Bump the all-npm-dependencies group across 1 directory with 6 updates by dependabot[bot] · Pull Request #24 · hexlet-components/devops-example-app

dependabot · 2026-08-01T07:55:19Z

Bumps the all-npm-dependencies group with 6 updates in the / directory:

Package	From	To
@fastify/static	`9.1.3`	`10.1.2`
@fastify/view	`11.1.1`	`12.0.0`
fastify	`5.8.5`	`5.10.0`
@sentry/node	`10.55.0`	`10.68.0`
@biomejs/biome	`2.4.16`	`2.5.6`
npm-check-updates	`22.2.1`	`23.0.0`

Updates @fastify/static from 9.1.3 to 10.1.2

Release notes

Sourced from @fastify/static's releases.

v10.1.2

⚠️ Security Release

Fix for GHSA-8pvw-jcv7-9cmj

What's Changed

ci: pin actions to commit-hash by @Fdawgs in fastify/fastify-static#601

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

v10.1.1

⚠️ Security Release

Fix for GHSA-83w8-p2f5-377r

What's Changed

docs(readme): fix typos by @Fdawgs in fastify/fastify-static#600

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

v10.1.0

What's Changed

fix: set Vary: Accept-Encoding for preCompressed responses by @LeSingh1 in fastify/fastify-static#586

feat: use @fastify/error for errors and add option suppressWarning by @climba03003 in fastify/fastify-static#599

New Contributors

@LeSingh1 made their first contribution in fastify/fastify-static#586

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

v10.0.0

Breaking Changes

setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers. For example,
// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')
fastify.register(require('@fastify/static'), {
root: path.join(__dirname, 'public'),
prefix: '/public/', // optional: default '/',
setHeaders(res) {
res.setHeader('X-Test', 'Foo')
}
})
</tr></table>

... (truncated)

Commits

7a9d1c6 Bumped v10.1.2
878c72e Merge commit from fork
aee1c2c ci: pin actions to commit-hash (#601)
3733059 Bumped 10.1.1
db4276f Merge commit from fork
c68224e docs(readme): fix typos (#600)
36c939d Bumped v10.1.0
7c1121a feat: use @fastify/error for errors and add option suppressWarning (#599)
c57d8bc fix: set Vary: Accept-Encoding for preCompressed responses (#586)
babf6df Bumped v10.0.0
Additional commits viewable in compare view

Updates @fastify/view from 11.1.1 to 12.0.0

Release notes

Sourced from @fastify/view's releases.

v12.0.0

What's Changed

chore: remove borp by @ilteoood in fastify/point-of-view#483

chore(.npmrc): ignore scripts by @Fdawgs in fastify/point-of-view#484

build(deps-dev): remove @fastify/pre-commit by @Fdawgs in fastify/point-of-view#485

build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in fastify/point-of-view#487

ci(ci): add concurrency config by @Fdawgs in fastify/point-of-view#488

build(deps-dev): bump pino from 9.14.0 to 10.1.0 by @dependabot[bot] in fastify/point-of-view#489

build(deps-dev): bump eta from 3.5.0 to 4.4.1 by @dependabot[bot] in fastify/point-of-view#490

build(deps-dev): bump @types/node from 24.10.4 to 25.0.3 by @dependabot[bot] in fastify/point-of-view#491

feat: support squirrelly by @ilteoood in fastify/point-of-view#492

chore: removed .taprc file by @Tony133 in fastify/point-of-view#496

chore(license): revise copyright notice for github integration by @Fdawgs in fastify/point-of-view#497

ci: remove stale.yml by @Tony133 in fastify/point-of-view#498

fix: add missingedge type definition by @bnb in fastify/point-of-view#493

build(deps-dev): bump c8 from 10.1.3 to 11.0.0 by @dependabot[bot] in fastify/point-of-view#499

build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @dependabot[bot] in fastify/point-of-view#501

build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in fastify/point-of-view#504

build(deps-dev): bump twig from 1.17.1 to 3.0.0 by @dependabot[bot] in fastify/point-of-view#505

ci: add lock-threads workflow by @Fdawgs in fastify/point-of-view#506

chore(.gitattributes): retain binary file eol style by @Fdawgs in fastify/point-of-view#507

refactor(types): migrate from tsd to tstyche by @Tony133 in fastify/point-of-view#508

chore: removed types deprecated by @Tony133 in fastify/point-of-view#511

New Contributors

@Tony133 made their first contribution in fastify/point-of-view#496

@bnb made their first contribution in fastify/point-of-view#493

Full Changelog: fastify/point-of-view@v11.1.1...v12.0.0

Commits

477e526 12.0.0
753799e chore: removed types deprecated
57f933f refactor(types): migrate from tsd to tstyche (#508)
b6dca88 chore(.gitattributes): ensure non-text files remain untouched (#507)
aae520f ci: add lock-threads workflow (#506)
4267c07 build(deps-dev): bump twig from 1.17.1 to 3.0.0 (#505)
5d8d3da build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#504)
f56bc59 build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#501)
a98ef08 build(deps-dev): bump c8 from 10.1.3 to 11.0.0 (#499)
4a8ae31 fix: add middingedge type definition (#493)
Additional commits viewable in compare view

Updates fastify from 5.8.5 to 5.10.0

Release notes

Sourced from fastify's releases.

v5.10.0

What's Changed

docs(type-providers): clarify as const usage by @smith558 in fastify/fastify#6772

docs: fix broken and redirected links by @Eomm in fastify/fastify#6817

docs: remove marko from @fastify/view engines (support dropped) by @EduardF1 in fastify/fastify#6821

fix: clear socket._meta on reply.hijack() when onTimeout is registered by @nerkoux in fastify/fastify#6810

docs: fix duplicate routeOptions entries in Request.md example by @thePranav-kpk in fastify/fastify#6824

chore: Bump @types/node from 25.9.4 to 26.0.1 in the dev-dependencies-typescript group by @dependabot[bot] in fastify/fastify#6829

docs(ecosystem): add @stitchapi/fastify to Community plugins by @rejifald in fastify/fastify#6820

feat: introduce log controller layer by @Eomm in fastify/fastify#6580

fix: use ContentType to detect json and charset in reply.send by @climba03003 in fastify/fastify#6830

docs: fix incorrect defaults and code examples in Server.md by @Adit-Jain-srm in fastify/fastify#6805

docs: fix incorrect hook count in Hooks.md by @thePranav-kpk in fastify/fastify#6825

chore: Bump fast-json-stringify from 6.4.0 to 7.0.0 in the dependencies group across 1 directory by @dependabot[bot] in fastify/fastify#6800

perf: reduce per-request overhead in the request lifecycle by @mcollina in fastify/fastify#6831

fix: derive request.port from request.host by @mcollina in fastify/fastify#6680

docs: update Logging.md with per-route log level info by @asppsa in fastify/fastify#6627

docs(type-providers): update import for article consistency by @smith558 in fastify/fastify#6771

New Contributors

@EduardF1 made their first contribution in fastify/fastify#6821

@thePranav-kpk made their first contribution in fastify/fastify#6824

@rejifald made their first contribution in fastify/fastify#6820

@Adit-Jain-srm made their first contribution in fastify/fastify#6805

@asppsa made their first contribution in fastify/fastify#6627

Full Changelog: fastify/fastify@v5.9.0...v5.10.0

v5.9.0

What's Changed

feat: add request.mediaType by @climba03003 in fastify/fastify#6653

docs: remove deprecated leveldb plugin and update ecosystem by @Tony133 in fastify/fastify#6661

chore(sponsor): add bestforandroid by @Eomm in fastify/fastify#6659

ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @Tony133 in fastify/fastify#6662

fix: prevent duplicate res.end in sendTrailer with sync callbacks by @climba03003 in fastify/fastify#6676

fix: avoid duplicate closeIdleConnections call on native servers by @trivikr in fastify/fastify#6669

fix: error.code not present on some routing errors by @mcollina in fastify/fastify#6678

