Skip to content

chore(deps): Bump the npm_and_yarn group across 2 directories with 25 updates#22

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-1186972e08
Open

chore(deps): Bump the npm_and_yarn group across 2 directories with 25 updates#22
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-1186972e08

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 1, 2026

Bumps the npm_and_yarn group with 24 updates in the / directory:

Package From To
react-router 6.30.1 6.30.2
@backstage/backend-defaults 0.13.0 0.16.0
@backstage/plugin-auth-backend 0.25.5 0.27.1
@backstage/plugin-scaffolder-backend 3.0.0 3.1.5
@backstage/cli-common 0.1.15 0.1.18
@backstage/integration 1.18.1 1.20.1
@backstage/plugin-techdocs-node 1.13.8 1.14.4
@smithy/config-resolver 4.1.4 4.4.13
@xmldom/xmldom 0.8.10 0.8.12
axios 1.10.0 1.14.0
basic-ftp 5.0.5 5.2.0
diff 4.0.2 4.0.4
fast-xml-parser 4.5.3 4.5.5
handlebars 4.7.8 4.7.9
immutable 3.8.2 3.8.3
js-yaml 3.14.1 3.14.2
jsonpath 1.1.1 1.3.0
jws 3.2.2 3.2.3
multer 2.0.2 2.1.1
node-forge 1.3.1 1.4.0
picomatch 2.3.1 2.3.2
rollup 4.45.1 4.60.1
svgo 2.8.0 2.8.2
yauzl 3.2.0 3.3.0

Bumps the npm_and_yarn group with 2 updates in the /packages/backend directory: @backstage/backend-defaults and @backstage/plugin-auth-backend.

Updates react-router from 6.30.1 to 6.30.2

Release notes

Sourced from react-router's releases.

v6.30.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6302

Changelog

Sourced from react-router's changelog.

v6.30.2

Date: 2025-11-13

Security Notice

This release addresses 1 security vulnerability:

Patch Changes

  • Normalize double-slashes in resolvePath (#14537)

Full Changelog: v6.30.1...v6.30.2

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for react-router since your current version.


Updates @backstage/backend-defaults from 0.13.0 to 0.16.0

Changelog

Sourced from @​backstage/backend-defaults's changelog.

0.16.0

Minor Changes

  • 42960f1: The actions registry invoke endpoint now accepts direct user credentials in addition to service principals, enabling CLI and other direct user clients to invoke actions.
  • 0e7d8f9: The scheduler service now uses the metrics service to create metrics, providing plugin-scoped attribution.
  • 527cf88: BREAKING Removed deprecated BitbucketUrlReader. Use the BitbucketCloudUrlReader or the BitbucketServerUrlReader instead.

Patch Changes

  • cc8348e: Added permissions integration to the actions registry. Actions registered with a visibilityPermission field are now checked against the permissions framework when listing and invoking. Denied actions are filtered from list results, and invoking a denied action returns a 404 Not Found as if the action does not exist. Permissions are automatically registered with the PermissionsRegistryService so they appear in the permission policy system.
  • dee4283: Added pluginId field to ActionsServiceAction type, populated from the registering plugin's metadata.
  • 015668c: Added cancelTask method to the SchedulerService interface and implementation, allowing cancellation of currently running scheduled tasks. For global tasks, the database lock is released and a periodic liveness check aborts the running task function. For local tasks, the task's abort signal is triggered directly. A new POST /.backstage/scheduler/v1/tasks/:id/cancel endpoint is also available.
  • 638e6c7: chore(deps): bump yauzl from 3.2.0 to 3.2.1
  • 6738cf0: build(deps): bump minimatch from 9.0.5 to 10.2.1
  • 62f0a53: Fixed error forwarding in the actions registry so that known errors like InputError and NotFoundError thrown by actions preserve their original status codes and messages instead of being wrapped in ForwardedError and coerced to 500.
  • d933f62: Add configurable throttling and retry mechanism for GitLab integration.
  • b99158a: Fixed yarn backstage-cli config:check --strict --config app-config.yaml config validation error by adding an optional default type discriminator to PostgreSQL connection configuration, allowing config:check to properly validate default connection configurations.
  • 1ee5b28: Adds an alpha MetricsService to provide a unified interface for metrics instrumentation across Backstage plugins.
  • 5fcbef2: Updated dependency express-rate-limit to ^8.0.0.
  • a49a40d: Updated dependency zod to ^3.25.76 || ^4.0.0 & migrated to /v3 or /v4 imports.
  • Updated dependencies
    • @​backstage/backend-plugin-api@​1.8.0
    • @​backstage/cli-node@​0.3.0
    • @​backstage/integration@​2.0.0
    • @​backstage/config-loader@​1.10.9
    • @​backstage/plugin-permission-common@​0.9.7
    • @​backstage/plugin-permission-node@​0.10.11
    • @​backstage/plugin-auth-node@​0.6.14
    • @​backstage/backend-app-api@​1.6.0
    • @​backstage/plugin-events-node@​0.4.20

