chore(deps): bump the nodejs-minor-patch group across 1 directory with 8 updates

[dependabot]

Bumps the nodejs-minor-patch group with 8 updates in the /reference-apps/nodejs directory:

Package	From	To
amqplib	2.0.1	2.2.0
mongodb	7.6.0	7.7.0
mysql2	3.24.2	3.24.5
pg	8.23.0	8.23.1
redis	6.2.1	6.3.0
eslint	10.9.1	10.12.0
jest	30.5.0	30.5.2
supertest	7.2.2	7.3.1

Updates amqplib from 2.0.1 to 2.2.0

Changelog

Sourced from amqplib's changelog.

v2.2.0

• Add calculateDelay recovery option for supplying a custom reconnect delay strategy, e.g. full jitter, decorrelated jitter or a fixed schedule. When set, maxDelay is not applied to its return value; when it throws or returns an invalid value, recovery gives up as if maxRetries were exhausted (fixes #855, thanks @​GiHoon1123)
• The built-in reconnect delay no longer exceeds maxDelay. Previously the cap was applied before jitter, so delays could overshoot it by up to the jitter fraction. The exponential base is now capped at maxDelay / (1 + jitter) so the full jitter range fits under the cap; with default settings the steady-state delay is now spread over 20-30s rather than 24-36s
• Channel operations attempted after recovery has given up (reconnect-failed) now reject with the failure instead of waiting forever
• Add initialMaxRetries recovery option to bound retries before the first successful connection separately from maxRetries, so startup can fail fast while steady-state recovery retries indefinitely (fixes #856)

v2.1.0

• Add waitForConnect recovery option. When false, connect returns the recovering connection immediately instead of waiting for the first successful connection, so listeners for connect, connect-failed and reconnect-scheduled can be attached before the initial attempt, and close() can cancel it. Expose waitForConnect() on recovering connections to await the first connection (fixes #858)
• Fix setup being run when close() is called while the initial connection attempt is in flight

Commits

• bcd72dd 2.2.0
• ced5456 Merge pull request #862 from amqp-node/feat/initial-max-retries
• 0283bba Remove spurious comment
• be9ddbf Add initialMaxRetries recovery option to bound the initial connection separately
• 3f486e6 Merge pull request #857 from GiHoon1123/feat/custom-reconnect-delay-strategy
• 69085d9 Reject channel operations once recovery has given up instead of hanging
• 5ac72e8 Add changelog entries for calculateDelay and the built-in delay cap
• d960972 Give up recovery cleanly when calculateDelay throws or returns an invalid value
• f413b87 Merge branch 'main' into feat/custom-reconnect-delay-strategy
• a6eec24 Stage releases on npm via OIDC trusted publishing instead of a dry-run
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for amqplib since your current version.

Updates mongodb from 7.6.0 to 7.7.0

Release notes

Sourced from mongodb's releases.

v7.7.0

7.7.0 (2026-09-28)

The MongoDB Node.js team is pleased to announce version 7.7.0 of the mongodb package!

Release Notes

OIDC authentication recovers from a failed token fetch

A single failed OIDC token fetch, such as a cloud metadata endpoint timing out, used to leave the driver's token-fetch mutex holding that failure. Every later operation on the affected MongoClient then failed with the original error without attempting a new token fetch, and only restarting the process restored authentication. A failed token fetch now affects only the operation that triggered it.

Driver dependencies updates

Dependency version changes:

• bson: 7.2.0 -> 7.3.2
• mongodb-connection-string-url: 7.0.1 -> 7.0.2
• mongodb-js/saslprep: 1.4.11 -> 1.5.0

Features

• NODE-7670: update dependencies, including next BSON minor (#5034) (995edbf)

Bug Fixes

• NODE-7858: re-arm OIDC callback lock after a rejection (#5056) (7e953ed)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

Changelog

Sourced from mongodb's changelog.

7.7.0 (2026-09-18)

Features

• NODE-7670: update dependencies, including next BSON minor (#5034) (995edbf)

Bug Fixes

• NODE-7858: re-arm OIDC callback lock after a rejection (#5056) (7e953ed)

Commits

• 20b001b chore(main): release 7.7.0 (#5039)
• 7e953ed fix(NODE-7858): re-arm OIDC callback lock after a rejection (#5056)
• 73f4982 test(NODE-7831): widen duration bounds in flaky timing assertions (#5050)
• cca9250 chore(NODE-7856): bump drivers-evergreen-tools submodule to unblock CI (#5055)
• 783d489 chore(NODE-7771): align tags to match their versions on evergreen tasks (#5048)
• af0bcb2 chore(NODE-7691): add optional section into PR template for bug fixes (#5042)
• 83668e6 chore(NODE-7694): Successful lint tasks can precede integration tests as a de...
• 28e455d chore(NODE-7788): remove csot perf tests (#5044)
• dba1544 chore(NODE-7805): restrict release_notes to PRs from this repository (#5043)
• de31f12 chore: bump drivers-evergreen-tools (#5047)
• Additional commits viewable in compare view

Updates mysql2 from 3.24.2 to 3.24.5

Release notes

Sourced from mysql2's releases.

v3.24.5

3.24.5 (2026-09-29)

Bug Fixes

• strip the brackets from an IPv6 host in a connection URI (#4570) (b1c39c8)

v3.24.4

3.24.4 (2026-09-07)

Performance Improvements

• per-query overhead, local dates, short strings, TLS context and compression (#4522) (2387daf)
• reuse TLS sessions across connections to the same server (#4529) (9178c82)

v3.24.3

3.24.3 (2026-09-01)

Bug Fixes

• typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

Changelog

Sourced from mysql2's changelog.

3.24.5 (2026-09-29)

Bug Fixes

• strip the brackets from an IPv6 host in a connection URI (#4570) (b1c39c8)

3.24.4 (2026-09-07)

Performance Improvements

• per-query overhead, local dates, short strings, TLS context and compression (#4522) (2387daf)
• reuse TLS sessions across connections to the same server (#4529) (9178c82)

3.24.3 (2026-09-01)

Bug Fixes

• typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

Commits

• e224afe chore(master): release 3.24.5 (#4577)
• 64ff7cc build(deps-dev): bump @​types/node from 26.6.2 to 26.6.3 (#4578)
• c3f9872 build(deps-dev): bump rollup in the rollup group across 1 directory (#4572)
• 4476371 build(deps-dev): bump prettier in the prettier group across 1 directory (#4571)
• 3fc1b4a build(deps-dev): bump @​types/node from 26.6.2 to 26.6.3 in /website (#4579)
• 6fcd60a build(deps): bump undici from 7.29.0 to 7.30.0 in /website (#4576)
• 1705203 build(deps): bump lucide-react from 1.47.0 to 1.48.0 in /website (#4575)
• e1cb755 build(deps-dev): bump prettier from 3.9.8 to 3.9.9 in /website (#4574)
• 84425a1 build(deps): bump sass from 1.104.1 to 1.105.0 in /website (#4573)
• b1c39c8 fix: strip the brackets from an IPv6 host in a connection URI (#4570)
• Additional commits viewable in compare view

Updates pg from 8.23.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

Commits

• 0980cef Publish
• 2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
• 7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
• 9683053 fix(pg): do not treat Sync as connection ending (#3772)
• 4589038 fix: validate server certificate against host when connecting to an IP addres...
• 9808955 cleanup: Fix typo in comment
• 2b02f64 fix: avoid mutating query config (#3720)
• 0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
• 2991480 Deprecate serializing invalid Dates (#3731)
• c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
• Additional commits viewable in compare view

Updates redis from 6.2.1 to 6.3.0

Commits

• c8ff8cc Release redis@6.3.0
• c3e8b53 Release entraid@6.3.0
• c7f6cb5 Release time-series@6.3.0
• 3843988 Release search@6.3.0
• 6b63940 Release json@6.3.0
• 7b732cd Release bloom@6.3.0
• badfdf0 Release client@6.3.0
• bfdd485 ci: use npm trusted publishing for releases (#3480)
• 0afa8d8 chore(deps): bump brace-expansion (#3485)
• 6ee8ca2 chore(deps): bump ip-address from 10.4.0 to 10.7.2 (#3482)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for redis since your current version.

Updates eslint from 10.9.1 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

... (truncated)

Commits

• a438ec3 10.12.0
• 32a73f1 Build: changelog update for 10.12.0
• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
• 152067f chore: update ecosystem plugins (#21362)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
• 67eb586 docs: Update README
• bfaea12 perf: cache normalized config globals per languageOptions (#21364)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
• d166567 chore: update dependency prettier to v3.9.9 (#21371)
• Additional commits viewable in compare view

Updates jest from 30.5.0 to 30.5.2

Release notes

Sourced from jest's releases.

v30.5.2

Features

• [@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

• [jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)
• [jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)
• [@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

New Contributors

• @​winklemad made their first contribution in jestjs/jest#16345

Full Changelog: jestjs/jest@v30.5.1...v30.5.2

v30.5.1

Fixes

• [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
• [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
• [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
• [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
• [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

• [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

• @​HuzaifaChaudary made their first contribution in jestjs/jest#16413

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

Changelog

Sourced from jest's changelog.

30.5.2

Features

• [@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

• [jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)
• [jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)
• [@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

30.5.1

Fixes

• [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
• [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
• [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
• [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
• [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

• [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

Commits

• 202dd8a v30.5.2
• 9ab14fe v30.5.1
• See full diff in compare view

Updates supertest from 7.2.2 to 7.3.1

Release notes

Sourced from supertest's releases.

v7.3.1

• Merge pull request #907 from JH8459/fix/ephemeral-loopback-bind 884cd26
• fix: bind ephemeral server to the loopback address it connects to e74a1e0

---

forwardemail/supertest@v7.3.0...v7.3.1

v7.3.0

• fix: stabilize ephemeral server requests and assertions 71dc5fb
• Merge pull request #883 from forwardemail/dependabot/npm_and_yarn/multi-acd8535d99 3b5ba5c
• Merge pull request #886 from forwardemail/dependabot/npm_and_yarn/picomatch-2.3.2 c3419b2
• Merge pull request #887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1 7e409db
• Merge pull request #898 from forwardemail/dependabot/npm_and_yarn/brace-expansion-1.1.21 b55a7f9
• Merge pull request #899 from forwardemail/dependabot/npm_and_yarn/browserslist-4.29.0 7a5deaa
• Merge pull request #900 from forwardemail/dependabot/npm_and_yarn/fast-uri-3.1.8 a75f6ee
• Merge pull request #901 from forwardemail/dependabot/npm_and_yarn/js-yaml-3.15.2 c2cb33e
• Merge pull request #896 from pnookala-godaddy/codex/ephemeral-loopback-bind 7fb34e7
• chore(deps-dev): bump js-yaml from 3.14.2 to 3.15.2 c357584
• chore(deps-dev): bump browserslist from 4.25.1 to 4.29.0 2a01b57
• chore(deps-dev): bump fast-uri from 3.0.6 to 3.1.8 343394d
• chore(deps-dev): bump brace-expansion from 1.1.12 to 1.1.21 6b203e9
• Merge pull request #881 from forwardemail/dependabot/npm_and_yarn/qs-6.14.2 d40ca7e
• fix: match ephemeral server address family b6f5995
• chore(deps-dev): bump lodash from 4.17.21 to 4.18.1 81766ca
• chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 985ac7c
• chore(deps): bump minimatch 58baa5f
• chore(deps): bump qs from 6.14.1 to 6.14.2 c406e82

---

forwardemail/supertest@v7.2.2...v7.3.0

Commits

• 3634bdd 7.3.1
• 884cd26 Merge pull request #907 from JH8459/fix/ephemeral-loopback-bind
• e74a1e0 fix: bind ephemeral server to the loopback address it connects to
• a3f5cb8 7.3.0
• 71dc5fb fix: stabilize ephemeral server requests and assertions
• 3b5ba5c Merge pull request #883 from forwardemail/dependabot/npm_and_yarn/multi-acd85...
• c3419b2 Merge pull request #886 from forwardemail/dependabot/npm_and_yarn/picomatch-2...
• 7e409db Merge pull request #887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1
• b55a7f9 Merge pull request #898 from forwardemail/dependabot/npm_and_yarn/brace-expan...
• 7a5deaa Merge pull request #899 from forwardemail/dependabot/npm_and_yarn/browserslis...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions