chore(deps-dev): bump the dev-dependencies group across 1 directory with 11 updates by dependabot[bot] · Pull Request #500 · cap-js/telemetry

dependabot · 2026-09-04T22:04:37Z

Bumps the dev-dependencies group with 11 updates in the / directory:

Package	From	To
@cap-js/cds-test	`1.0.1`	`1.0.2`
@opentelemetry/exporter-metrics-otlp-grpc	`0.219.0`	`0.222.0`
@opentelemetry/exporter-metrics-otlp-proto	`0.219.0`	`0.222.0`
@opentelemetry/exporter-trace-otlp-grpc	`0.219.0`	`0.222.0`
@opentelemetry/exporter-trace-otlp-proto	`0.219.0`	`0.222.0`
@opentelemetry/instrumentation-host-metrics	`0.2.0`	`0.5.0`
@opentelemetry/instrumentation-runtime-node	`0.32.0`	`0.35.0`
@sap/cds-mtxs	`4.0.1`	`4.0.2`
axios	`1.18.1`	`1.20.0`
eslint	`10.6.0`	`10.10.0`
jest	`30.4.2`	`30.5.1`

Updates @cap-js/cds-test from 1.0.1 to 1.0.2

Release notes

Sourced from @cap-js/cds-test's releases.

v1.0.2

Fixed

Buffer request bodies are no longer serialized via JSON.stringify()

In chest-powered tests, inspectPort configuration will be passed to node:test.run(...) when debugging

In chest-powered tests, concurrency of node:test.run(...) will be limitted to 1 to enable debugging

Changelog

Sourced from @cap-js/cds-test's changelog.

[1.0.2] - 2026-08-04

Fixed

Buffer request bodies are no longer serialized via JSON.stringify()

In chest-powered tests, inspectPort configuration will be passed to node:test.run(...) when debugging

In chest-powered tests, concurrency of node:test.run(...) will be limitted to 1 to enable debugging

Commits

1304e9d fix: pass debug flag to runner (#96)
540bc36 Bump @cap-js/sqlite from 2.4.0 to 3.0.2 (#102)
4f150df fix(naxios): send Buffer request bodies as raw bytes (#103)
4d6ca38 feat: remove sleep API (#98)
6d8eac9 chore: open dependency to cap-js/sqlite 3 (#94)
7456cb5 fix: fulfilled and rejected can be awaited (#93)
fa7721a Bump qs from 6.15.1 to 6.15.2 in the npm_and_yarn group across 1 directory (#91)
7c833de fix: .to.be.fullfilled/rejected must return this (#92)
0f1a65c Bump @cap-js/sqlite from 2.2.0 to 2.4.0 (#88)
90e6cf5 Temporarily reverting cds.test --with-mocks
Additional commits viewable in compare view

Updates @opentelemetry/exporter-metrics-otlp-grpc from 0.219.0 to 0.222.0

Release notes

Sourced from @opentelemetry/exporter-metrics-otlp-grpc's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-metrics-otlp-proto from 0.219.0 to 0.222.0

Release notes

Sourced from @opentelemetry/exporter-metrics-otlp-proto's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-grpc from 0.219.0 to 0.222.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-grpc's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-proto from 0.219.0 to 0.222.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-proto's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates @opentelemetry/instrumentation-host-metrics from 0.2.0 to 0.5.0

Release notes

Sourced from @opentelemetry/instrumentation-host-metrics's releases.

instrumentation-host-metrics: v0.5.0

0.5.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

instrumentation-console: v0.4.0

0.4.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

Bug Fixes

instrumentation-console: restore console methods on disable when constructed with { enabled: true } (#3641) (97c7f21)

instrumentation-host-metrics: v0.4.0

0.4.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

sampler-aws-xray: v0.3.0

0.3.0 (2026-07-23)

⚠ BREAKING CHANGES

only emit stable http, network and database attributes (#3585)

Features

only emit stable http, network and database attributes (#3585) (5b7dd0e)

Changelog

Sourced from @opentelemetry/instrumentation-host-metrics's changelog.

0.5.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

0.4.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

0.3.0 (2026-07-03)

Features

deps: update deps matching '@opentelemetry/*' (#3593) (6dfb532)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/instrumentation-host-metrics since your current version.

Updates @opentelemetry/instrumentation-runtime-node from 0.32.0 to 0.35.0

Changelog

Sourced from @opentelemetry/instrumentation-runtime-node's changelog.

0.35.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

0.34.0 (2026-07-23)

⚠ BREAKING CHANGES

instrumentation-runtime-node: remove deprecated v8js.memory.heap.limit metric (#3632)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

instrumentation-runtime-node: remove deprecated v8js.memory.heap.limit metric (#3632) (f698292)

0.33.0 (2026-07-03)

Features

deps: update deps matching '@opentelemetry/*' (#3593) (6dfb532)

instrumentation-runtime-node: add active resource gauge (#3361) (f3d38e2)

Commits

See full diff in compare view

Updates @sap/cds-mtxs from 4.0.1 to 4.0.2

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032,

…ith 11 updates Bumps the dev-dependencies group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@cap-js/cds-test](https://github.com/cap-js/cds-test) | `1.0.1` | `1.0.2` | | [@opentelemetry/exporter-metrics-otlp-grpc](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.222.0` | | [@opentelemetry/exporter-metrics-otlp-proto](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.222.0` | | [@opentelemetry/exporter-trace-otlp-grpc](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.222.0` | | [@opentelemetry/exporter-trace-otlp-proto](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.222.0` | | [@opentelemetry/instrumentation-host-metrics](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-host-metrics) | `0.2.0` | `0.5.0` | | [@opentelemetry/instrumentation-runtime-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-runtime-node) | `0.32.0` | `0.35.0` | | [@sap/cds-mtxs](https://cap.cloud.sap/) | `4.0.1` | `4.0.2` | | [axios](https://github.com/axios/axios) | `1.18.1` | `1.20.0` | | [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.10.0` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.4.2` | `30.5.1` | Updates `@cap-js/cds-test` from 1.0.1 to 1.0.2 - [Release notes](https://github.com/cap-js/cds-test/releases) - [Changelog](https://github.com/cap-js/cds-test/blob/main/CHANGELOG.md) - [Commits](cap-js/cds-test@v1.0.1...v1.0.2) Updates `@opentelemetry/exporter-metrics-otlp-grpc` from 0.219.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.222.0) Updates `@opentelemetry/exporter-metrics-otlp-proto` from 0.219.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.222.0) Updates `@opentelemetry/exporter-trace-otlp-grpc` from 0.219.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.222.0) Updates `@opentelemetry/exporter-trace-otlp-proto` from 0.219.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.222.0) Updates `@opentelemetry/instrumentation-host-metrics` from 0.2.0 to 0.5.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-host-metrics/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/v0.5.0/packages/instrumentation-host-metrics) Updates `@opentelemetry/instrumentation-runtime-node` from 0.32.0 to 0.35.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-runtime-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/host-metrics-v0.35.0/packages/instrumentation-runtime-node) Updates `@sap/cds-mtxs` from 4.0.1 to 4.0.2 Updates `axios` from 1.18.1 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.18.1...v1.20.0) Updates `eslint` from 10.6.0 to 10.10.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.6.0...v10.10.0) Updates `jest` from 30.4.2 to 30.5.1 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.1/packages/jest) --- updated-dependencies: - dependency-name: "@cap-js/cds-test" dependency-version: 1.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@opentelemetry/exporter-metrics-otlp-grpc" dependency-version: 0.222.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/exporter-metrics-otlp-proto" dependency-version: 0.222.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-grpc" dependency-version: 0.222.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-proto" dependency-version: 0.222.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/instrumentation-host-metrics" dependency-version: 0.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/instrumentation-runtime-node" dependency-version: 0.35.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@sap/cds-mtxs" dependency-version: 4.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: eslint dependency-version: 10.9.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: jest dependency-version: 30.5.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 4, 2026

dependabot Bot requested a review from a team as a code owner September 4, 2026 22:04

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 4, 2026

dependabot Bot changed the title ~~chore(deps-dev): bump the dev-dependencies group with 11 updates~~ chore(deps-dev): bump the dev-dependencies group across 1 directory with 11 updates Sep 10, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-88f28b7c9e branch from eba850d to 1ad412f Compare September 10, 2026 08:35

Navigation Menu

Uh oh!

chore(deps-dev): bump the dev-dependencies group across 1 directory with 11 updates - #500

chore(deps-dev): bump the dev-dependencies group across 1 directory with 11 updates#500
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-88f28b7c9e

dependabot Bot commented on behalf of github Sep 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.0.2

Fixed

[1.0.2] - 2026-08-04

Fixed

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

instrumentation-host-metrics: v0.5.0

0.5.0 (2026-08-31)

Features

instrumentation-console: v0.4.0

0.4.0 (2026-08-31)

Features

Bug Fixes

instrumentation-host-metrics: v0.4.0

0.4.0 (2026-07-23)

Features

sampler-aws-xray: v0.3.0

0.3.0 (2026-07-23)

⚠ BREAKING CHANGES

Features

0.5.0 (2026-08-31)

Features

0.4.0 (2026-07-23)

Features

0.3.0 (2026-07-03)

Features

0.35.0 (2026-08-31)

Features

0.34.0 (2026-07-23)

⚠ BREAKING CHANGES

Features

0.33.0 (2026-07-03)

Features

v1.20.0 — August 19, 2026

dependabot Bot commented on behalf of github Sep 4, 2026 •

edited

Loading