Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Deprecations / Replacements

Warning

The following dependencies are either deprecated or have replacements available.

Datasource	Package	Replacement PR?
npm	prom-client

Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

Note

Packages are marked as abandoned when they exceed the abandonmentThreshold since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.

View abandoned dependencies (26)

Datasource	Package	Last Updated
npm	@breejs/later	2023-11-28
npm	bookshelf	2020-06-07
npm	bunyan	2021-01-08
npm	cacheable-lookup	2022-09-27
npm	caller	2022-03-10
npm	cookiejar	2023-01-13
npm	date-format	2022-09-26
npm	debug	2025-09-13
npm	extract-zip	2020-06-10
npm	find-root	2017-06-29
npm	gelf-stream	2016-05-07
npm	husky	2024-11-18
npm	json-stringify-safe	2015-05-19
npm	long-timeout	2016-02-24
npm	nconf	2025-04-14
npm	nodemailer-mailgun-transport	2022-09-14
npm	nodemailer-stub-transport	2016-08-18
npm	prettyjson	2022-01-11
npm	rewire	2025-08-15
npm	split2	2023-03-26
npm	stoppable	2018-11-10
npm	sywac	2020-07-25

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• Update dependency @types/node to v24.13.5
• Update pnpm to v12.4.2

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• Update tryghost/actions digest to 470d6b8
• Update nx monorepo to v23.2.1 (@nx/js, nx)
• Update dependency js-yaml@<3.15.0 to v5.4.2
• Update dependency multer to v2.4.0
• Update dependency oxfmt to v0.68.0
• Update dependency oxlint to v1.83.0
• Update vitest monorepo to v5 (@vitest/coverage-v8, vitest)
• Lock file maintenance
• Click on this checkbox to rebase all open PRs at once

Detected Dependencies

github-actions (2)

.github/workflows/publish.yml (6)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• pnpm/action-setup v6@0977fd99725f1db4007ccb2928dbb4e90d06cc86
• actions/setup-node v7@820762786026740c76f36085b0efc47a31fe5020
• actions/cache v6@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• tryghost/actions main@0cf14bbb9f589e442ab88a82bf610b6673d2dcce → [Updates: main]
• node 24

.github/workflows/test.yml (7)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• pnpm/action-setup v6@0977fd99725f1db4007ccb2928dbb4e90d06cc86
• actions/setup-node v7@820762786026740c76f36085b0efc47a31fe5020
• actions/cache v6@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• nrwl/nx-set-shas v5@afb73a62d26e41464e9254689e1fd6122ee683c1
• codecov/codecov-action v7@303a32d7a59b442fa8d48b6a1cc6825c09c847a5
• tryghost/actions main@0cf14bbb9f589e442ab88a82bf610b6673d2dcce → [Updates: main]

npm (44)

package.json (9)

• @nx/js 23.2.0 → [Updates: 23.2.1]
• @vitest/coverage-v8 4.1.11 → [Updates: 5.0.0]
• husky 9.1.7
• lint-staged 17.5.1
• nx 23.2.0 → [Updates: 23.2.1]
• oxfmt 0.67.0 → [Updates: 0.68.0]
• oxlint 1.82.0 → [Updates: 1.83.0]
• vitest 4.1.11 → [Updates: 5.0.0]
• pnpm 12.4.1 → [Updates: 12.4.2]

packages/bookshelf-collision/package.json (1)

• lodash ^4.18.1

packages/bookshelf-custom-query/package.json

packages/bookshelf-eager-load/package.json (1)

• lodash ^4.18.1

packages/bookshelf-filter/package.json (1)

• @tryghost/nql ^0.13.4

packages/bookshelf-has-posts/package.json (1)

• lodash ^4.18.1

packages/bookshelf-include-count/package.json (1)

• lodash ^4.18.1

packages/bookshelf-order/package.json (1)

• lodash ^4.18.1

packages/bookshelf-pagination/package.json (4)

• lodash ^4.18.1
• better-sqlite3 13.0.3
• bookshelf 1.2.0
• knex 3.3.0

packages/bookshelf-plugins/package.json

packages/bookshelf-search/package.json

packages/bookshelf-transaction-events/package.json

packages/bunyan-rotating-filestream/package.json (2)

• long-timeout ^0.1.1
• bunyan 1.8.15

packages/config/package.json (1)

• nconf ^0.13.0

packages/database-info/package.json (1)

• knex 3.3.0

packages/debug/package.json (1)

• debug ^4.4.3

packages/domain-events/package.json

packages/elasticsearch/package.json (2)

• @elastic/elasticsearch ^8.19.2
• split2 ^4.2.0

packages/email-mock-receiver/package.json

packages/errors/package.json (2)

• @types/node 24.13.4 → [Updates: 24.13.5]
• esbuild 0.28.2

packages/express-test/package.json (7)

• cookiejar ^2.1.4
• form-data ^4.0.6
• mime-types ^3.0.2
• express 5.2.1
• express-session 1.19.0
• multer 2.3.0 → [Updates: 2.4.0]
• express ^4.0.0 || ^5.0.0

packages/http-cache-utils/package.json

packages/http-stream/package.json (1)

• express 5.2.1

packages/jest-snapshot/package.json (3)

• @jest/expect ^30.4.1
• @jest/expect-utils ^30.4.1
• jest-snapshot ^30.4.1

packages/job-manager/package.json (10)

• @breejs/later ^4.2.0
• bree ^9.2.9
• cron-validate ^1.5.3
• fastq ^1.20.3
• p-wait-for ^6.0.0
• workerpool ^10.0.3
• @sinonjs/fake-timers 15.4.0
• date-fns 4.4.0
• rewire 9.0.1
• node ^22.12.0 || >=24.0.0

packages/logging/package.json (5)

• bunyan ^1.8.15
• fs-extra ^11.4.0
• gelf-stream ^1.1.1
• json-stringify-safe ^5.0.1
• lodash ^4.18.1

packages/metrics/package.json (2)

• json-stringify-safe ^5.0.1
• rewire 9.0.1

packages/mw-error-handler/package.json (2)

• lodash ^4.18.1
• semver ^7.8.5

packages/mw-vhost/package.json (1)

• supertest 7.2.2

packages/nodemailer/package.json (4)

• @aws-sdk/client-sesv2 ^3.1122.0
• nodemailer ^10.0.0
• nodemailer-mailgun-transport ^2.1.5
• nodemailer-stub-transport ^1.1.0

packages/pretty-cli/package.json (2)

• chalk ^6.0.0
• sywac ^1.3.0

packages/pretty-stream/package.json (3)

• date-format ^4.0.14
• lodash ^4.18.1
• prettyjson ^1.2.5

packages/prometheus-metrics/package.json (12)

• prom-client ^15.1.3
• stoppable ^1.1.0
• @types/express 5.0.6
• @types/node 24.13.4 → [Updates: 24.13.5]
• @types/sinon 22.0.0
• @types/stoppable 1.1.3
• @types/supertest 7.2.1
• express 5.2.1
• knex 3.3.0
• nock 14.0.17
• supertest 7.2.2
• express ^4.0.0 || ^5.0.0

packages/promise/package.json

packages/request/package.json (6)

• cacheable-lookup ^7.0.0
• got ^16.0.0
• lodash ^4.18.1
• nock 14.0.17
• rewire 9.0.1
• node ^22.12.0 || >=24.0.0

packages/root-utils/package.json (2)

• caller ^1.1.0
• find-root ^1.1.0

packages/security/package.json (2)

• @tryghost/string ^0.3.5
• bcryptjs ^3.0.3

packages/server/package.json

packages/tpl/package.json (1)

• @types/node 24.13.4 → [Updates: 24.13.5]

packages/validator/package.json (2)

• lodash ^4.18.1
• validator ^13.15.35

packages/version/package.json (1)

• semver ^7.8.5

packages/webhook-mock-receiver/package.json (3)

• p-wait-for ^6.0.0
• got 16.0.0
• node ^22.12.0 || >=24.0.0

packages/zip/package.json (3)

• archiver ^8.0.0
• extract-zip ^2.0.1
• folder-hash 4.1.3

pnpm-workspace.yaml (6)

• sinon 22.1.0
• typescript 7.0.2
• axios ^1.15.0
• fast-xml-parser ^5.7.0
• js-yaml@<3.15.0 5.3.0 → [Updates: 5.4.2]
• yauzl 3.4.0

nvm (1)

.nvmrc (1)

• node 24

renovate-config (1)

renovate.json

---

• Check this box to trigger a request for Renovate to run again on this repository