Skip to content

Bump the npm_and_yarn group across 1 directory with 16 updates - #27

Merged
berkant-k merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-72e9abe686
Sep 6, 2026
Merged

Bump the npm_and_yarn group across 1 directory with 16 updates#27
berkant-k merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-72e9abe686

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package From To
@medplum/core 4.5.2 5.1.6
nanoid 3.3.12 3.3.18
nanoid 5.1.11 5.1.16
next 16.2.7 16.3.4
undici 8.5.0 8.9.0
@hono/node-server 1.19.14 1.19.17
js-yaml 3.14.2 3.15.2
brace-expansion 1.1.15 1.1.18
body-parser 2.2.2 2.3.0
browserslist 4.28.2 4.28.9
fast-uri 3.1.2 3.1.7
hono 4.12.28 4.13.7
ip-address 10.2.0 10.7.0
postcss-selector-parser 7.1.1 7.1.6
qs 6.15.2 6.16.0

Updates @medplum/core from 4.5.2 to 5.1.6

Release notes

Sourced from @​medplum/core's releases.

Version 5.1.6

What's Changed

  • docs(communications): external messaging integration patterns (#8762)
  • Update eligibility-checks.md (#8770)
  • fix(provider): Intake form remove examples from value sets (#8790)
  • Dependency upgrades 2026-03-30 (#8821)
  • Disable redirect URL partial match (#8749)

Full Changelog: medplum/medplum@v5.1.5...v5.1.6

Version 5.1.5

What's Changed

  • docs(communications): add Bot Automation for Messaging page (#8714)
  • Updating the default model to be 5.4 in Spaces (#8746)
  • docs(opentelemetry): fix environment variable references for OTLP configuration (#8750)
  • Fixes #8072 - flaky HL7 client tests (#8748)
  • docs(communications): messaging data model replaces organizing threads (#8752)
  • Various server cleanups (#8758)
  • feat(app): Include payload content tab for Communication (#8715)
  • Fixes #8745 - always populate ProjectMembership.invitedBy (#8761)
  • Create new task-based-message-response-tracking-and-routing.mdx (#8637)
  • Populate Appointment.slot references in $book operation (#8765)
  • feat(spaces): move spaces system prompts to Communication resources (#8757)
  • fix(hl7): warn instead of err on unknown msg ctrl id (#8782)
  • docs(communications): thread lifecycle, participants, and access control (#8772)
  • Remove first draft of LLM tenanting decision guide (#8774)
  • Scheduling service type matching fixes (#8768)
  • Re-use repo DB connection for system access (#8767)
  • fix(fhircast): prevent DiagnosticReport-update in other cxts (#8789)
  • Enhance self-hosting documentation with environment configuration details for Medplum app (#8728)
  • build(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 (#8780)
  • Parse mixed alphanumeric tokens with leading digit as string (#8792)
  • docs(blog): March 2026 monthly update (#8791)
  • fix(ci): login to docker for svc containers (#8800)
  • fix(ccda): add null check for reaction manifestation before setting extension (#8801)
  • Remove compartments calculation that is overwritten (#8804)
  • Fix use of modifiers in _filter search (#8783)
  • fix(client/subscription): prevent React lifecycles from tracking unused WebSocket subs (#8723)

Full Changelog: medplum/medplum@v5.1.4...v5.1.5

Version 5.1.4

What's Changed

  • fix(provider): Use external id in Candid when Candid encounter id is missing (#8591)
  • Set DB transaction idle timeout (#8630)
  • Deleting Outdated Chat Example App (#8627)
  • More efficiently set pg pool config options (#8631)

... (truncated)

Commits

Updates nanoid from 3.3.12 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.
Changelog

Sourced from nanoid's changelog.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates nanoid from 5.1.11 to 5.1.16

Release notes

Sourced from nanoid's releases.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.
Changelog

Sourced from nanoid's changelog.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates next from 16.2.7 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

... (truncated)

Commits
  • 299180d v16.3.4
  • 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
  • 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
  • d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
  • 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
  • a9a1cb7 v16.3.3
  • 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
  • 3a15b4a [16.3.x] [next/image]: disable avif image optimization
  • 7378b51 Backport/docs fixes 16.3 (#97649)
  • Additional commits viewable in compare view

Updates undici from 8.5.0 to 8.9.0

Release notes

Sourced from undici's releases.

v8.9.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
  • GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

What's Changed

... (truncated)

Commits
  • 21a8e1e Bumped v8.9.0 (#5589)
  • 7d3cf92 fix: validate blob body content type
  • c601fff fix(cache): harden cache directive parsing
  • 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
  • e11a68e fix(retry): reject partial content length mismatch
  • 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
  • 4fe5bc5 fix: handle empty qualified private cache directive
  • 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
  • a17e301 Ignore auto-generated .npmrc on Windows (#5583)
  • a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
  • Additional commits viewable in compare view

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.


Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.
Commits

Updates brace-expansion from 1.1.15 to 1.1.18

Commits

Updates body-parser from 2.2.2 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: use static exports instead of lazy getters to improve ESM compatibility
  • feat: add subpath exports for individual parsers
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
  • deps:
    • content-type@^2.0.0
    • http-errors@^2.0.1
    • iconv-lite^0.7.2
    • qs@^6.15.2
    • raw-body@^3.0.2
    • type-is@^2.1.0
Commits
  • d0f2ace 2.3.0 (#735)
  • 7d03f2f chore: updated deps to latest (#733)
  • 8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
  • 32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
  • ff0f6b9 docs: update outdated reference to MDN docs (#730)
  • 14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
  • 37f36a2 deps: update content-type and type-is (#728)
  • e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
  • e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
  • a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
  • Additional commits viewable in compare view

Updates browserslist from 4.28.2 to 4.28.9

Release notes

Sourced from browserslist's releases.

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).
Changelog

Sourced from browserslist's changelog.

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates fast-uri from 3.1.2 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • Description has been truncated

@dependabot
Bump the npm_and_yarn group across 1 directory with 16 updates
21e8400 
Bumps the npm_and_yarn group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@medplum/core](https://github.com/medplum/medplum/tree/HEAD/packages/core) | `4.5.2` | `5.1.6` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.12` | `3.3.18` |
| [nanoid](https://github.com/ai/nanoid) | `5.1.11` | `5.1.16` |
| [next](https://github.com/vercel/next.js) | `16.2.7` | `16.3.4` |
| [undici](https://github.com/nodejs/undici) | `8.5.0` | `8.9.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `1.19.17` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.2` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.15` | `1.1.18` |
| [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.2` | `4.28.9` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.7` |
| [hono](https://github.com/honojs/hono) | `4.12.28` | `4.13.7` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.7.0` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.1` | `7.1.6` |
| [qs](https://github.com/ljharb/qs) | `6.15.2` | `6.16.0` |



Updates `@medplum/core` from 4.5.2 to 5.1.6
- [Release notes](https://github.com/medplum/medplum/releases)
- [Commits](https://github.com/medplum/medplum/commits/v5.1.6/packages/core)

Updates `nanoid` from 3.3.12 to 3.3.18
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.12...3.3.18)

Updates `nanoid` from 5.1.11 to 5.1.16
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.12...3.3.18)

Updates `next` from 16.2.7 to 16.3.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.7...v16.3.4)

Updates `undici` from 8.5.0 to 8.9.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.5.0...v8.9.0)

Updates `@hono/node-server` from 1.19.14 to 1.19.17
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.14...v1.19.17)

Updates `js-yaml` from 3.14.2 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.2)

Updates `brace-expansion` from 1.1.15 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.18)

Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

Updates `browserslist` from 4.28.2 to 4.28.9
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.2...4.28.9)

Updates `fast-uri` from 3.1.2 to 3.1.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.7)

Updates `hono` from 4.12.28 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.28...v4.13.7)

Updates `ip-address` from 10.2.0 to 10.7.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.7.0)

Updates `postcss` from 8.4.31 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.31...8.5.23)

Updates `postcss-selector-parser` from 7.1.1 to 7.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.6)

Updates `qs` from 6.15.2 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.2...v6.16.0)

Updates `sharp` from 0.34.5 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.4)

---
updated-dependencies:
- dependency-name: "@medplum/core"
  dependency-version: 5.1.6
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 5.1.16
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 16.3.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 8.9.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.17
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.28.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.7.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 5, 2026
@vercel

vercel Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
pyronis Ready Ready Preview Sep 5, 2026 8:03am UTC

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 5, 2026
@dependabot dependabot Bot mentioned this pull request Sep 5, 2026
Closed
@berkant-k
berkant-k merged commit 28606b7 into main Sep 6, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-72e9abe686 branch September 6, 2026 16:00

This branch was successfully deployed

1 active deployment
Preview — 21e8400c Deployed Sep 5, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@berkant-k