fix: correct isCustomSerializerCompiler flag check by @eddieran in fastify/fastify#6657

fix: validate invalid route logLevel at registration by @maxpetrusenko in fastify/fastify#6523

docs: update contribution rules by @Tony133 in fastify/fastify#6670

fix: use ContentType parser for response schema lookup by @UlisesGascon in fastify/fastify#6685

ci(ci): use shared quality workflow by @Fdawgs in fastify/fastify#6688

fix(types): allow request.getValidationFunction() to return undefined by @trivikr in fastify/fastify#6665

fix: do not trust forwarded host/proto when socket is missing by @mcollina in fastify/fastify#6684

perf: defer ContentType parsing in getSchemaSerializer until needed by @aquie00t in fastify/fastify#6692

perf: cache parsed ContentType objects in ContentTypeParser by @aquie00t in fastify/fastify#6694

perf: add typeof guard before toString.call in send and onSendEnd by @aquie00t in fastify/fastify#6693

chore: Bump pnpm/action-setup from 5.0.0 to 6.0.4 by @dependabot[bot] in fastify/fastify#6704

chore: Bump actions/github-script from 8 to 9 by @dependabot[bot] in fastify/fastify#6705

chore: Bump JustinBeckwith/linkinator-action from 2.4.0 to 2.4.2 by @dependabot[bot] in fastify/fastify#6706

... (truncated)

Commits

94bcbcc Bumped v5.10.0
c47975e docs: Update import for page consistency (#6771)
82952b8 docs: Logging.md with per-route log level info (#6627)
6ac2e95 fix: derive request.port from request.host (#6680)
5f4871f perf: reduce per-request overhead in the request lifecycle (#6831)
ec4bc66 chore: Bump fast-json-stringify to v7 (#6800)
d0b649d docs: fix incorrect hook count in Hooks.md (eight -> ten) (#6825)
826c807 docs: fix incorrect defaults and code examples in Server.md (#6805)
6f63ce9 fix: use ContentType to detect json and charset in reply.send (#6830)
75d74e1 feat: introduce log controller layer (#6580)
Additional commits viewable in compare view

Updates @sentry/node from 10.55.0 to 10.68.0

Release notes

Sourced from @sentry/node's releases.

10.68.0

feat(cloudflare): Add @sentry/cloudflare/vite orchestrion plugin (#21967)

feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)

feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)

feat(server-utils): Allow integrations to be part of marker (#22094)

feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)

feat(server-utils): Warn when bundler config has instrumented module in external (#22379)

feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)

feat(v10): Add url.full and url.path to http.server spans (#22533)

feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)

feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)

feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)

feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)

feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)

feat(v10/core): Add instrumentStateGraph API (#22491)

feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)

feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)

feat(v10/react-router): Make instrumentation API the default (#22525)

fix(cloudflare,deno,node): Align types of vercelai (#22343)

fix(core): Instrument Anthropic client in place instead of via a deep proxy (#22305)

fix(replay): Set text/javascript MIME type on compression worker Blob (#22377)

fix(sveltekit): Adapt frame rewriting for kit 3 (#22407)

fix(v10): Pin @apm-js-collab/code-transformer-bundler-plugins to 0.7.1 (#22497)

fix(v10/cloudflare): Import prismaIntegration from server-utils (#22535)

fix(v10/core): Avoid functionToStringIntegration causing infinite recursions (#22527)

fix(v10/core): Avoid propagating baggage: "undefined" when DSC is missing (#22440)

chore: Add external contributor to CHANGELOG.md (#22342)

chore: Add external contributor to CHANGELOG.md (#22405)

chore(deps): Bump axios from 1.16.0 to 1.18.0 in /dev-packages/e2e-tests/test-applications/nestjs-basic (#22395)

chore(deps): Bump morgan from 1.10.0 to 1.11.0 (#22187)

chore(size-limit): weekly auto-bump (#22182)

ci(v10): Add v10 to build and license-compliance branch filters (#22499)

feat(deps): Bump axios from 1.16.0 to 1.18.0 (#22396)

ref(server-utils): Remove unneeded orchestrion config (#22384)

ref(server-utils): Small fastify cleanup (#22385)

test: Remove unnecessary test waits (#22383)

test(sveltekit-3): Fix import defineEnvVars from @sveltejs/kit/env (#22390)

test(v10/cloudflare): Add Vite-build support to the integration-test runner (#22539)

Work in this release was contributed by @psh4607 and @trinitiwowka. Thank you for your contributions!

Bundle size 📦

| Path | Size |

... (truncated)

Changelog

Sourced from @sentry/node's changelog.

10.68.0

feat(cloudflare): Add @sentry/cloudflare/vite orchestrion plugin (#21967)

feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)

feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)

feat(server-utils): Allow integrations to be part of marker (#22094)

feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)

feat(server-utils): Warn when bundler config has instrumented module in external (#22379)

feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)

feat(v10): Add url.full and url.path to http.server spans (#22533)

feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)

feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)

feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)

feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)

feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)

feat(v10/core): Add instrumentStateGraph API (#22491)

feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)

feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)

feat(v10/react-router): Make instrumentation API the default (#22525)

fix(cloudflare,deno,node): Align types of vercelai (#22343)

fix(core): Instrument Anthropic client in place instead of via a deep proxy (#22305)

fix(replay): Set text/javascript MIME type on compression worker Blob (#22377)

fix(sveltekit): Adapt frame rewriting for kit 3 (#22407)

fix(v10): Pin @apm-js-collab/code-transformer-bundler-plugins to 0.7.1 (#22497)

fix(v10/cloudflare): Import prismaIntegration from server-utils (#22535)

fix(v10/core): Avoid functionToStringIntegration causing infinite recursions (#22527)

fix(v10/core): Avoid propagating baggage: "undefined" when DSC is missing (#22440)

chore: Add external contributor to CHANGELOG.md (#22342)

chore: Add external contributor to CHANGELOG.md (#22405)

chore(deps): Bump axios from 1.16.0 to 1.18.0 in /dev-packages/e2e-tests/test-applications/nestjs-basic (#22395)

chore(deps): Bump morgan from 1.10.0 to 1.11.0 (#22187)

chore(size-limit): weekly auto-bump (#22182)

ci(v10): Add v10 to build and license-compliance branch filters (#22499)

feat(deps): Bump axios from 1.16.0 to 1.18.0 (#22396)

ref(server-utils): Remove unneeded orchestrion config (#22384)

ref(server-utils): Small fastify cleanup (#22385)

test: Remove unnecessary test waits (#22383)

test(sveltekit-3): Fix import defineEnvVars from @sveltejs/kit/env (#22390)

test(v10/cloudflare): Add Vite-build support to the integration-test runner (#22539)

Work in this release was contributed by @psh4607 and @trinitiwowka. Thank you for your contributions!

10.67.0

... (truncated)

Commits

b4396c3 release: 10.68.0
be21e8c meta(changelog): Update changelog for 10.68.0 (#22566)
fb0987f feat(v10): Add http.route attribute to http.server spans with parameteriz...
f7bd901 feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)
ed3a8c8 feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)
20227f9 feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)
3e5625e feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)
d924551 test(v10/cloudflare): Add Vite-build support to the integration-test runner (...
11fed03 feat(v10/cloudflare): Read wrangler config and resolve the Sentry options mod...
a540764 feat(v10): Add url.full and url.path to http.server spans (#22533)
Additional commits viewable in compare view

Updates @biomejs/biome from 2.4.16 to 2.5.6

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.6

2.5.6

Patch Changes
#11035 0e4b03b Thanks @ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.
#11043 22ec076 Thanks @denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:
 .example {
   value: outer(
     1,
     /* comment */
     nested(
-      first,
-      second
-    )
+        first,
+        second
+      )
   );
 }
#11007 c9acb25 Thanks @BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

#10152 50a9bd8 Thanks @Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

#11105 8ffe2b9 Thanks @dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

#10533 5809875 Thanks @Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

#11040 0abb620 Thanks @Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

#10858 6d18204 Thanks @ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.
#11009 2c36626 Thanks @ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

The following statements are now reported:
type AsyncCallback = () => Promise<void>;
declare const callback: AsyncCallback;
callback();
[1, 2, 3].map(async (value) => value);

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.6

Patch Changes
#11035 0e4b03b Thanks @ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.
#11043 22ec076 Thanks @denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:
 .example {
   value: outer(
     1,
     /* comment */
     nested(
-      first,
-      second
-    )
+        first,
+        second
+      )
   );
 }
#11007 c9acb25 Thanks @BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

#10152 50a9bd8 Thanks @Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

#11105 8ffe2b9 Thanks @dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

#10533 5809875 Thanks @Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

#11040 0abb620 Thanks @Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

#10858 6d18204 Thanks @ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.
#11009 2c36626 Thanks @ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

The following statements are now reported:
type AsyncCallback = () => Promise<void>;
declare const callback: AsyncCallback;
callback();
[1, 2, 3].map(async (value) => value);
#10973 9cb044c Thanks @ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

... (truncated)

Commits

1139f1c ci: release (#11022)
781d68d feat(lint/js): add noRestrictedProperties (#9806)
412a0e9 ci: release (#10948)
b3b12b3 feat(lint): add noNegationInEqualityCheck rule (#10915)
9a66bc7 chore: add latitude to sponsors (#10947)
bfc3f3d ci: release (#10887)
9e1999f chore: revert the revert
0b0fd8d chore: revert
0afa35a ci: release (#10817)
3447b2f feat(useDomQuerySelector): add ignore option (#10835)
Additional commits viewable in compare view

Updates npm-check-updates from 22.2.1 to 23.0.0

Release notes

Sourced from npm-check-updates's releases.

v23.0.0

⚠️ Breaking changes & migration

1. Node.js 22+ required (#1844) The minimum supported Node.js is now 22. Supported versions: ^22.22.2 || ^24.15.0 || >=26.0.0 (and npm >=10).

Migration: Upgrade Node before installing. On older Node, stay on v22.x.

2. Pure ESM package — CJS build dropped, default export is now callable (#1916, #1894) The package is now pure ESM (no more CommonJS build), and the default export is now callable directly. ncu.run() and ncu.defineConfig() still work as namespaced properties.
Migration (ESM):
// before
import * as ncu from 'npm-check-updates'
const upgraded = await ncu.run({ /* ... */ })
// after
import ncu from 'npm-check-updates'
const upgraded = await ncu({ /* ... */ }) // ncu.run({...}) also still works
Migration (CommonJS): Still usable via Node's native require() of ESM (Node 22+), but the import shape changed:
// before
const ncu = require('npm-check-updates')
// after
const { default: ncu } = require('npm-check-updates')
ncu({ /* ... */ }).then(upgraded => console.log(upgraded))
3. filterVersion / rejectVersion no longer accept a predicate function. Use filter / reject instead. (#1933) These options now accept only a string, wildcard, glob, comma/space-delimited list, or /regex/. (CLI usage is unchanged — the CLI never supported functions.)
Migration: If you passed a function to filterVersion/rejectVersion in .ncurc.js or via the module API, move it to filter / reject instead. Those receive the package name and the parsed current version, so they can match on both:
// before
filterVersion: (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
// after
filter:        (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
4. Output is now grouped by default (#1937) --format now defaults to ["group"], so upgrades are grouped by major / minor / patch out of the box. This is a better default for most users.
Migration: To get the old flat output, use:
ncu --format no-group
The new no- prefix removes a value from the default list instead of replacing the whole list, so --format no-group,time disables grouping while adding publish times.
5. --target semver now respects explicit upper bounds (#1920) An explicit upper bound in a range is now preserved and never exceeded, e.g. ^9.5.0 <10 → ^9.7.0 <10 (previously the bound could be overrun). This can change which versions are selected for ranges with explicit upper bounds.

✨ Other improvements

Native TypeScript loading (#1888), lazy-loaded npm-registry-fetch for faster startup (#1898), and reduced dependencies for a lighter install.

... (truncated)

Commits

2417fe3 23.0.0
61b8818 Update deps (#1948)
548c6e3 Merge pull request #1943 from raineorshine/xmr/test-doctor
d31677a test/doctor: run fixtures from a temp copy instead of mutating tracked files
31c7e85 Fix and clean up skipped tests (#1941)
c7c968f Merge pull request #1935 from raineorshine/xmr/fix-regex
e42e613 Update dependencies (#1940)
5c7b422 Add regression test for single-character override keys that are not '.'
8d0d4be Move override tests into upgradePackageData.test.ts
21b8f53 Use jsonc-parser for packageManager and JSON catalog upgrades
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conf...

Description has been truncated

Bumps the all-npm-dependencies group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@fastify/static](https://github.com/fastify/fastify-static) | `9.1.3` | `10.1.2` | | [@fastify/view](https://github.com/fastify/point-of-view) | `11.1.1` | `12.0.0` | | [fastify](https://github.com/fastify/fastify) | `5.8.5` | `5.10.0` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.55.0` | `10.68.0` | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.16` | `2.5.6` | | [npm-check-updates](https://github.com/raineorshine/npm-check-updates) | `22.2.1` | `23.0.0` | Updates `@fastify/static` from 9.1.3 to 10.1.2 - [Release notes](https://github.com/fastify/fastify-static/releases) - [Commits](fastify/fastify-static@v9.1.3...v10.1.2) Updates `@fastify/view` from 11.1.1 to 12.0.0 - [Release notes](https://github.com/fastify/point-of-view/releases) - [Commits](fastify/point-of-view@v11.1.1...v12.0.0) Updates `fastify` from 5.8.5 to 5.10.0 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.8.5...v5.10.0) Updates `@sentry/node` from 10.55.0 to 10.68.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.68.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.55.0...10.68.0) Updates `@biomejs/biome` from 2.4.16 to 2.5.6 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.6/packages/@biomejs/biome) Updates `npm-check-updates` from 22.2.1 to 23.0.0 - [Release notes](https://github.com/raineorshine/npm-check-updates/releases) - [Changelog](https://github.com/raineorshine/npm-check-updates/blob/main/CHANGELOG.md) - [Commits](raineorshine/npm-check-updates@v22.2.1...v23.0.0) --- updated-dependencies: - dependency-name: "@fastify/static" dependency-version: 10.1.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-npm-dependencies - dependency-name: "@fastify/view" dependency-version: 12.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-npm-dependencies - dependency-name: fastify dependency-version: 5.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-dependencies - dependency-name: "@sentry/node" dependency-version: 10.68.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-npm-dependencies - dependency-name: "@biomejs/biome" dependency-version: 2.5.6 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-npm-dependencies - dependency-name: npm-check-updates dependency-version: 23.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 1, 2026

fey merged commit d3c8d6b into main Aug 3, 2026
1 of 2 checks passed

fey deleted the dependabot/npm_and_yarn/all-npm-dependencies-2f3728727f branch August 3, 2026 12:07

Navigation Menu

Uh oh!

Bump the all-npm-dependencies group across 1 directory with 6 updates - #24

Bump the all-npm-dependencies group across 1 directory with 6 updates#24
fey merged 1 commit into
mainfrom
dependabot/npm_and_yarn/all-npm-dependencies-2f3728727f

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

v10.1.2

⚠️ Security Release

What's Changed

v10.1.1

⚠️ Security Release

What's Changed

v10.1.0

What's Changed

New Contributors

v10.0.0

Breaking Changes

v12.0.0

What's Changed

New Contributors

v5.10.0

What's Changed

New Contributors

v5.9.0

What's Changed

10.68.0

Bundle size 📦

10.68.0

10.67.0

Biome CLI v2.5.6

2.5.6

Patch Changes

2.5.6

Patch Changes

v23.0.0

⚠️ Breaking changes & migration

✨ Other improvements

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant