Skip to content

deps: bump the production-minor-and-patch group across 1 directory with 7 updates - #62

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/production-minor-and-patch-74058a5327
Open

deps: bump the production-minor-and-patch group across 1 directory with 7 updates#62
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/production-minor-and-patch-74058a5327

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-minor-and-patch group with 7 updates in the /backend directory:

Package From To
@google/genai 2.18.0 2.21.0
express-rate-limit 8.6.2 8.7.0
mongoose 9.9.3 9.9.5
pdfkit 0.19.1 0.20.2
zod 4.4.3 4.5.4
@img/sharp-linux-x64 0.35.3 0.35.4
@img/sharp-libvips-linux-x64 1.3.2 1.3.3

Updates @google/genai from 2.18.0 to 2.21.0

Release notes

Sourced from @​google/genai's releases.

v2.21.0

2.21.0 (2026-09-02)

Features

  • Add Gemini 3.8 Flash model to SDKs and update Flash model descriptions (4a969fe)

v2.20.0

2.20.0 (2026-08-31)

Features

  • Add support for the audio/webm MIME type. (b0e3c5f)
  • Add translation_config SDK support for GEAP. (3e1d923)
  • add Video Understanding support to the Interactions API (6ddbeba)

Bug Fixes

  • Don't set redundant Content-Length on file upload requests (2f5cc7a)
  • Don't set redundant Content-Length on file upload requests (2f5cc7a), refs #1718
  • expose ProcessingCallStep and ProcessingResultStep in Interactions SDK (b6f8db5)
  • Quote setupComplete key in LiveClientMessage (4467faf)

v2.19.0

2.19.0 (2026-08-25)

Features

  • Add AudioTranscriptionConfigMode (c0a37de)
  • add environment files support and scotty file download helper (0d6ee9d)
  • Add TYPE_JPEG2000 to VideoContent.MimeType enum (41da204)

Performance Improvements

  • Keep the Buffer in the Node tokenizer platform, ~2x faster model parse (11d804a)
Changelog

Sourced from @​google/genai's changelog.

2.21.0 (2026-09-02)

Features

  • Add Gemini 3.8 Flash model to SDKs and update Flash model descriptions (4a969fe)

2.20.0 (2026-08-31)

Features

  • Add support for the audio/webm MIME type. (b0e3c5f)
  • Add translation_config SDK support for GEAP. (3e1d923)
  • add Video Understanding support to the Interactions API (6ddbeba)

Bug Fixes

  • Don't set redundant Content-Length on file upload requests (2f5cc7a)
  • Don't set redundant Content-Length on file upload requests (2f5cc7a), refs #1718
  • expose ProcessingCallStep and ProcessingResultStep in Interactions SDK (b6f8db5)
  • Quote setupComplete key in LiveClientMessage (4467faf)

2.19.0 (2026-08-25)

Features

  • Add AudioTranscriptionConfigMode (c0a37de)
  • add environment files support and scotty file download helper (0d6ee9d)
  • Add TYPE_JPEG2000 to VideoContent.MimeType enum (41da204)

Performance Improvements

  • Keep the Buffer in the Node tokenizer platform, ~2x faster model parse (11d804a)
Commits
  • 27af897 chore(main): release 2.21.0 (#1915)
  • 4a969fe feat: Add Gemini 3.8 Flash model to SDKs and update Flash model descriptions
  • 8233d41 chore: docs
  • 7fe15a6 chore(main): release 2.20.0 (#1899)
  • b0e3c5f feat: Add support for the audio/webm MIME type.
  • 3e1d923 feat: Add translation_config SDK support for GEAP.
  • b6f8db5 fix: expose ProcessingCallStep and ProcessingResultStep in Interactions SDK
  • 4467faf fix: Quote setupComplete key in LiveClientMessage
  • 6ddbeba feat: add Video Understanding support to the Interactions API
  • 6a44ab0 chore: keep config as the last method parameter
  • Additional commits viewable in compare view

Updates express-rate-limit from 8.6.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

Commits
  • 48db09e 8.7.0
  • dce5871 v8.7.0 changelog
  • 2f08044 Add inspect.software health badge (#673)
  • a29757c feat: add retryAfter option (#661)
  • 146e88b chore: rename license
  • 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
  • 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
  • 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
  • 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
  • 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
  • Additional commits viewable in compare view

Updates mongoose from 9.9.3 to 9.9.5

Release notes

Sourced from mongoose's releases.

9.9.5 / 2026-09-04

  • fix(query): pass schema through when casting a nested $expr comparison #16496 rajanpanth
  • fix(projection): build the dotted path correctly in isPathSelectedInclusive #16495 rajanpanth
  • fix(document): replace {MODEL} in custom cast error messages from document validation #16480 #8300 AbinMadathil-Celigo
  • types(model): add missing properties to listSearchIndexes() return type #16486 lazerg

9.9.4 / 2026-08-25

  • fix(query): set strictQuery and strict on _mongooseOptions consistently #16451 #16447
  • fix(hydration): use the doc model for looking up a ref #16453 rawmind
  • fix(schema): drop the map values subpath when removing a map path #16457 rawmind
  • fix(schema): remove a map that lives under a nested path #16461 #16457 luantaraschi
  • fix(schema): do not repeat null in a toJSONSchema enum that already lists null #16456 luantaraschi
  • fix(schema): clone a document array element with its own constructor signature #16463 #16462 luantaraschi
  • fix(schema): keep the map value schematype a single object when cloning #16473 luantaraschi
  • fix(schema): clarify duplicate index warning to note index is not created #16476 vjymisal0
  • perf(model): index bulkSave write errors by document id #16474 yoominho91
  • docs: add Atlas Vector Search and Atlas Search documentation #16395
  • docs: fix dead MongoDB driver Collection link #16458 rajanpanth
Changelog

Sourced from mongoose's changelog.

9.9.5 / 2026-09-04

  • fix(query): pass schema through when casting a nested $expr comparison #16496 rajanpanth
  • fix(projection): build the dotted path correctly in isPathSelectedInclusive #16495 rajanpanth
  • fix(document): replace {MODEL} in custom cast error messages from document validation #16480 #8300 AbinMadathil-Celigo
  • types(model): add missing properties to listSearchIndexes() return type #16486 lazerg

9.9.4 / 2026-08-25

  • fix(query): set strictQuery and strict on _mongooseOptions consistently #16451 #16447
  • fix(hydration): use the doc model for looking up a ref #16453 rawmind
  • fix(schema): drop the map values subpath when removing a map path #16457 rawmind
  • fix(schema): remove a map that lives under a nested path #16461 #16457 luantaraschi
  • fix(schema): do not repeat null in a toJSONSchema enum that already lists null #16456 luantaraschi
  • fix(schema): clone a document array element with its own constructor signature #16463 #16462 luantaraschi
  • fix(schema): keep the map value schematype a single object when cloning #16473 luantaraschi
  • fix(schema): clarify duplicate index warning to note index is not created #16476 vjymisal0
  • perf(model): index bulkSave write errors by document id #16474 yoominho91
  • docs: add Atlas Vector Search and Atlas Search documentation #16395
  • docs: fix dead MongoDB driver Collection link #16458 rajanpanth

8.24.4 / 2026-08-21

Commits
  • 86292f0 chore: release 9.9.5
  • 85e32e2 Merge pull request #16496 from rajanpanth/fix/cast-expr-nested-args
  • 51ca33e Merge pull request #16495 from rajanpanth/fix/is-path-selected-inclusive-dotted
  • 2baeeb4 Merge pull request #16486 from lazerg/gh-16485-list-search-indexes-types
  • 605e328 fix(query): pass schema through when casting a nested $expr comparison
  • 18ef9e1 fix(projection): build the dotted path correctly in isPathSelectedInclusive
  • 4c1c6bf Merge branch 'master' into gh-16485-list-search-indexes-types
  • e55d4ce Merge pull request #16487 from Automattic/dependabot/npm_and_yarn/master/esli...
  • eb9fa48 test(schema): remove stray pasted URL that broke lint
  • cf9a5d3 Merge pull request #16490 from Automattic/dependabot/npm_and_yarn/master/mark...
  • Additional commits viewable in compare view

Updates pdfkit from 0.19.1 to 0.20.2

Release notes

Sourced from pdfkit's releases.

v0.20.2

  • Fix bundlers and file tracers packing the ESM copies of the standard font metrics instead of the CommonJS ones the Node build actually loads, which left Cannot find module errors for every standard font at runtime, by resolving the internal #standard-fonts/* mapping to a single file under all conditions
  • Fix doc.file() throwing when the same in-memory attachment is embedded twice under one name, because the creation and modified dates the deduplication check compares are absent for sources that are not read from disk
  • Fix doc.text() throwing unsupported number: NaN when lineBreak: false is combined with underline, strike, link or goTo, because the rendered width was computed from the line wrapper's measurements, which are never produced when wrapping is disabled

v0.20.1

  • Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

v0.20.0

Highlights

TLDR: "A PDF generation library for Node.js" -> "A JavaScript PDF generation library"

Standard Font Support rewritten

Standard font support has been rewritten to use pre-parsed font metrics instead of parsing raw AFM definitions at runtime. The new approach is more efficient (less runtime overhead and memory usage) and reduces the size of the browser bundle significantly. Standalone build which bundles all standard fonts is down to 1.3MB from 2.3MB.

In Node, font metrics are loaded lazily as before, while in browser builds, except the standalone one, each font must be imported from pdfkit/standard-fonts/* and registered with registerStdFonts(). Previously, to use a standard font in browser was necessary to use a bundler.

See usage example in output helpers section below.

Removal of Node specific dependencies

Buffer is no longer used internally. Uint8Array is now the minimum denominator for binary data in both Node and browsers. Since Buffer is a Uint8Array subclass, this change is fully backward compatible.

Native fs, zlib and ReadableStream are conditionally imported only in Node. Browser builds use minimal implementations. This approach gives us the best of both worlds: Node builds still use the native modules, while browser ones are portable.

Many thanks to @​diegomura for his help in removing the Node specific dependencies.

registerFile API

The new registerFile(path, data) API allows registering in-memory files globally. The data argument must be a Uint8Array. Passing undefined as data unregisters the path.

In browsers, it can be used as a simplified virtual file system. In Node, this is useful for registering fonts, images and other resources that are not available on disk. The native file system is still used when the path is not registered.

import { PDFDocument, registerFile } from 'pdfkit';
const response = await fetch('/fonts/Roboto-Regular.ttf');
const fontData = new Uint8Array(await response.arrayBuffer());
registerFile('fonts/Roboto-Regular.ttf', fontData);
const doc = new PDFDocument();
// register an alias for the font path
doc.registerFont('Roboto', 'fonts/Roboto-Regular.ttf');
// or use the path directly
doc.font('fonts/Roboto-Regular.ttf');
</tr></table>

... (truncated)

Changelog

Sourced from pdfkit's changelog.

[v0.20.2] - 2026-08-29

  • Fix bundlers and file tracers packing the ESM copies of the standard font metrics instead of the CommonJS ones the Node build actually loads, which left Cannot find module errors for every standard font at runtime, by resolving the internal #standard-fonts/* mapping to a single file under all conditions
  • Fix doc.file() throwing when the same in-memory attachment is embedded twice under one name, because the creation and modified dates the deduplication check compares are absent for sources that are not read from disk
  • Fix doc.text() throwing unsupported number: NaN when lineBreak: false is combined with underline, strike, link or goTo, because the rendered width was computed from the line wrapper's measurements, which are never produced when wrapping is disabled

[v0.20.1] - 2026-08-23

  • Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

[v0.20.0] - 2026-08-23

  • [BREAKING CHANGE] Remove the virtual file system (pdfkit/virtual-fs). Browser builds no longer depend on fs: use registerFile to register Uint8Array data under a path, pass a Uint8Array or ArrayBuffer directly to registerFont, image and file, or pass a data URL directly to image and file
  • Add registerFile(path, data, options) to globally register in-memory files in Node and browsers, with optional birthtime and ctime metadata. Passing undefined as data unregisters the path
  • [BREAKING CHANGE] Export PDFDocument, LineWrapper and registerFile as named exports from the main Node and browser entry points while preserving the default PDFDocument export
  • Add experimental toBlob(document) and toBytes(document) output helpers under pdfkit/output
  • Accept already-parsed fontkit Font instances in doc.font() and registerFont
  • Load the PDF/A ICC profile from disk only when needed in Node, while continuing to bundle it in browser builds
  • Add tools to convert raw AFM standard-font definitions into parsed or compact runtime JavaScript modules
  • [BREAKING CHANGE] Use generated standard-font data instead of parsing raw AFM definitions at runtime. Node loads font metrics lazily; browser applications must import each font they use from pdfkit/standard-fonts/* and register it with registerStdFonts()
  • [BREAKING CHANGE] Restrict AcroForm options to documented mappings and explicit escape hatches.
  • [BREAKING CHANGE] Stop automatically uppercasing annotation option keys.
  • [BREAKING CHANGE] Throw from addNamedEmbeddedFile when no ref is given, instead of writing an unparseable undefined token into the /EmbeddedFiles name tree
  • Do not mutate options passed to doc.annotate() and its convenience methods (link, note, strike, lineAnnotation, rectAnnotation, ellipseAnnotation, textAnnotation, fileAnnotation)
  • Persist font options when adding a new page. Fixes #1739
  • Use Uint8Array instead of Node's Buffer internally
  • Fix date text field formatting emitting invalid JavaScript, so the format was never applied. Fixes #1546
  • Fix indentAllLines applying the indent again on every paragraph and every page break, and keep it applied across continued text. Fixes #1606
  • Fix a hole in a sparse array being skipped entirely, which shifted every later entry down one
  • Encrypt strings inside name trees. Fixes #1513
Commits
  • 8d72a71 v0.20.2
  • 70c9ad5 Document the parameter list each destination type takes (#1785)
  • e04b677 Fix doc.text() throwing NaN with lineBreak false and underline/strike/link/go...
  • c6f57c6 fix: resolve #standard-fonts/* to one file under every condition (#1782)
  • b87b5ac Fix case-insensitive lookup for named CSS colors (#1780)
  • 69671d9 Fix doc.file() throwing when the same in-memory attachment is added twice (#1...
  • 1f1abb8 Bump ip-address from 10.2.0 to 10.4.0 (#1761)
  • f58c4c7 Bump postcss from 8.5.15 to 8.5.25 (#1762)
  • f048bdd v0.20.1
  • 910c86a Add Node ESM build: route the node import condition to a real Node bundle (#1...
  • Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

  • 84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)
  • e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

  • e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema
  • 87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines
  • 99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)
  • e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open
  • 7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar
  • eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

  • a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
  • d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
  • 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
  • e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
  • fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
  • 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
  • 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

  • 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • e8e206f 4.5.4
  • 84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
  • 1a16102 4.5.3
  • eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
  • 7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
  • e3a695b docs(v4): record the email regex and container output-shape findings under Open
  • 99fce39 bench(v4): z.compile() against zod-compiler (#6499)
  • 87d6464 fix(docs): drop the OG description when the title wraps past two lines
  • e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
  • 9a193aa 4.5.2
  • Additional commits viewable in compare view

