Skip to content

deps: bump the safe-dependencies group with 8 updates #256

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

deps: bump the safe-dependencies group with 8 updates #256

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 1, 2026

Bumps the safe-dependencies group with 8 updates:

Package From To
express 5.1.0 5.2.1
@types/express 5.0.5 5.0.6
@types/node 24.10.0 24.10.4
eslint 9.39.1 9.39.2
firebase-tools 14.15.2 14.27.0
nodemon 3.1.10 3.1.11
prettier 3.6.2 3.7.4
prettier-plugin-packagejson 2.5.19 2.5.20

Updates express from 5.1.0 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
Commits

Updates @types/express from 5.0.5 to 5.0.6

Commits

Updates @types/express from 5.0.5 to 5.0.6

Commits

Updates @types/node from 24.10.0 to 24.10.4

Commits

Updates eslint from 9.39.1 to 9.39.2

Release notes

Sourced from eslint's releases.

v9.39.2

Bug Fixes

  • 5705833 fix: warn when eslint-env configuration comments are found (#20381) (sethamus)

Build Related

  • 506f154 build: add .scss files entry to knip (#20391) (Milos Djermanovic)

Chores

Commits

Updates firebase-tools from 14.15.2 to 14.27.0

Release notes

Sourced from firebase-tools's releases.

v14.27.0

  • Fixed issue where MCP server didn't detect if iOS app uses Crashlytics in projects that use project.pbxproj (#9515)
  • Add logic to synchronize v2 scheduled function timeout with Cloud Schduler's attempt deadline (#9544)
  • Prevent deployments of Next.js apps vulnerable to CVE-2025-66478 (#9572)
  • Updated Data Connect emulator to v2.17.3:
    • Fixed Swift codegen: Include FirebaseCore import in the connector keys file.
    • Fixed a bug where debug details of Internal errors were swallowed: firebase/firebase-tools#9508

v14.26.0

  • Add support for nodejs24 (beta) runtime for Cloud Functions for Firebase. (#9475)
  • Adds listServices and also defines trigger within runv2.ts (#9482)
  • Updates the firebase init functions template to use firebase-functions 7.0.0 (#9496)
  • Updated to v2.17.2 of the Data Connect emulator, which fixes a bug with handling of optional enum lists in generated Flutter SDKs. (#9391)

v14.25.1

  • Fixed an issue that was causing the MCP server to fail to start when run from directories with deeply nested children.

v14.25.0

  • Added Node 24 support.
  • Updated superstatic to v10.
  • Fixed a crash during parallel deployments when buildConfig is empty (#9455)
  • [Added] support for new google-genai plugin during init genkit (#8957)
  • Updated to v2.17.1 of the Data Connect emulator, which fixes an admin SDK bug for operation without argument #9449 (#9454).
  • Fixed "Precondition failed" error when updating GCFv2 functions in a FAILED state without code changes.

v14.24.2

  • Fixes MCP server issue where googleapis is not available. (#9443)

v14.24.1

  • Fixed issue where MCP server was blocked by console.log

v14.24.0

  • Adds 2nd gen Firebase Data Connect triggers to firebase deploy (#9394).
  • Upgrades @google-cloud/pubsub to v5 (#9428).
  • Updated to v2.17.0 of the Data Connect emulator, which includes internal improvements and now supports Generated Admin SDKs (#9430).

v14.23.0

  • Fix the __name__ normalization of vector indexes for Firestore standard edition databases.
  • Fixed an issue where the emulator would fail to start when using firebase-functions v7+ (#9401).
  • Added functions.list_functions as a MCP tool (#9369)
  • Added AI Logic to firebase init CLI command and firebase_init MCP tool. (#9185)
  • Improved error messages for Firebase AI Logic provisioning during 'firebase init' (#9377)
  • Fixed issue where 'init hosting' failed to prompt for the public directory and set up Hosting files (#9403)
  • Added appdistribution:testcases:export and appdistribution:testcases:import (#9397)
  • Updated to v2.16.0 of the Data Connect emulator, which includes internal improvements.
  • Data Connect now allows executing a valid query / operation even if the other operations are invalid. (This toleration provides convenience on a best-effort basis. Some errors like invalid syntax can still cause the whole request to be rejected.)
  • Fixed enum list deserialization in Data Connect generated Dart SDKs.
  • Added GraphQL __typename support in Data Connect.
  • Support enum values in Data Connect CEL expressions.

... (truncated)

Commits

Updates nodemon from 3.1.10 to 3.1.11

Release notes

Sourced from nodemon's releases.

v3.1.11

3.1.11 (2025-11-11)

Bug Fixes

Commits

Updates prettier from 3.6.2 to 3.7.4

Release notes

Sourced from prettier's releases.

3.7.4

What's Changed

🔗 Changelog

3.7.3

What's Changed

🔗 Changelog

3.7.2

What's Changed

🔗 Changelog

3.7.1

🔗 Changelog

3.7.0

diff

🔗 Release note

Changelog

Sourced from prettier's changelog.

3.7.4

diff

LWC: Avoid quote around interpolations (#18383 by @​kovsu)

<!-- Input -->
<div foo={bar}>   </div>
<!-- Prettier 3.7.3 (--embedded-language-formatting off) -->
<div foo="{bar}"></div>
<!-- Prettier 3.7.4 (--embedded-language-formatting off) -->
<div foo={bar}></div>

TypeScript: Fix comment inside union type gets duplicated (#18393 by @​fisker)

// Input
type Foo = (/** comment */ a | b) | c;
// Prettier 3.7.3
type Foo = /** comment / (/* comment */ a | b) | c;
// Prettier 3.7.4
type Foo = /** comment */ (a | b) | c;

TypeScript: Fix unstable comment print in union type comments (#18395 by @​fisker)

// Input
type X = (A | B) & (
  // comment
  A | B
);
// Prettier 3.7.3 (first format)
type X = (A | B) &
(// comment
A | B);
// Prettier 3.7.3 (second format)
type X = (
| A
</tr></table>

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for prettier since your current version.


Updates prettier-plugin-packagejson from 2.5.19 to 2.5.20

Release notes

Sourced from prettier-plugin-packagejson's releases.

v2.5.20

2.5.20 (2025-11-28)

Bug Fixes

  • deps: update dependency sort-package-json to v3.5.0 (f04e33c)
Commits
  • 0dc0a7e Merge pull request #266 from matzkoh/renovate/sort-package-json-3.x
  • f04e33c fix(deps): update dependency sort-package-json to v3.5.0
  • b6fca98 chore: Add write permission for contents in release workflow
  • f6aa6aa Merge pull request #254 from matzkoh/renovate/jest-monorepo
  • 2c2e3ff Merge pull request #264 from matzkoh/claude/fix-errors-merge-014UuscNDYKfqgXT...
  • 65cbb66 test: update snapshot header link for Jest 30.2.0
  • 0f7469e chore(deps): update dependency jest to v30.2.0
  • 2e65867 Merge pull request #262 from matzkoh/renovate/node-24.x
  • 4b264b7 chore: Add permissions for id-token in release workflow
  • 79def39 chore(deps): update node.js to v24
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for prettier-plugin-packagejson since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the safe-dependencies group with 8 updates
20d05b5 
Bumps the safe-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [express](https://github.com/expressjs/express) | `5.1.0` | `5.2.1` |
| [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express) | `5.0.5` | `5.0.6` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.10.0` | `24.10.4` |
| [eslint](https://github.com/eslint/eslint) | `9.39.1` | `9.39.2` |
| [firebase-tools](https://github.com/firebase/firebase-tools) | `14.15.2` | `14.27.0` |
| [nodemon](https://github.com/remy/nodemon) | `3.1.10` | `3.1.11` |
| [prettier](https://github.com/prettier/prettier) | `3.6.2` | `3.7.4` |
| [prettier-plugin-packagejson](https://github.com/matzkoh/prettier-plugin-packagejson) | `2.5.19` | `2.5.20` |


Updates `express` from 5.1.0 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.1.0...v5.2.1)

Updates `@types/express` from 5.0.5 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

Updates `@types/express` from 5.0.5 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

Updates `@types/node` from 24.10.0 to 24.10.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint` from 9.39.1 to 9.39.2
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.1...v9.39.2)

Updates `firebase-tools` from 14.15.2 to 14.27.0
- [Release notes](https://github.com/firebase/firebase-tools/releases)
- [Changelog](https://github.com/firebase/firebase-tools/blob/main/CHANGELOG.md)
- [Commits](firebase/firebase-tools@v14.15.2...v14.27.0)

Updates `nodemon` from 3.1.10 to 3.1.11
- [Release notes](https://github.com/remy/nodemon/releases)
- [Commits](remy/nodemon@v3.1.10...v3.1.11)

Updates `prettier` from 3.6.2 to 3.7.4
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.6.2...3.7.4)

Updates `prettier-plugin-packagejson` from 2.5.19 to 2.5.20
- [Release notes](https://github.com/matzkoh/prettier-plugin-packagejson/releases)
- [Commits](matzkoh/prettier-plugin-packagejson@v2.5.19...v2.5.20)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: safe-dependencies
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: safe-dependencies
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: safe-dependencies
- dependency-name: "@types/node"
  dependency-version: 24.10.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: safe-dependencies
- dependency-name: eslint
  dependency-version: 9.39.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: safe-dependencies
- dependency-name: firebase-tools
  dependency-version: 14.27.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: safe-dependencies
- dependency-name: nodemon
  dependency-version: 3.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: safe-dependencies
- dependency-name: prettier
  dependency-version: 3.7.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: safe-dependencies
- dependency-name: prettier-plugin-packagejson
  dependency-version: 2.5.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: safe-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jan 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant