Bump the npm_and_yarn group across 9 directories with 25 updates

[dependabot]

Bumps the npm_and_yarn group with 20 updates in the /compiler/internal/vm/foundation/test directory:

Package	From	To
@astrojs/node	9.1.3	9.5.4
@nestjs/common	11.0.3	11.0.16
@remix-run/node	2.16.8	2.17.2
@remix-run/react	2.10.3	2.17.3
astro	5.5.5	5.15.9
aws-cdk-lib	2.148.0	2.189.1
axios	1.6.8	1.13.5
devalue	5.1.1	5.6.3
esbuild	0.18.6	0.25.0
express	4.18.2	4.22.0
fastify	5.2.2	5.7.3
hono	4.7.2	4.11.10
jws	4.0.0	4.0.1
lodash	4.17.21	4.17.23
mysql2	3.7.0	3.9.8
nodemailer	6.9.3	7.0.11
rollup	4.4.1	4.59.0
typeorm	0.3.20	0.3.26
undici	5.20.0	6.23.0
webpack	5.88.0	5.104.1

Bumps the npm_and_yarn group with 2 updates in the /compiler/internal/vm/foundation/test/cli/install/migration/contoso-test directory: fastify and minimatch.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/dynamic_bitset/doc directory: axios, js-yaml, minimatch and fast-xml-parser.
Bumps the npm_and_yarn group with 3 updates in the /compiler/internal/vm/libconsepts/msm/doc directory: axios, js-yaml and fast-xml-parser.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/openmethod/doc directory: axios, js-yaml, minimatch and fast-xml-parser.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/redis/doc directory: axios, js-yaml, minimatch and sha.js.
Bumps the npm_and_yarn group with 2 updates in the /compiler/internal/vm/libconsepts/unordered/doc directory: js-yaml and minimatch.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/url/doc directory: axios, js-yaml, minimatch and fast-xml-parser.
Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/static_core/plugins/ets/tools/declgen_ts2sts directory: webpack.

Updates @astrojs/node from 9.1.3 to 9.5.4

Release notes

Sourced from @​astrojs/node's releases.

@​astrojs/node@​9.5.4

Patch Changes

• #15564 522f880 Thanks @​matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

• #15572 ef851bf Thanks @​matthewp! - Upgrade astro package support

  astro@5.17.3 includes a fix to prevent Action payloads from exhausting memory. @​astrojs/node now depends on this version of Astro as a minimum requirement.

@​astrojs/node@​9.5.3

Patch Changes

• c13b536 Thanks @​matthewp! - Improves error page loading to read from disk first before falling back to configured host

Changelog

Sourced from @​astrojs/node's changelog.

9.5.4

Patch Changes

• #15564 522f880 Thanks @​matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

• #15572 ef851bf Thanks @​matthewp! - Upgrade astro package support

  astro@5.17.3 includes a fix to prevent Action payloads from exhausting memory. @​astrojs/node now depends on this version of Astro as a minimum requirement.

9.5.3

Patch Changes

• c13b536 Thanks @​matthewp! - Improves error page loading to read from disk first before falling back to configured host

9.5.2

Patch Changes

• #15196 a8317c1 Thanks @​ematipico! - Fixes an issue where some prendered pages weren't correctly rendered when using the Node.js adapter in middleware mode.

• #15169 b803d8b Thanks @​rururux! - fix: fix image 500 error when moving dist directory in standalone Node

9.5.1

Patch Changes

• Updated dependencies [9e9c528, 0f75f6b]:
  • @​astrojs/internal-helpers@​0.7.5

9.5.0

Minor Changes

• #14441 62ec8ea Thanks @​upsuper! - Updates redirect handling to be consistent across static and server output, aligning with the behavior of other adapters.

  Previously, the Node.js adapter used default HTML files with meta refresh tags when in static output. This often resulted in an extra flash of the page on redirect, while also not applying the proper status code for redirections. It's also likely less friendly to search engines.

  This update ensures that configured redirects are always handled as HTTP redirects regardless of output mode, and the default HTML files for the redirects are no longer generated in static output. It makes the Node.js adapter more consistent with the other official adapters.

  No change to your project is required to take advantage of this new adapter functionality. It is not expected to cause any breaking changes. However, if you relied on the previous redirecting behavior, you may need to handle your redirects differently now. Otherwise you should notice smoother redirects, with more accurate HTTP status codes, and may potentially see some SEO gains.

9.4.6

Patch Changes

• #14514 66a26d7 Thanks @​matthewp! - Fixes compatibility issue with older versions of Astro by making getAllowedDomains() call optional and updating peer dependency to require astro@^5.14.3

9.4.5

... (truncated)

Commits

• e0f1a2b [ci] release (#15571)
• ef851bf Update minimum astro version support in @​astrojs/node (#15572)
• f2955fb [ci] release (#15474)
• c13b536 Validate Host header against allowedDomains
• c19b70e fix(deps): update astro adapters (#15243)
• 7fe9e1b fix: update devalue to the latest (#15222)
• 44f4e78 [ci] release (#15188)
• 2fa19c4 fix(core): add defensive validation for mod.page in App.render (#15148)
• 8d74e9e [ci] format
• a8317c1 fix(node): hash URL stripping (#15196)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​astrojs/node since your current version.

Updates @nestjs/common from 11.0.3 to 11.0.16

Release notes

Sourced from @​nestjs/common's releases.

v11.0.16 (2025-04-11)

• fix(common): use file-type to validate file mimetypes by @​Chathula in nestjs/nest#14881

v11.0.15 (2025-04-10)

Bug fixes

• platform-fastify
  • #14935 fix(fastify): methods comparison (@​johaven)

Committers: 1

• Johan Legrand (@​johaven)

v11.0.14 (2025-04-09)

Bug fixes

• platform-fastify
  • #14511 fix(fastify): adds the non-standard http methods to the instance (@​johaven)

Committers: 1

• Johan Legrand (@​johaven)

v11.0.13 (2025-04-03)

Bug fixes

• platform-fastify
  • #14895 fix(fastify-adapter): global prefix exclusion path handling w/middleware (@​KyleLilly)
• microservices
  • #14869 fix(microservices): do not re-create client connection once get client by service name (@​mingo023)

Dependencies

• platform-express
  • #14883 fix(deps): update dependency express to v5.1.0 (@​renovate[bot])
  • #14817 fix(deps): update dependency multer to v1.4.5-lts.2 (@​renovate[bot])
• platform-fastify
  • #14861 fix(deps): update dependency fastify to v5.2.2 (@​renovate[bot])
  • #14864 chore(deps): bump @​fastify/cors from 11.0.0 to 11.0.1 (@​dependabot[bot])

Committers: 2

• Kyle Lilly (@​KyleLilly)
• Minh Ngo (@​mingo023)

v11.0.12 (2025-03-19)

Bug fixes

• core
  • #14803 fix(core): infinite loop on broken circular reference (@​kamilmysliwiec)
  • nestjs/nest#14792 dependencies not resolving for request-scoped lazy providers (@​anizozina)

Enhancements

... (truncated)

Commits

• b6edf9a chore(@​nestjs) publish v11.0.16 release
• ab79c56 chore: minor tweaks
• dcc177a Update packages/common/pipes/file/file-type.validator.ts
• e019da8 refactor(common): move back file type validator options type
• 4718a64 chore(@​nestjs) publish v11.0.15 release
• b6078fd refactor(common): move file-type package to peer dependencies
• f34ef9a refactor(common): refactor code to use simple eval
• 3ff9024 fix(common): used eval import
• 63d28bf refactor(common): removed async keyword
• 5243fca fix(common): update file mime package and add param skip magic numbers
• Additional commits viewable in compare view

Updates @remix-run/node from 2.16.8 to 2.17.2

Release notes

Sourced from @​remix-run/node's releases.

file-storage-s3 v0.1.0

Minor Changes

• Unreleased

  Initial release of @remix-run/file-storage-s3.

Patch Changes

• Bumped @remix-run/* dependencies:
  • file-storage@0.13.3

Commits

• 3920349 Version 2.17.2
• 64d88de Validate session id in file session storage (#10806)
• 91ef6fe Version 2.17.1
• 3000859 chore: Update version for release (#10698)
• 3004a98 chore: Update version for release (pre) (#10692)
• fc5cb1f chore: Update version for release (pre) (#10691)
• See full diff in compare view

Updates @remix-run/react from 2.10.3 to 2.17.3

Release notes

Sourced from @​remix-run/react's releases.

remix v2.17.3

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2173

Commits

• b1d29d9 Version 2.17.3
• 5c87c08 Escape HTML in scroll restoration keys (#10925)
• 4a5ffd1 Revert "Version 2.17.3"
• 98c89fa Version 2.17.3
• 3920349 Version 2.17.2
• 91ef6fe Version 2.17.1
• 6bfad4e Escape meta json ld content (#10741)
• 3000859 chore: Update version for release (#10698)
• 3004a98 chore: Update version for release (pre) (#10692)
• fc5cb1f chore: Update version for release (pre) (#10691)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​remix-run/react since your current version.

Updates astro from 5.5.5 to 5.15.9

Changelog

Sourced from astro's changelog.

5.15.9

Patch Changes

• #14786 758a891 Thanks @​mef! - Add handling of invalid encrypted props and slots in server islands.

• #14783 504958f Thanks @​florian-lefebvre! - Improves the experimental Fonts API build log to show the number of downloaded files. This can help spotting excessive downloading because of misconfiguration

• #14791 9e9c528 Thanks @​Princesseuh! - Changes the remote protocol checks for images to require explicit authorization in order to use data URIs.

  In order to allow data URIs for remote images, you will need to update your astro.config.mjs file to include the following configuration:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  images: {
  remotePatterns: [
  {
  protocol: 'data',
  },
  ],
  },
  });

• #14787 0f75f6b Thanks @​matthewp! - Fixes wildcard hostname pattern matching to correctly reject hostnames without dots

  Previously, hostnames like localhost or other single-part names would incorrectly match patterns like *.example.com. The wildcard matching logic has been corrected to ensure that only valid subdomains matching the pattern are accepted.

• #14776 3537876 Thanks @​ktym4a! - Fixes the behavior of passthroughImageService so it does not generate webp.

• Updated dependencies [9e9c528, 0f75f6b]:

  • @​astrojs/internal-helpers@​0.7.5
  • @​astrojs/markdown-remark@​6.3.9

5.15.8

Patch Changes

• #14772 00c579a Thanks @​matthewp! - Improves the security of Server Islands slots by encrypting them before transmission to the browser, matching the security model used for props. This improves the integrity of slot content and prevents injection attacks, even when component templates don't explicitly support slots.

  Slots continue to work as expected for normal usage—this change has no breaking changes for legitimate requests.

• #14771 6f80081 Thanks @​matthewp! - Fix middleware pathname matching by normalizing URL-encoded paths

  Middleware now receives normalized pathname values, ensuring that encoded paths like /%61dmin are properly decoded to /admin before middleware checks. This prevents potential security issues where middleware checks might be bypassed through URL encoding.

5.15.7

... (truncated)

Commits

• 7a07f02 [ci] release (#14788)
• 8cf3f05 [ci] format
• 758a891 fix(astro): handle invalid encrypted props in server island (#14786)
• 3537876 fix: passthroughImageService generate webp (#14776)
• 048e4dc [ci] format
• 9e9c528 fix: require explicit authorization to use data urls (#14791)
• 0f75f6b Fix wildcard hostname matching to reject hostnames without dots (#14787)
• 504958f feat(fonts): log number of downloaded files (#14783)
• 24e28d2 fix(deps): update astro dependencies (#14779)
• 60af4d0 [ci] release (#14773)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro since your current version.

Updates aws-cdk-lib from 2.148.0 to 2.189.1

Release notes

Sourced from aws-cdk-lib's releases.

v2.189.1

Bug Fixes

• core: implicit Aspect applications do not override custom Aspect applications (#34132) (b7f4bc7)

---

Alpha modules (2.189.1-alpha.0)

v2.189.0

Features

• apigatewayv2: dualstack HTTP and WebSocket API (#34054) (eec900e)
• update L1 CloudFormation resource definitions (#34064) (9cb2602)
• bedrock: support Amazon Nova Reel 1.1 (#34070) (3da0c4d)
• support L2 constructs for Amazon S3 Tables (#33599) (2e95252)
• pipelines: add V2 pipeline type support in L3 construct (#34005) (994e952), closes #33995

Bug Fixes

• codepipeline: replace account root principal with pipeline role in trust policy for cross-account actions (under feature flag) (#34074) (2d901f4)
• custom-resources: AwsCustomResource assumed role session name may contain invalid characters (#34016) (32b6b4d), closes #23260 #34011

---

Alpha modules (2.189.0-alpha.0)

Features

• ec2-alpha: implement mapPublicIpOnLaunch prop in SubnetV2 (#34057) (836c5cf), closes #32159

Bug Fixes

• amplify: unable to re-run integ test due to missing status field in customRule (#33973) (6638c08), closes #33962

v2.188.0

Features

• update L1 CloudFormation resource definitions (#33980) (0923b5e)
• update L1 CloudFormation resource definitions (#34029) (be6210f)
• codepipeline: add usePipelineRoleForActions field support in L2 (#33961) (d8bbc1c)
• codepipeline-actions: support ECRBuildAndPublish action (#33375) (c5cd679), closes #33376
• codepipeline-actions: support InspectorEcrImageScanAction and InspectorSourceCodeScanAction actions (#33378) (2dc8cc7), closes #33377
• cognito: v3.0 pre token generation trigger event (#33778) (ea1436f), closes #33733
• events-targets: support ApiGatewayV2 HttpApi (#33864) (91a3076), closes #26649
• kinesisfirehose: support S3 file extension format (#33776) (e314a9a), closes #32154
• logs-destinations: support Amazon Data Firehose logs destination (#33683) (a8edf69), closes #32038 #24766
• pipelines: actions can default to the pipeline service role instead of a newly created role (#33991) (2ebc51e)
• rds: engine lifecycle support (#33902) (c0f8d29), closes #33859

Bug Fixes

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.241.0-alpha.0 (2026-03-02)

Features

• mixins-preview: add recordFields and outputFormat to Vended Logs Mixin (#37042) (dd94c31)
• mixins-preview: cross account delivery destinations (#36827) (a759eb6)

2.240.0-alpha.0 (2026-02-23)

2.239.0-alpha.0 (2026-02-19)

⚠ BREAKING CHANGES

redshift-alpha: update default node type from DC2_LARGE to RA3_LARGE

Features

• bedrock-agentcore-alpha: add fromCodeAsset method to create runtime artifact with local code assets (#36472) (c5a87e6), closes #36473
• bedrock-agentcore-alpha: added new target type (api gateway) in agentcore gateway target. (#36841) (0842754), closes #36817
• mixins-preview: add ECS ClusterSettingsMixin (#36796) (b8ab5be)
• mixins-preview: add s3 bucket mixin for publicAccessBlock (#36905) (feed4b2)
• mixins-preview: send Vended Logs to pre-created DeliveryDestination using toDestination() (#36896) (48f1fe6)

Bug Fixes

• redshift-alpha: update default node type from DC2_LARGE to RA3_LARGE (#36516) (ea19e5c), closes #36416

2.238.0-alpha.0 (2026-02-09)

Features

• eks-v2-alpha: add support for bootstrapSelfManagedAddons (#36740) (1ffe38d)
• eks-v2-alpha: add support for EKS hybrid nodes (#36749) (48ace56)

Bug Fixes

• eks-v2-alpha: ensure kubectl provider and handler functions use the same vpc configuration (#36735) (4e02f08), closes #34878 #34877
• ivs-alpha: add region constraints to integration tests (#36851) (d55fec4)
• mixins-preview: apply mixins in order (#36847) (726060c)
• mixins-preview: apply mixins in order in MixinApplicator (#36877) (09db1c9), closes #36847

2.237.1-alpha.0 (2026-02-03)

... (truncated)

Commits

• e7432ee chore(release): 2.189.1
• b7f4bc7 fix(core): implicit Aspect applications do not override custom Aspect applica...
• dcd077f chore: update analytics metadata blueprints
• b997bf1 chore(release): 2.189.0
• eec900e feat(apigatewayv2): dualstack HTTP and WebSocket API (#34054)
• 9cb2602 feat: update L1 CloudFormation resource definitions (#34064)
• 2d901f4 fix(codepipeline): replace account root principal with pipeline role in trust...
• 3da0c4d feat(bedrock): support Amazon Nova Reel 1.1 (#34070)
• b1e8879 docs(pipelines): add link to developer guide on how to use docker drop-in rep...
• 1b98a41 docs(batch): add note on update fatgate compute environment (#34022)
• Additional commits viewable in compare view

Updates axios from 1.6.8 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

• Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
• Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

• Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

• Fix/5657. (PR #7313)
• Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

• Add input validation to isAbsoluteURL. (PR #7326)
• Refactor: bump minor package versions. (PR #7356)

Documentation

• Clarify object-check comment. (PR #7323)
• Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

• Chore: fix issues with YAML. (PR #7355)
• CI: update workflow YAMLs. (PR #7372)
• CI: fix run condition. (PR #7373)
• Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
• Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

• @​sachin11063 (first contribution — PR #7323)
• @​asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

• fix: issues with version 1.13.3 (#7352) (ee90dfc)
  • Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

• http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
• interceptor: handle the error in the same interceptor (#6269) (5945e40)
• main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
• package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
• silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
• turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
• types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
• types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
• unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

• add undefined as a value in AxiosRequestConfig (#5560) (095033c)
• add automatic minor and patch upgrades to dependabot (#6053) (65a7584)
• add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)
• added copilot instructions (3f83143)
• compatibility with frozen prototypes (#6265) (860e033)
• enhance pipeFileToResponse with error handling (#7169) (88d7884)
• types: Intellisense for string literals in a widened union (#6134) (f73474d), closes microsoft/TypeScript#33471

Reverts

• Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
• deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

• Ashvin Tiwari
• Nikunj Mochi
• Anchal Singh
• jasonsaayman
• Julian Dax
• Akash Dhar Dubey
• Madhumita
• Tackoil
• Justin Dhillon
• Rudransh
• WuMingDao
• codenomnom
• Nandan Acharya
• Eric Dubé
• Tibor Pilz
• Gabriel Quaresma
• Turadg Aleahmad

... (truncated)

Commits

• 29f7542 chore(release): prepare release 1.13.5 (#7379)
• 431c3a3 ci: fix run condition (#7373)
• 9ff3a78 ci: update ymls (#7372)
• 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
• 475e75a feat: add input validation to isAbsoluteURL (#7326)
• 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
• 04cf019 docs: clarify object check comment (#7323)
• 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
• 569f028 fix: added a option to choose between legacy and the new request/response int...
• 44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Updates devalue from 5.1.1 to 5.6.3

Release notes

Sourced from devalue's releases.

v5.6.3

Patch Changes

• 0f04d4d: fix: Properly handle __proto__
• 819f1ac: fix: better encoding for sparse arrays

v5.6.2

Patch Changes

• 1175584: fix: validate input for ArrayBuffer parsing
• e46afa6: fix: validate input for typed arrays
• 1175584: fix: more helpful errors for inputs causing stack overflows

v5.6.1

Patch Changes

• 2161d44: fix: add hasOwn check before calling reviver

v5.6.0

Minor Changes

• a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
• a3d09d4: feat: add value and root properties in DevalueError instances

v5.5.0

Minor Changes

• 828fa1c: Enable support for custom reducer/reviver for "function" values

v5.4.2

Patch Changes

• 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

v5.4.1

Patch Changes

• ca3c7b6: chore: Remove impossible void type from replacer's uneval

v5.4.0

Minor Changes

• 9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

• b617c7c: perf: shrink uneval output with null-proto objects

v5.3.2

Patch Changes

... (truncated)

Changelog

Sourced from devalue's changelog.

5.6.3

Patch Changes

• 0f04d4d: fix: Properly handle __proto__
• 819f1ac: fix: better encoding for sparse arrays

5.6.2

Patch Changes

• 1175584: fix: validate input for ArrayBuffer parsing
• e46afa6: fix: validate input for typed arrays
• 1175584: fix: more helpful errors for inputs causing stack overflows

5.6.1

Patch Changes

• 2161d44: fix: add hasOw...

  Description has been truncated