Updates @img/sharp-linux-x64 from 0.35.3 to 0.35.4

Release notes

Sourced from @​img/sharp-linux-x64's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

Commits

Updates @img/sharp-libvips-linux-x64 from 1.3.2 to 1.3.3

Release notes

Sourced from @​img/sharp-libvips-linux-x64's releases.

v1.3.3

Dependency Version
aom 3.15.0
archive 3.8.9
cairo 1.18.4
cgif 0.5.3
exif 0.6.26
expat 2.8.3
ffi 3.8.0
fontconfig 2.18.3
freetype 2.14.3
fribidi 1.0.16
glib 2.89.4
harfbuzz 14.3.1
heif 1.23.2
highway 1.4.0
imagequant 2.4.1
lcms 2.19.1
mozjpeg 0826579
pango 1.58.2
pixman 0.46.4
png 1.6.58
proxy-libintl 0.5
rsvg 2.62.91
tiff 4.7.2
uhdr 2.0.2
vips 8.18.6
webp 1.6.0
xml2 2.15.3
zlib-ng 2.3.3

v1.3.3-rc.0

Dependency Version
aom 3.14.1
archive 3.8.9
cairo 1.18.4
cgif 0.5.3
exif 0.6.26
expat 2.8.3
ffi 3.8.0
fontconfig 2.18.3
freetype 2.14.3
fribidi 1.0.16
glib 2.89.4
harfbuzz 14.3.1
heif 1.23.2
highway 1.4.0
imagequant 2.4.1

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the production-minor-and-patch group across 1 directory wi…
6c3263e 
…th 7 updates

Bumps the production-minor-and-patch group with 7 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [@google/genai](https://github.com/googleapis/js-genai) | `2.18.0` | `2.21.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.2` | `8.7.0` |
| [mongoose](https://github.com/Automattic/mongoose) | `9.9.3` | `9.9.5` |
| [pdfkit](https://github.com/foliojs/pdfkit) | `0.19.1` | `0.20.2` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |
| [@img/sharp-linux-x64](https://github.com/lovell/sharp/tree/HEAD/npm/linux-x64) | `0.35.3` | `0.35.4` |
| [@img/sharp-libvips-linux-x64](https://github.com/lovell/sharp-libvips/tree/HEAD/npm/linux-x64) | `1.3.2` | `1.3.3` |



Updates `@google/genai` from 2.18.0 to 2.21.0
- [Release notes](https://github.com/googleapis/js-genai/releases)
- [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/js-genai@v2.18.0...v2.21.0)

Updates `express-rate-limit` from 8.6.2 to 8.7.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.6.2...v8.7.0)

Updates `mongoose` from 9.9.3 to 9.9.5
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@9.9.3...9.9.5)

Updates `pdfkit` from 0.19.1 to 0.20.2
- [Release notes](https://github.com/foliojs/pdfkit/releases)
- [Changelog](https://github.com/foliojs/pdfkit/blob/master/CHANGELOG.md)
- [Commits](foliojs/pdfkit@v0.19.1...v0.20.2)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

Updates `@img/sharp-linux-x64` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](https://github.com/lovell/sharp/commits/v0.35.4/npm/linux-x64)

Updates `@img/sharp-libvips-linux-x64` from 1.3.2 to 1.3.3
- [Release notes](https://github.com/lovell/sharp-libvips/releases)
- [Commits](https://github.com/lovell/sharp-libvips/commits/v1.3.3/npm/linux-x64)

---
updated-dependencies:
- dependency-name: "@google/genai"
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: express-rate-limit
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: mongoose
  dependency-version: 9.9.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: pdfkit
  dependency-version: 0.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: "@img/sharp-linux-x64"
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@img/sharp-libvips-linux-x64"
  dependency-version: 1.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tagadearpit