Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 14 updates - #3492

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-1e916cd5e1
Open

chore(deps): bump the production-dependencies group across 1 directory with 14 updates#3492
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-1e916cd5e1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 14 updates in the / directory:

Package From To
@sentry/node 11.4.0 11.8.0
eventsource 5.1.2 5.1.3
dotenv 18.0.5 18.0.8
express 5.2.1 5.3.0
express-rate-limit 8.7.0 8.7.1
@aws-sdk/client-cloudwatch 3.1146.0 3.1152.0
@aws-sdk/client-s3 3.1146.0 3.1152.0
@aws-sdk/s3-request-presigner 3.1146.0 3.1152.0
posthog-node 5.55.0 5.56.1
@anthropic-ai/sdk 0.131.0 0.135.0
google-auth-library 11.1.0 11.3.1
@aws-sdk/client-ses 3.1146.0 3.1152.0
@aws-sdk/credential-providers 3.1146.0 3.1152.0
@sentry/core 11.4.0 11.8.0

Updates @sentry/node from 11.4.0 to 11.8.0

Release notes

Sourced from @​sentry/node's releases.

11.8.0

Important Changes

  • feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

    The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

    • Node.js 20.19.0 or higher is required.
    • @sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.
    • The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
    • Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

  • feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

    OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

  • feat(core): Support SuppressedError in LinkedErrors integration (#25246)
  • fix(astro): Delete generated source maps for static output (#25310)
  • fix(astro): Upload source maps of Astro 7's prerender build (#25309)
  • fix(browser): Apply urlQueryParams to the Referer header (#25324)
  • fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
  • fix(hono): Expose runtime-specific SDK options (#25290)
  • fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
  • fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
  • fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)
  • fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
  • fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
  • fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
  • fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)
  • chore: Add external contributor to CHANGELOG.md (#25375)
  • ci: Install the pnpm version that Volta pins (#25287)
  • license: Add cli FSL notice to package licenses (#25314)
  • ref(core): use shared MCP attribute conventions (#25059)
  • ref(tanstackstart-react): Reuse shared component annotation options (#25313)
  • test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
  • test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)
  • test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
  • test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
  • test(e2e): Add node-openai-send-to-sentry test app (#24824)
  • test(e2e): Add nuxt-5-sourcemaps test (#25268)
  • test(e2e): Inherit root Volta config in all e2e test apps (#25369)
  • test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
  • test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)
  • test(nextjs): Switch DEBUG_BUILD with a getter instead of re-importing the SDK (#25279)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

11.8.0

Important Changes

  • feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

    The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

    • Node.js 20.19.0 or higher is required.
    • @sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.
    • The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
    • Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

  • feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

    OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

  • feat(core): Support SuppressedError in LinkedErrors integration (#25246)
  • fix(astro): Delete generated source maps for static output (#25310)
  • fix(astro): Upload source maps of Astro 7's prerender build (#25309)
  • fix(browser): Apply urlQueryParams to the Referer header (#25324)
  • fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
  • fix(hono): Expose runtime-specific SDK options (#25290)
  • fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
  • fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
  • fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)
  • fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
  • fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
  • fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
  • fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)
  • chore: Add external contributor to CHANGELOG.md (#25375)
  • ci: Install the pnpm version that Volta pins (#25287)
  • license: Add cli FSL notice to package licenses (#25314)
  • ref(core): use shared MCP attribute conventions (#25059)
  • ref(tanstackstart-react): Reuse shared component annotation options (#25313)
  • test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
  • test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)
  • test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
  • test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
  • test(e2e): Add node-openai-send-to-sentry test app (#24824)
  • test(e2e): Add nuxt-5-sourcemaps test (#25268)
  • test(e2e): Inherit root Volta config in all e2e test apps (#25369)
  • test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
  • test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)

... (truncated)

Commits
  • c6492ef release: 11.8.0
  • e091f7f meta(changelog): Update changelog for 11.8.0 (#25388)
  • 30ec754 meta(changelog): Update changelog for 11.8.0
  • a309cf8 test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
  • 71f1ef9 test(e2e): Inherit root Volta config in all e2e test apps (#25369)
  • e54e577 chore: Add external contributor to CHANGELOG.md (#25375)
  • 0ed4606 fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
  • 9516aeb fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
  • 7471347 feat(core): Support SuppressedError in LinkedErrors integration (#25246)
  • f4ae6c5 fix(browser): Apply urlQueryParams to the Referer header (#25324)
  • Additional commits viewable in compare view

Updates eventsource from 5.1.2 to 5.1.3

Release notes

Sourced from eventsource's releases.

v5.1.3

Patch Changes

  • #369 d3fe0d3 Thanks @​rexxars! - Accept case variations of text/event-stream and reject different MIME subtypes such as text/event-streaming.

  • #370 02634eb Thanks @​rexxars! - Avoid double-encoding non-ASCII event IDs when reconnecting with Cloudflare Workers' native fetch.

  • #367 fd62d79 Thanks @​OsamaAnsar! - Fixed Last-Event-ID not being sent as UTF-8 on reconnect

    The event ID was passed to fetch() as a plain string header value, but header values are byte strings. An ID containing a character above U+00FF, eg €, made fetch() throw a TypeError on every reconnect attempt, so the connection was never re-established. An ID with characters in the U+0080 to U+00FF range, eg é, was sent as a single Latin-1 byte instead of its UTF-8 encoding. The header now carries the UTF-8 bytes of the ID, as the specification requires.

Changelog

Sourced from eventsource's changelog.

5.1.3

Patch Changes

  • #369 d3fe0d3 Thanks @​rexxars! - Accept case variations of text/event-stream and reject different MIME subtypes such as text/event-streaming.

  • #370 02634eb Thanks @​rexxars! - Avoid double-encoding non-ASCII event IDs when reconnecting with Cloudflare Workers' native fetch.

  • #367 fd62d79 Thanks @​OsamaAnsar! - Fixed Last-Event-ID not being sent as UTF-8 on reconnect

    The event ID was passed to fetch() as a plain string header value, but header values are byte strings. An ID containing a character above U+00FF, eg €, made fetch() throw a TypeError on every reconnect attempt, so the connection was never re-established. An ID with characters in the U+0080 to U+00FF range, eg é, was sent as a single Latin-1 byte instead of its UTF-8 encoding. The header now carries the UTF-8 bytes of the ID, as the specification requires.

Commits

Updates dotenv from 18.0.5 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

  • Fast parser should strip appended extra quotes (#1073)
  • Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

  • Treat undefined settings like quiet: true as null rather than falsey (#1070)
  • CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

  • Use smarter parseBoolean not Boolean() to fix override (#1069)
Commits
  • e2fe95e 18.0.8
  • 7aa712a type detail improvement
  • 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
  • 0b4843a changelog
  • 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
  • f757811 fix(types): allow undefined values in populate output
  • fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
  • 2953207 18.0.7
  • 9944723 make more readable for undefined -> null
  • d455db0 Merge branch 'master' of github.com:motdotla/dotenv
  • Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits
  • c2e30b3 8.7.1
  • b40a390 v8.7.1 changelog
  • ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
  • 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
  • 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
  • 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
  • 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
  • 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
  • 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
  • 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
  • Additional commits viewable in compare view

Updates @aws-sdk/client-cloudwatch from 3.1146.0 to 3.1152.0

Release notes

Sourced from @​aws-sdk/client-cloudwatch's releases.

v3.1152.0

3.1152.0(2026-10-14)

Documentation Changes
  • client-marketplace-metering: Documentation update - added a Get started pointer to the AWS Marketplace AI Metering Agent Skill in the BatchMeterUsage API reference. No API or behavior change. (c97db282)
New Features
  • clients: update client endpoints as of 2026-10-14 (91a8a07c)
  • client-imagebuilder: This release adds parentInstance to infrastructure configurations, so builds can use an already-running instance from an Amazon EC2 Auto Scaling group. It also adds terminateInstanceOnCompletion, which keeps build and test instances running after image creation ends. (e8a5e26b)
  • client-cloudfront: This release adds a new "IpAddressType" field to "VPCOriginEndpointConfig", allowing customers to specify whether their VPC origin accepts IPv4-only or dualstack connections. (6bae6413)
  • client-transfer: AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. This gives you greater control over your server identity and helps simplify server migrations and failover. (9d0e8866)
  • client-dynamodb-streams: Add support for a new iterator type (AT TIMESTAMP) for DynamoDB Streams GetShardIterator API that allows reading from a specific point in time from the stream. (150e6ae3)
  • client-ec2: Adds T8i instance sizes to the InstanceType enum. T8i instances are low-cost burstable instances powered by custom sixth generation Intel Xeon 6 processors, available exclusively on AWS, and built on the latest sixth generation AWS Nitro cards (65c6056b)
  • client-arc-region-switch: Features - Adds support for an optional payload to invoke the Lambda function with as part of the Custom action Lambda execution block (d21aa72b)
  • client-organizations: With dual-stack enabled, all requests now resolve to the endpoint in the partition's primary Region (for example, organizations.us-east-1.api.aws) and are signed for that Region. Previously, requests from other Regions resolved to a nonexistent endpoint. No API changes. (9324745e)
  • client-bedrock-agentcore-control: This release supports scoping Amazon Bedrock AgentCore Gateway rate limits by request header or request body field. (30c5bca2)
  • client-lambda: AWS Lambda now supports an optional X-Ray trace header for chained invocations in durable executions, enabling child invocations to be linked to the initiating span. (08219be0)
  • client-guardduty: Releasing support for Custom Detection Rule Runtime Monitoring (0cb32b8f)
  • lib-transfer-manager: publish as a preview package (#8355) (41080929)

For list of updated packages, view updated-packages.md in assets-3.1152.0.zip

v3.1151.0

3.1151.0(2026-10-13)

Chores
  • lib-transfer-manager: move lib-transfer-manager to preview/ folder (#8351) (5037a006)
  • scripts: add preview/ folder to build tooling (#8350) (a922905a)
Documentation Changes
  • client-lambda-web: Documentation update to include common use cases. (643507a0)
New Features
  • clients: update client endpoints as of 2026-10-13 (d3994582)
  • client-lakeformation: Added new LakeFormation APIs and documentation updates for Simple Row-level Security (RLS). (c7a586fc)
  • client-agent-registry-control: AWS Agent Registry is improving recently launched custom metadata schema feature to make shared attributes easier to manage. (ed00d0bb)
  • client-omics: With Expanded container registry support, you can use container images from registries such as Seqera (Wave), NVIDIA NGC, and Google Artifact Registry with AWS HealthOmics private workflows, without manually migrating images into Amazon ECR or editing your workflow definitions. (db382740)
  • client-route-53-domains: Route 53 Domains now supports premium domains. This release adds consent objects to operations on premium domains and a new GetDomainPrices API. Also, the Flags and PublicKey fields were deprecated from the DnssecKey response. (c5cc6f50)
  • client-gamelift: Adds support for new instance types in the C8a, C8i, C9g, M8a, M8i, and M9g families for managed EC2 and container fleets (51456772)
  • client-appstream: Adds support for administrators to require users to re-authenticate OneDrive and Google Drive storage connectors when a streaming session is reused. (2b6f2af5)
  • client-connect: New APIs to support aliases and versions for ContactFlow. (39466baa)
  • client-appintegrations: This release adds the Connect JWT authentication type and the AudienceOverride field to AuthConfig, letting A2A server applications authenticate with JWTs issued by Amazon Connect. (3b212b20)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-cloudwatch's changelog.

3.1152.0 (2026-10-14)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1151.0 (2026-10-13)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1150.0 (2026-10-12)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1148.0 (2026-10-08)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

3.1147.0 (2026-10-06)

Note: Version bump only for package @​aws-sdk/client-cloudwatch

Commits

Updates @aws-sdk/client-s3 from 3.1146.0 to 3.1152.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1152.0

3.1152.0(2026-10-14)

Documentation Changes
  • client-marketplace-metering: Documentation update - added a Get started pointer to the AWS Marketplace AI Metering Agent Skill in the BatchMeterUsage API reference. No API or behavior change. (c97db282)
New Features
  • clients: update client endpoints as of 2026-10-14 (91a8a07c)
  • client-imagebuilder: This release adds parentInstance to infrastructure configurations, so builds can use an already-running instance from an Amazon EC2 Auto Scaling group. It also adds terminateInstanceOnCompletion, which keeps build and test instances running after image creation ends. (e8a5e26b)
  • client-cloudfront: This release adds a new "IpAddressType" field to "VPCOriginEndpointConfig", allowing customers to specify whether their VPC origin accepts IPv4-only or dualstack connections. (6bae6413)
  • client-transfer: AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. This gives you greater control over your server identity and helps simplify server migrations and failover. (9d0e8866)
  • client-dynamodb-streams: Add support for a new iterator type (AT TIMESTAMP) for DynamoDB Streams GetShardIterator API that allows reading from a specific point in time from the stream. (150e6ae3)
  • client-ec2: Adds T8i instance sizes to the InstanceType enum. T8i instances are low-cost burstable instances powered by custom sixth generation Intel Xeon 6 processors, available exclusively on AWS, and built on the latest sixth generation AWS Nitro cards (65c6056b)
  • client-arc-region-switch: Features - Adds support for an optional payload to invoke the Lambda function with as part of the Custom action Lambda execution block (d21aa72b)
  • client-organizations: With dual-stack enabled, all requests now resolve to the endpoint in the partition's primary Region (for example, organizations.us-east-1.api.aws) and are signed for that Region. Previously, requests from other Regions resolved to a nonexistent endpoint. No API changes. (9324745e)
  • client-bedrock-agentcore-control: This release supports scoping Amazon Bedrock AgentCore Gateway rate limits by request header or request body field. (30c5bca2)
  • client-lambda: AWS Lambda now supports an optional X-Ray trace header for chained invocations in durable executions, enabling child invocations to be linked to the initiating span. (08219be0)
  • client-guardduty: Releasing support for Custom Detection Rule Runtime Monitoring (0cb32b8f)
  • lib-transfer-manager: publish as a preview package (#8355) (41080929)

For list of updated packages, view updated-packages.md in assets-3.1152.0.zip

v3.1151.0

3.1151.0(2026-10-13)

Chores
  • lib-transfer-manager: move lib-transfer-manager to preview/ folder (#8351) (5037a006)
  • scripts: add preview/ folder to build tooling (#8350) (a922905a)
Documentation Changes
  • client-lambda-web: Documentation update to include common use cases. (643507a0)
New Features
  • clients: update client endpoints as of 2026-10-13 (d3994582)
  • client-lakeformation: Added new LakeFormation APIs and documentation updates for Simple Row-level Security (RLS). (c7a586fc)
  • client-agent-registry-control: AWS Agent Registry is improving recently launched custom metadata schema feature to make shared attributes easier to manage. (ed00d0bb)
  • client-omics: With Expanded container registry support, you can use container images from registries such as Seqera (Wave), NVIDIA NGC, and Google Artifact Registry with AWS HealthOmics private workflows, without manually migrating images into Amazon ECR or editing your workflow definitions. (db382740)
  • client-route-53-domains: Route 53 Domains now supports premium domains. This release adds consent objects to operations on premium domains and a new GetDomainPrices API. Also, the Flags and PublicKey fields were deprecated from the DnssecKey response. (c5cc6f50)
  • client-gamelift: Adds support for new instance types in the C8a, C8i, C9g, M8a, M8i, and M9g families for managed EC2 and container fleets (51456772)
  • client-appstream: Adds support for administrators to require users to re-authenticate OneDrive and Google Drive storage connectors when a streaming session is reused. (2b6f2af5)
  • client-connect: New APIs to support aliases and versions for ContactFlow. (39466baa)
  • client-appintegrations: This release adds the Connect JWT authentication type and the AudienceOverride field to AuthConfig, letting A2A server applications authenticate with JWTs issued by Amazon Connect. (3b212b20)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1152.0 (2026-10-...

Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 18, 2026
@dependabot
chore(deps): bump the production-dependencies group across 1 director…
7b7b474 
…y with 14 updates

Bumps the production-dependencies group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `11.4.0` | `11.8.0` |
| [eventsource](https://github.com/EventSource/eventsource) | `5.1.2` | `5.1.3` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.5` | `18.0.8` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.7.0` | `8.7.1` |
| [@aws-sdk/client-cloudwatch](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-cloudwatch) | `3.1146.0` | `3.1152.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1146.0` | `3.1152.0` |
| [@aws-sdk/s3-request-presigner](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/s3-request-presigner) | `3.1146.0` | `3.1152.0` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.55.0` | `5.56.1` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.131.0` | `0.135.0` |
| [google-auth-library](https://github.com/googleapis/google-cloud-node/tree/HEAD/core/packages/google-auth-library-nodejs) | `11.1.0` | `11.3.1` |
| [@aws-sdk/client-ses](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ses) | `3.1146.0` | `3.1152.0` |
| [@aws-sdk/credential-providers](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/credential-providers) | `3.1146.0` | `3.1152.0` |
| [@sentry/core](https://github.com/getsentry/sentry-javascript) | `11.4.0` | `11.8.0` |



Updates `@sentry/node` from 11.4.0 to 11.8.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@11.4.0...11.8.0)

Updates `eventsource` from 5.1.2 to 5.1.3
- [Release notes](https://github.com/EventSource/eventsource/releases)
- [Changelog](https://github.com/EventSource/eventsource/blob/main/CHANGELOG.md)
- [Commits](EventSource/eventsource@v5.1.2...v5.1.3)

Updates `dotenv` from 18.0.5 to 18.0.8
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.5...v18.0.8)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `express-rate-limit` from 8.7.0 to 8.7.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.7.0...v8.7.1)

Updates `@aws-sdk/client-cloudwatch` from 3.1146.0 to 3.1152.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-cloudwatch/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1152.0/clients/client-cloudwatch)

Updates `@aws-sdk/client-s3` from 3.1146.0 to 3.1152.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1152.0/clients/client-s3)

Updates `@aws-sdk/s3-request-presigner` from 3.1146.0 to 3.1152.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/s3-request-presigner/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1152.0/packages/s3-request-presigner)

Updates `posthog-node` from 5.55.0 to 5.56.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.56.1/packages/node)

Updates `@anthropic-ai/sdk` from 0.131.0 to 0.135.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.131.0...sdk-v0.135.0)

Updates `google-auth-library` from 11.1.0 to 11.3.1
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/core/packages/google-auth-library-nodejs/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/google-auth-library-v11.3.1/core/packages/google-auth-library-nodejs)

Updates `@aws-sdk/client-ses` from 3.1146.0 to 3.1152.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ses/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1152.0/clients/client-ses)

Updates `@aws-sdk/credential-providers` from 3.1146.0 to 3.1152.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/credential-providers/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1152.0/packages/credential-providers)

Updates `@sentry/core` from 11.4.0 to 11.8.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@11.4.0...11.8.0)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.135.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-cloudwatch"
  dependency-version: 3.1152.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1152.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-ses"
  dependency-version: 3.1152.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/credential-providers"
  dependency-version: 3.1152.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/s3-request-presigner"
  dependency-version: 3.1152.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/core"
  dependency-version: 11.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/node"
  dependency-version: 11.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: dotenv
  dependency-version: 18.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: eventsource
  dependency-version: 5.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: google-auth-library
  dependency-version: 11.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: posthog-node
  dependency-version: 5.56.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-1e916cd5e1 branch from 34dc802 to 7b7b474 Compare October 18, 2026 23:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants