chore(deps-dev): bump the dev-dependencies group with 12 updates by dependabot[bot] · Pull Request #515 · cap-js/telemetry

dependabot · 2026-09-18T22:04:44Z

Bumps the dev-dependencies group with 12 updates:

Package	From	To
@cap-js/cds-test	`1.0.1`	`1.0.2`
@cap-js/sqlite	`3.0.2`	`3.1.1`
@opentelemetry/exporter-metrics-otlp-grpc	`0.219.0`	`0.222.0`
@opentelemetry/exporter-metrics-otlp-proto	`0.219.0`	`0.222.0`
@opentelemetry/exporter-trace-otlp-grpc	`0.219.0`	`0.222.0`
@opentelemetry/exporter-trace-otlp-proto	`0.219.0`	`0.222.0`
@opentelemetry/instrumentation-host-metrics	`0.2.0`	`0.5.0`
@opentelemetry/instrumentation-runtime-node	`0.32.0`	`0.35.0`
@sap/cds-mtxs	`4.0.1`	`4.1.0`
axios	`1.18.1`	`1.20.0`
eslint	`10.6.0`	`10.10.0`
jest	`30.4.2`	`30.5.1`

Updates @cap-js/cds-test from 1.0.1 to 1.0.2

Release notes

Sourced from @cap-js/cds-test's releases.

v1.0.2

Fixed

Buffer request bodies are no longer serialized via JSON.stringify()

In chest-powered tests, inspectPort configuration will be passed to node:test.run(...) when debugging

In chest-powered tests, concurrency of node:test.run(...) will be limitted to 1 to enable debugging

Changelog

Sourced from @cap-js/cds-test's changelog.

[1.0.2] - 2026-08-04

Fixed

Buffer request bodies are no longer serialized via JSON.stringify()

In chest-powered tests, inspectPort configuration will be passed to node:test.run(...) when debugging

In chest-powered tests, concurrency of node:test.run(...) will be limitted to 1 to enable debugging

Commits

1304e9d fix: pass debug flag to runner (#96)
540bc36 Bump @cap-js/sqlite from 2.4.0 to 3.0.2 (#102)
4f150df fix(naxios): send Buffer request bodies as raw bytes (#103)
4d6ca38 feat: remove sleep API (#98)
6d8eac9 chore: open dependency to cap-js/sqlite 3 (#94)
7456cb5 fix: fulfilled and rejected can be awaited (#93)
fa7721a Bump qs from 6.15.1 to 6.15.2 in the npm_and_yarn group across 1 directory (#91)
7c833de fix: .to.be.fullfilled/rejected must return this (#92)
0f1a65c Bump @cap-js/sqlite from 2.2.0 to 2.4.0 (#88)
90e6cf5 Temporarily reverting cds.test --with-mocks
Additional commits viewable in compare view

Updates @cap-js/sqlite from 3.0.2 to 3.1.1

Release notes

Sourced from @cap-js/sqlite's releases.

db-service: v3.1.1

3.1.1 (2026-09-15)

Fixed

cqn4sql: correctly expand not exists alongside a null-check branch (#1736) (bfb0a01)

Performance Improvements

do not use ranked search for static values (#1727) (33fb36b)

if explicit order by is specified, do not add ranked search as a secondary clause (33fb36b)

hana: v3.1.1

3.1.1 (2026-09-15)

Fixed

resolve service projections for upsert (#1735) (960ac9b)

Performance Improvements

do not use ranked search for static values (#1727) (33fb36b)

if explicit order by is specified, do not add ranked search as a secondary clause (33fb36b)

Dependencies

The following workspace dependencies were updated

dependencies

@cap-js/db-service bumped from ^3.1.0 to ^3.1.1

postgres: v3.1.1

3.1.1 (2026-09-15)

Dependencies

The following workspace dependencies were updated

dependencies

@cap-js/db-service bumped from ^3.1.0 to ^3.1.1

sqlite: v3.1.1

3.1.1 (2026-09-15)

Dependencies

... (truncated)

Commits

7241d2d chore: release main (#1728)
bfb0a01 fix(cqn4sql): correctly expand not exists \<assoc> alongside a null-check br...
960ac9b fix: resolve service projections for upsert (#1735)
33fb36b perf: do not use ranked search for static values (#1727)
dba03e9 chore: release main (#1703)
bc93160 feat: rank $search results by relevance (#1725)
633db11 test(cqn4sql): refactor calculated elements test suite (#1643)
cf6af99 fix(pool): recover lost connection after stale acquire timeout (#1724)
c9228a6 chore(deps-dev): bump @sap/hana-client from 2.29.25 to 2.29.27 in the depende...
1443f85 chore(deps): bump qs from 6.15.3 to 6.16.0 (#1722)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-metrics-otlp-grpc from 0.219.0 to 0.222.0

Release notes

Sourced from @opentelemetry/exporter-metrics-otlp-grpc's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-metrics-otlp-proto from 0.219.0 to 0.222.0

Release notes

Sourced from @opentelemetry/exporter-metrics-otlp-proto's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-grpc from 0.219.0 to 0.222.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-grpc's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-proto from 0.219.0 to 0.222.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-proto's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes
fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @trentm

fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @trentm

fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @trentm
fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @trentm
This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)
Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"
🚀 Features

feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @dyladan

fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @JacksonWeber

📚 Documentation

docs(sdk-logs): mark logger configuration as experimental #6996 @LarryHu0217

docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @vedantchalke36

🏠 Internal

refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @david-luna

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

... (truncated)

Commits

0b72a81 chore: prepare next release (#7044)
a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
f41805e chore: prepare next release (#7042)
b85eb28 chore(instrumentation-http): fix lint errors (#7039)
3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
e086dec Merge commit from fork
59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
d0ce753 chore: add @maryliag to maintainers (#7024)
03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
Additional commits viewable in compare view

Updates @opentelemetry/instrumentation-host-metrics from 0.2.0 to 0.5.0

Release notes

Sourced from @opentelemetry/instrumentation-host-metrics's releases.

instrumentation-host-metrics: v0.5.0

0.5.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

instrumentation-console: v0.4.0

0.4.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

Bug Fixes

instrumentation-console: restore console methods on disable when constructed with { enabled: true } (#3641) (97c7f21)

instrumentation-host-metrics: v0.4.0

0.4.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

sampler-aws-xray: v0.3.0

0.3.0 (2026-07-23)

⚠ BREAKING CHANGES

only emit stable http, network and database attributes (#3585)

Features

only emit stable http, network and database attributes (#3585) (5b7dd0e)

Changelog

Sourced from @opentelemetry/instrumentation-host-metrics's changelog.

0.5.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

0.4.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

0.3.0 (2026-07-03)

Features

deps: update deps matching '@opentelemetry/*' (#3593) (6dfb532)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/instrumentation-host-metrics since your current version.

Updates @opentelemetry/instrumentation-runtime-node from 0.32.0 to 0.35.0

Changelog

Sourced from @opentelemetry/instrumentation-runtime-node's changelog.

0.35.0 (2026-08-31)

Features

deps: update deps matching '@opentelemetry/*' (#3716) (015582a)

0.34.0 (2026-07-23)

⚠ BREAKING CHANGES

instrumentation-runtime-node: remove deprecated v8js.memory.heap.limit metric (#3632)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

instrumentation-runtime-node: remove deprecated v8js.memory.heap.limit metric (#3632) (f698292)

0.33.0 (2026-07-03)

Features

deps: update deps matching '@opentelemetry/*' (#3593) (6dfb532)

instrumentation-runtime-node: add active resource gauge (#3361) (f3d38e2)

Commits

See full diff in compare view

Updates @sap/cds-mtxs from 4.0.1 to 4.1.0

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (

Bumps the dev-dependencies group with 12 updates: | Package | From | To | | --- | --- | --- | | [@cap-js/cds-test](https://github.com/cap-js/cds-test) | `1.0.1` | `1.0.2` | | [@cap-js/sqlite](https://github.com/cap-js/cds-dbs) | `3.0.2` | `3.1.1` | | [@opentelemetry/exporter-metrics-otlp-grpc](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.222.0` | | [@opentelemetry/exporter-metrics-otlp-proto](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.222.0` | | [@opentelemetry/exporter-trace-otlp-grpc](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.222.0` | | [@opentelemetry/exporter-trace-otlp-proto](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.222.0` | | [@opentelemetry/instrumentation-host-metrics](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-host-metrics) | `0.2.0` | `0.5.0` | | [@opentelemetry/instrumentation-runtime-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-runtime-node) | `0.32.0` | `0.35.0` | | [@sap/cds-mtxs](https://cap.cloud.sap/) | `4.0.1` | `4.1.0` | | [axios](https://github.com/axios/axios) | `1.18.1` | `1.20.0` | | [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.10.0` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.4.2` | `30.5.1` | Updates `@cap-js/cds-test` from 1.0.1 to 1.0.2 - [Release notes](https://github.com/cap-js/cds-test/releases) - [Changelog](https://github.com/cap-js/cds-test/blob/main/CHANGELOG.md) - [Commits](cap-js/cds-test@v1.0.1...v1.0.2) Updates `@cap-js/sqlite` from 3.0.2 to 3.1.1 - [Release notes](https://github.com/cap-js/cds-dbs/releases) - [Commits](cap-js/cds-dbs@hana-v3.0.2...hana-v3.1.1) Updates `@opentelemetry/exporter-metrics-otlp-grpc` from 0.219.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.222.0) Updates `@opentelemetry/exporter-metrics-otlp-proto` from 0.219.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.222.0) Updates `@opentelemetry/exporter-trace-otlp-grpc` from 0.219.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.222.0) Updates `@opentelemetry/exporter-trace-otlp-proto` from 0.219.0 to 0.222.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.222.0) Updates `@opentelemetry/instrumentation-host-metrics` from 0.2.0 to 0.5.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-host-metrics/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/v0.5.0/packages/instrumentation-host-metrics) Updates `@opentelemetry/instrumentation-runtime-node` from 0.32.0 to 0.35.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-runtime-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/host-metrics-v0.35.0/packages/instrumentation-runtime-node) Updates `@sap/cds-mtxs` from 4.0.1 to 4.1.0 Updates `axios` from 1.18.1 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.18.1...v1.20.0) Updates `eslint` from 10.6.0 to 10.10.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.6.0...v10.10.0) Updates `jest` from 30.4.2 to 30.5.1 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.1/packages/jest) --- updated-dependencies: - dependency-name: "@cap-js/cds-test" dependency-version: 1.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@cap-js/sqlite" dependency-version: 3.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/exporter-metrics-otlp-grpc" dependency-version: 0.222.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/exporter-metrics-otlp-proto" dependency-version: 0.222.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-grpc" dependency-version: 0.222.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-proto" dependency-version: 0.222.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/instrumentation-host-metrics" dependency-version: 0.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@opentelemetry/instrumentation-runtime-node" dependency-version: 0.35.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@sap/cds-mtxs" dependency-version: 4.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: eslint dependency-version: 10.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: jest dependency-version: 30.5.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 18, 2026

dependabot Bot requested a review from a team as a code owner September 18, 2026 22:04

Navigation Menu

chore(deps-dev): bump the dev-dependencies group with 12 updates - #515

chore(deps-dev): bump the dev-dependencies group with 12 updates#515
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-f91047d8e1

dependabot Bot commented on behalf of github Sep 18, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 18, 2026

v1.0.2

Fixed

[1.0.2] - 2026-08-04

Fixed

db-service: v3.1.1

3.1.1 (2026-09-15)

Fixed

Performance Improvements

hana: v3.1.1

3.1.1 (2026-09-15)

Fixed

Performance Improvements

Dependencies

postgres: v3.1.1

3.1.1 (2026-09-15)

Dependencies

sqlite: v3.1.1

3.1.1 (2026-09-15)

Dependencies

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

experimental/v0.222.0

0.222.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

instrumentation-host-metrics: v0.5.0

0.5.0 (2026-08-31)

Features

instrumentation-console: v0.4.0

0.4.0 (2026-08-31)

Features

Bug Fixes

instrumentation-host-metrics: v0.4.0

0.4.0 (2026-07-23)

Features

sampler-aws-xray: v0.3.0

0.3.0 (2026-07-23)

⚠ BREAKING CHANGES

Features

0.5.0 (2026-08-31)