Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Deprecations / Replacements

Warning

These dependencies are either deprecated or have replacements available:

Datasource	Name	Replacement PR?
npm	chai-subset

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• fix(deps): update aws-sdk-js-v3 monorepo to v3.989.0 (@aws-sdk/client-s3, @aws-sdk/lib-storage, @aws-sdk/s3-request-presigner)
• fix(deps): update dependency config to v4.3.0
• fix(deps): update dependency dotenv to v17.3.1
• fix(deps): update dependency kysely to ^0.28.0
• fix(deps): update dependency otplib to v13.3.0
• fix(deps): update dependency pg to v8.18.0
• fix(deps): update dependency pg-connection-string to v2.11.0
• fix(deps): update dependency spdx-license-list to v6.11.0
• fix(deps): update opentelemetry-js monorepo (@opentelemetry/context-async-hooks, @opentelemetry/exporter-trace-otlp-proto, @opentelemetry/instrumentation)
• chore(deps): update dependency eslint to v10
• chore(deps): update postgres docker tag to v18
• fix(deps): update dependency nodemailer to v8
• 🔐 Create all rate-limited PRs at once 🔐

PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

• fix(deps): update dependency cloudflare to v5

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• fix(deps): update dependency @peculiar/asn1-x509 to v2.6.1
• chore(deps): update postgres docker tag to v16.12
• chore(deps): update dependency nock to v14
• fix(deps): update dependency plaid to v41
• fix(deps): update dependency stripe to v20
• fix(deps): update sentry-javascript monorepo to v10 (major) (@sentry/node, @sentry/profiling-node)
• Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• chore(deps): update dependency @opentelemetry/auto-instrumentations-node to ^0.69.0
• fix(deps): update dependency gqlmin to v0.3.1
• chore(deps): update dependency chai-as-promised to v8
• chore(deps): update dependency chokidar to v5
• chore(deps): update dependency fake-tag to v5
• chore(deps): update dependency markdown-table to v3
• chore(deps): update dependency sinon-chai to v4
• fix(deps): update dependency crypto-random-string to v5
• fix(deps): update dependency get-urls to v12
• fix(deps): update dependency graphql-upload to v17 (graphql-upload, @types/graphql-upload)
• fix(deps): update dependency node-fetch to v3
• fix(deps): update dependency p-map to v7
• fix(deps): update opentelemetry-js monorepo to v2 (major) (@opentelemetry/resources, @opentelemetry/sdk-trace-base, @opentelemetry/sdk-trace-node)

Detected Dependencies

github-actions (3)

.github/workflows/ci.yml (43)

• actions/checkout v6
• actions/setup-node v6
• actions/cache v5
• actions/checkout v6
• actions/setup-node v6
• actions/cache v5
• actions/checkout v6
• actions/setup-node v6
• actions/cache v5
• actions/checkout v6
• actions/setup-node v6
• actions/cache v5
• actions/checkout v6
• actions/setup-node v6
• actions/cache v5
• actions/cache v5
• actions/checkout v6
• actions/setup-node v6
• actions/cache v5
• actions/cache v5
• actions/checkout v6
• actions/setup-node v6
• actions/cache v5
• codecov/codecov-action v5
• codecov/test-results-action v1
• actions/checkout v6
• actions/setup-node v6
• actions/cache v5
• codecov/codecov-action v5
• codecov/test-results-action v1
• actions/checkout v6
• actions/setup-node v6
• actions/cache v5
• actions/checkout v6
• kamilkisiela/graphql-inspector v3.4.0
• kamilkisiela/graphql-inspector v3.4.0
• postgres 16.11 → [Updates: 16.12, 18.2]
• ubuntu 24.04
• postgres 16.11 → [Updates: 16.12, 18.2]
• opensearchproject/opensearch 3
• ubuntu 24.04
• postgres 16.11 → [Updates: 16.12, 18.2]
• postgres 16.11 → [Updates: 16.12, 18.2]

.github/workflows/codeql-analysis.yml (3)

• actions/checkout v6
• github/codeql-action v4
• github/codeql-action v4

.github/workflows/e2e.yml (17)

• actions/checkout v6
• actions/setup-node v6
• actions/checkout v6
• actions/checkout v6
• actions/checkout v6
• actions/checkout v6
• actions/cache v5
• actions/cache v5
• actions/cache v5
• actions/cache v5
• actions/cache v5
• actions/cache v5
• actions/cache v5
• actions/cache v5
• actions/upload-artifact v6
• postgres 16.11 → [Updates: 16.12, 18.2]
• ubuntu 24.04

npm (1)

package.json (169)

• @apollo/server 5.4.0
• @as-integrations/express5 1.1.2
• @aws-sdk/client-s3 3.988.0 → [Updates: 3.989.0]
• @aws-sdk/lib-storage 3.988.0 → [Updates: 3.989.0]
• @aws-sdk/s3-request-presigner 3.988.0 → [Updates: 3.989.0]
• @babel/core 7.29.0
• @babel/node 7.29.0
• @babel/plugin-transform-typescript 7.28.6
• @babel/preset-env 7.29.0
• @escape.tech/graphql-armor 3.2.0
• @hyperwatch/hyperwatch 4.2.0
• @json2csv/plainjs ^7.0.6
• @node-oauth/oauth2-server 5.2.1
• @octokit/auth-oauth-app 9.0.3
• @octokit/rest 22.0.1
• @opencollective/taxes 5.3.0
• @opensearch-project/opensearch ^3.4.0
• @opentelemetry/context-async-hooks 2.3.0 → [Updates: 2.5.1]
• @opentelemetry/instrumentation 0.209.0 → [Updates: 0.212.0]
• @opentelemetry/sdk-trace-base 1.30.1 → [Updates: 2.5.1]
• @paypal/payouts-sdk 1.1.1
• @peculiar/asn1-schema 2.6.0
• @peculiar/asn1-x509 2.6.0 → [Updates: 2.6.1]
• @sentry/node 9.47.1 → [Updates: 10.38.0]
• @sentry/profiling-node 9.47.1 → [Updates: 10.38.0]
• @simplewebauthn/server 13.2.2
• lib-address 0.7.0
• argparse 2.0.1
• async-mutex 0.5.0
• axios 1.13.5
• babel-plugin-add-module-exports 1.0.4
• bayes 1.0.0
• bcrypt 6.0.0
• blurhash 2.0.5
• cloudflare 4.5.0 → [Updates: 5.2.0]
• cloudflare-ip 0.0.7
• commander 14.0.3
• config 4.2.1 → [Updates: 4.3.0]
• connect-redis 9.0.0
• cookie-parser 1.4.7
• cors 2.8.6
• crypto-js 4.2.0
• crypto-random-string 3.3.1 → [Updates: 5.0.0]
• csv-parse 6.1.0
• dataloader 2.2.3
• dataloader-sequelize 2.3.3
• debug 4.4.3
• deepmerge 4.3.1
• dotenv 17.2.4 → [Updates: 17.3.1]
• errorhandler 1.5.2
• express 5.2.1
• express-basic-auth 1.2.1
• express-session 1.19.0
• express-ws 5.0.2
• fast-levenshtein 3.0.0
• fast-redact 3.5.0
• fs-extra 11.3.3
• get-urls 10.0.1 → [Updates: 12.1.0]
• gqlmin 0.1.1 → [Updates: 0.3.1]
• graphql 16.12.0
• graphql-scalars 1.25.0
• graphql-upload 15.0.2 → [Updates: 17.0.0]
• handlebars 4.7.8
• hashids 2.3.0
• hcaptcha 0.2.0
• helmet 8.1.0
• html-to-text 9.0.5
• ics 3.8.1
• jsonwebtoken 9.0.3
• juice 11.1.1
• kysely ^0.27.4 → [Updates: ^0.28.0]
• kysely-sequelize ^0.2.0
• limax 4.2.2
• lodash 4.17.23
• lru-cache 11.2.6
• moment 2.30.1
• moment-timezone 0.6.0
• multer 2.0.2
• node-fetch 2.7.0 → [Updates: 3.3.2]
• nodemailer 7.0.13 → [Updates: 8.0.1]
• nordigen-node 1.4.1
• otplib 13.2.1 → [Updates: 13.3.0]
• p-map 4.0.0 → [Updates: 7.0.4]
• p-queue 9.1.0
• passport 0.7.0
• passport-github 1.1.0
• paypal-adaptive 0.4.2
• pg 8.16.3 → [Updates: 8.18.0]
• pg-connection-string 2.9.1 → [Updates: 2.11.0]
• pg-format 1.0.4
• pg-listen 1.7.0
• plaid 31.1.0 → [Updates: 41.1.0]
• redis 5.10.0
• sanitize-html 2.17.0
• sequelize 6.37.7
• sequelize-cli 6.6.5
• sequelize-temporal 2.1.1
• sharp 0.34.5
• spdx-license-list 6.10.0 → [Updates: 6.11.0]
• stripe 17.7.0 → [Updates: 20.3.1]
• throng 5.0.0
• tweetnacl 1.0.3
• tweetnacl-util 0.15.1
• uuid 13.0.0
• validator 13.15.26
• winston 3.19.0
• zod 4.3.6
• @babel/cli ^7.23.4
• @babel/register ^7.23.7
• @graphql-eslint/eslint-plugin ^4.0.0
• @opentelemetry/api ^1.7.0
• @opentelemetry/auto-instrumentations-node ^0.67.0 → [Updates: ^0.69.0]
• @opentelemetry/exporter-trace-otlp-proto ^0.209.0 → [Updates: ^0.212.0]
• @opentelemetry/resources ^1.20.0 → [Updates: ^2.0.0]
• @opentelemetry/sdk-trace-node ^1.20.0 → [Updates: ^2.0.0]
• @types/express ^5.0.6
• @types/graphql-upload 16.0.7 → [Updates: 17.0.0]
• @types/jsonwebtoken ^9.0.10
• @types/lodash ^4.14.202
• @types/mocha ^10.0.10
• @types/node ^24.0.0
• @types/node-fetch ^2.6.13
• @types/nodemailer ^7.0.4
• @types/validator ^13.11.8
• @typescript-eslint/parser ^8.13.0
• babel-plugin-istanbul ^7.0.1
• chai ^6.0.0
• chai-as-promised ^7.1.1 → [Updates: ^8.0.0]
• chai-jest-snapshot ^2.0.0
• chai-sorted ^0.2.0
• chai-subset ^1.6.0
• cheerio ^1.1.2
• chokidar ^4.0.1 → [Updates: ^5.0.0]
• commitizen ^4.3.1
• cz-conventional-changelog ^3.3.0
• eslint ^9.14.0 → [Updates: ^10.0.0]
• eslint-config-opencollective ^6.0.0
• eslint-import-resolver-typescript ^4.0.0
• eslint-plugin-import ^2.31.0
• eslint-plugin-mocha 11.2.0
• eslint-plugin-n ^17.11.1
• eslint-plugin-react ^7.37.5
• eslint-plugin-simple-import-sort ^12.1.1
• exif-reader ^2.0.3
• fake-tag ^3.0.0 → [Updates: ^5.0.0]
• geoip-lite ^1.4.10
• globals ^17.0.0
• husky ^9.0.10
• lint-staged ^16.0.0
• markdown-table ^2.0.0 → [Updates: ^3.0.0]
• mocha ^11.7.5
• mocha-junit-reporter ^2.2.1
• nock ^13.5.0 → [Updates: ^14.0.0]
• node-mocks-http ^1.16.1
• nodemon ^3.0.2
• npm-run-all2 ^8.0.4
• nyc ^17.0.0
• opentelemetry-instrumentation-sequelize ^0.41.0
• prettier 3.8.1
• sinon ^21.0.0
• sinon-chai ^3.7.0 → [Updates: ^4.0.0]
• supertest ^7.0.0
• ts-unused-exports ^11.0.1
• typescript 5.9.3
• typescript-eslint ^8.13.0
• ws ^8.18.3
• node 24.x
• npm 11.x
• url-regex-safe 4.0.0

nvm (1)

.nvmrc (1)

• node 24

renovate-config-presets (1)

renovate.json

---

• Check this box to trigger a request for Renovate to run again on this repository