0.16.0-next.2

Patch Changes

  • 015668c: Added cancelTask method to the SchedulerService interface and implementation, allowing cancellation of currently running scheduled tasks. For global tasks, the database lock is released and a periodic liveness check aborts the running task function. For local tasks, the task's abort signal is triggered directly. A new POST /.backstage/scheduler/v1/tasks/:id/cancel endpoint is also available.
  • 5fcbef2: Updated dependency express-rate-limit to ^8.0.0.
  • Updated dependencies
    • @​backstage/backend-plugin-api@​1.8.0-next.1
    • @​backstage/integration@​2.0.0-next.2
    • @​backstage/backend-app-api@​1.6.0-next.1
    • @​backstage/plugin-auth-node@​0.6.14-next.2
    • @​backstage/plugin-events-node@​0.4.20-next.1
    • @​backstage/plugin-permission-node@​0.10.11-next.1

0.16.0-next.1

... (truncated)

Commits

Updates @backstage/plugin-auth-backend from 0.25.5 to 0.27.1

Changelog

Sourced from @​backstage/plugin-auth-backend's changelog.

@​backstage/plugin-auth-backend

0.28.0-next.1

Patch Changes

  • Updated dependencies
    • @​backstage/backend-plugin-api@​1.9.0-next.1
    • @​backstage/plugin-auth-node@​0.7.0-next.1
    • @​backstage/plugin-catalog-node@​2.1.1-next.1

0.28.0-next.0

Minor Changes

  • d7c67cd: BREAKING: The setting auth.omitIdentityTokenOwnershipClaim has had its default value switched to true.

    With this setting Backstage user tokens issued by the auth backend will no longer contain an ent claim - the one with the user's ownership entity refs. This means that tokens issued in large orgs no longer risk hitting HTTP header size limits.

    To get ownership info for the current user, code should use the userInfo core service. In practice code will typically already conform to this since the ent claim has not been readily exposed in any other way for quite some time. But code which explicitly decodes Backstage tokens - which is strongly discouraged - may be affected by this change.

    The setting will remain for some time to allow it to be set back to false if need be, but it will be removed entirely in a future release.

Patch Changes

  • dc87ac1: Fixed CIMD redirect URI matching to allow any port for localhost addresses per RFC 8252 Section 7.3. Native CLI clients use ephemeral ports for OAuth callbacks, which are now accepted when the registered redirect URI uses a localhost address.
  • Updated dependencies
    • @​backstage/backend-plugin-api@​1.8.1-next.0
    • @​backstage/plugin-auth-node@​0.6.15-next.0
    • @​backstage/plugin-catalog-node@​2.1.1-next.0
    • @​backstage/catalog-model@​1.7.7
    • @​backstage/config@​1.3.6
    • @​backstage/errors@​1.2.7
    • @​backstage/types@​1.2.2

0.27.2

Patch Changes

  • 1ccad86: Added who-am-i action to the auth backend actions registry. Returns the catalog entity and user info for the currently authenticated user.
  • d0f4cd2: Added optional client metadata document endpoint at /.well-known/oauth-client/cli.json relative to the auth backend base URL for CLI authentication. Enabled when auth.experimentalClientIdMetadataDocuments.enabled is set to true.
  • 6738cf0: build(deps): bump minimatch from 9.0.5 to 10.2.1
  • e9b6e97: Fixed a security vulnerability where the CIMD metadata fetch could follow HTTP redirects to internal hosts, bypassing SSRF protections.
  • 0f9d673: Improved redirect URI validation in the experimental OIDC provider to match against normalized URLs rather than raw strings.
  • a49a40d: Updated dependency zod to ^3.25.76 || ^4.0.0 & migrated to /v3 or /v4 imports.
  • 634eded: Fixed a foreign key constraint violation when issuing refresh tokens for CIMD clients, and prevented a failed refresh token issuance from failing the entire token exchange. Fixed AWS ALB auth provider incorrectly returning HTTP 500 instead of 401 for JWT validation failures, which caused retry loops and memory pressure under load.
  • 619be54: Update migrations to be reversible

