not only where it is built (e14278d)

mime-node: drop every control character from multipart boundary material (a82a355)

v10.0.7

10.0.7 (2026-09-11)

Bug Fixes

mime-funcs: do not double encode Buffer input when chunking base64 mime words (#1865) (4327a59)

mime-node: keep a boundary that is only line breaks from stripping to empty (ec46800)

mime-node: strip line breaks from multipart boundary material (#1867) (03c1a5c)

smtp-pool: release rate-limited connections on close (#1866) (7f5c7a4)

v10.0.6

10.0.6 (2026-09-11)

Bug Fixes

addressparser: scan free text for an address in linear time (437d7fc)

v10.0.5

10.0.5 (2026-09-11)

Bug Fixes

addressparser: parse comment-joined addresses in linear time (c07f175)

v10.0.4

10.0.4 (2026-09-11)

Bug Fixes

fetch: scope a cookie without a Path to the RFC 6265 default path (2f907cb)

fetch: send cookies set with Path back to the exact path (

Bumps the major-dependencies group with 11 updates: | Package | From | To | | --- | --- | --- | | [@dicebear/core](https://github.com/dicebear/dicebear) | `9.4.3` | `10.7.0` | | [@simplewebauthn/browser](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/browser) | `13.3.0` | `14.0.0` | | [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) | `13.3.3` | `14.0.1` | | [@xterm/xterm](https://github.com/xtermjs/xterm.js) | `5.5.0` | `6.0.0` | | [chalk](https://github.com/chalk/chalk) | `5.6.2` | `6.0.0` | | [connect-redis](https://github.com/tj/connect-redis) | `9.0.0` | `10.0.0` | | [ioredis](https://github.com/redis/ioredis) | `5.11.1` | `6.0.0` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `9.1.1` | `10.0.8` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.5` | `26.5.1` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.11` | `5.0.0` | Updates `@dicebear/core` from 9.4.3 to 10.7.0 - [Release notes](https://github.com/dicebear/dicebear/releases) - [Changelog](https://github.com/dicebear/dicebear/blob/11.x/CHANGELOG.md) - [Commits](dicebear/dicebear@v9.4.3...v10.7.0) Updates `@simplewebauthn/browser` from 13.3.0 to 14.0.0 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.0/packages/browser) Updates `@simplewebauthn/server` from 13.3.3 to 14.0.1 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.1/packages/server) Updates `@xterm/xterm` from 5.5.0 to 6.0.0 - [Release notes](https://github.com/xtermjs/xterm.js/releases) - [Commits](xtermjs/xterm.js@5.5.0...6.0.0) Updates `chalk` from 5.6.2 to 6.0.0 - [Release notes](https://github.com/chalk/chalk/releases) - [Commits](chalk/chalk@v5.6.2...v6.0.0) Updates `connect-redis` from 9.0.0 to 10.0.0 - [Release notes](https://github.com/tj/connect-redis/releases) - [Commits](tj/connect-redis@v9.0.0...v10.0.0) Updates `ioredis` from 5.11.1 to 6.0.0 - [Release notes](https://github.com/redis/ioredis/releases) - [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md) - [Commits](redis/ioredis@v5.11.1...v6.0.0) Updates `nodemailer` from 9.1.1 to 10.0.8 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v9.1.1...v10.0.8) Updates `@types/node` from 25.9.5 to 26.5.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.3...v7.0.2) Updates `vitest` from 4.1.11 to 5.0.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/vitest) --- updated-dependencies: - dependency-name: "@dicebear/core" dependency-version: 10.7.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: "@simplewebauthn/browser" dependency-version: 14.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: "@simplewebauthn/server" dependency-version: 14.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: "@xterm/xterm" dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: chalk dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: connect-redis dependency-version: 10.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: ioredis dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: nodemailer dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: "@types/node" dependency-version: 26.5.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: vitest dependency-version: 5.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-15T08:23:03Z

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

coderabbitai · 2026-09-15T08:23:07Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: ce21ac95-ae60-4b97-9de8-12a8111f1c29

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot · 2026-09-20T22:39:15Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 15, 2026

dependabot Bot closed this Sep 20, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/major-dependencies-31735616b6 branch September 20, 2026 22:39

Navigation Menu

Uh oh!

chore(deps)(deps): bump the major-dependencies group with 11 updates - #128

chore(deps)(deps): bump the major-dependencies group with 11 updates#128
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/major-dependencies-31735616b6

dependabot Bot commented on behalf of github Sep 15, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 15, 2026

Uh oh!

coderabbitai Bot commented Sep 15, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DiceBear 10.7 - Release Notes

🎨 Six new avatar styles

Cameo

Gaze

Marbles

Shadows

Slice

Stack

🎮 The core in C#

[10.7.0] - 2026-08-26

Changed

Fixed

[10.7.0-rc.1] - 2026-08-22

Added

v14.0.0 - The one after they go quantum

Breaking Changes

v13.3.3

v13.3.2

v13.3.1

v14.0.0 - The one after they go quantum

v14.0.1

v14.0.0 - The one after they go quantum

Breaking Changes

v14.0.1

v14.0.0 - The one after they go quantum

6.0.0

Features

Fixes

v6.0.0

Breaking

Improvements

Fixes

v10.0.0

Breaking changes

Maintenance

v6.0.0

6.0.0 (2026-07-31)

Bug Fixes

Features

BREAKING CHANGES

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

Bug Fixes

6.0.0 (2026-07-31)

Bug Fixes

Features

BREAKING CHANGES

v10.0.8

10.0.8 (2026-09-11)

Bug Fixes

v10.0.7

10.0.7 (2026-09-11)

Bug Fixes

v10.0.6

10.0.6 (2026-09-11)

Bug Fixes

v10.0.5

10.0.5 (2026-09-11)

Bug Fixes

v10.0.4

10.0.4 (2026-09-11)

Bug Fixes

Uh oh!

dependabot Bot commented on behalf of github Sep 15, 2026

Labels

Uh oh!

coderabbitai Bot commented Sep 15, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

dependabot Bot commented on behalf of github Sep 15, 2026 •

edited

Loading