... (truncated)

Commits

Updates @backstage/plugin-scaffolder-backend from 3.0.0 to 3.1.5

Changelog

Sourced from @​backstage/plugin-scaffolder-backend's changelog.

@​backstage/plugin-scaffolder-backend

3.3.0-next.1

Minor Changes

  • 309b712: Added a new execute-template actions registry action that executes a scaffolder template with provided input values and returns a task ID for tracking progress.

Patch Changes

  • 4559806: Removed unnecessary empty examples array from actions bridged via the actions registry.
  • Updated dependencies
    • @​backstage/backend-plugin-api@​1.9.0-next.1
    • @​backstage/backend-openapi-utils@​0.6.8-next.1
    • @​backstage/plugin-catalog-node@​2.1.1-next.1
    • @​backstage/plugin-events-node@​0.4.21-next.1
    • @​backstage/plugin-permission-node@​0.10.12-next.1
    • @​backstage/plugin-scaffolder-node@​0.13.1-next.1

3.2.1-next.0

Patch Changes

  • 79453c0: Updated dependency wait-for-expect to ^4.0.0.
  • Updated dependencies
    • @​backstage/backend-plugin-api@​1.8.1-next.0
    • @​backstage/plugin-permission-node@​0.10.12-next.0
    • @​backstage/backend-openapi-utils@​0.6.8-next.0
    • @​backstage/plugin-catalog-node@​2.1.1-next.0
    • @​backstage/plugin-events-node@​0.4.21-next.0
    • @​backstage/plugin-scaffolder-node@​0.13.1-next.0
    • @​backstage/catalog-model@​1.7.7
    • @​backstage/config@​1.3.6
    • @​backstage/errors@​1.2.7
    • @​backstage/integration@​2.0.0
    • @​backstage/types@​1.2.2
    • @​backstage/plugin-permission-common@​0.9.7
    • @​backstage/plugin-scaffolder-common@​2.0.0

3.2.0

Minor Changes

  • c9b11eb: Added a new list-scaffolder-tasks action that allows querying scaffolder tasks with optional ownership filtering and pagination support
  • 1b42218: Adds a new get-scaffolder-task-logs action to @backstage/plugin-scaffolder-backend that retrieves log events for a given scaffolder task, with optional support for retrieving only new events after a given event ID.
  • 0fbcf23: Migrated OpenAPI schemas to 3.1.
  • 7695dd2: Added a new list-scaffolder-actions action that returns all installed scaffolder actions with their schemas and examples
  • e8736ea: Added secrets schema validation for task creation, retry, and dry-run endpoints. When a template defines spec.secrets.schema, the API validates provided secrets against the schema and returns a 400 error if validation fails.

Patch Changes

... (truncated)

Commits

Updates @backstage/cli-common from 0.1.15 to 0.1.18

Changelog

Sourced from @​backstage/cli-common's changelog.

0.1.18

Patch Changes

  • 7455dae: Use node prefix on native imports

0.1.18-next.0

Patch Changes

  • 7455dae: Use node prefix on native imports
  • Updated dependencies
    • @​backstage/errors@​1.2.7

0.1.17

Patch Changes

  • ae4dd5d: Move some of the symlink resolution to isChildPath

0.1.16

Patch Changes

  • 5cfb2a4: Added new run, runOutput, and runCheck utilities to help run child processes in a safe and portable way.
  • c8c2329: Add proxy configuration from env-vars to create-app tasks
  • 2bae83a: Bumped dev dependencies @types/node

0.1.16-next.2

Patch Changes

  • 2bae83a: Bumped dev dependencies @types/node
  • Updated dependencies
    • @​backstage/errors@​1.2.7

0.1.16-next.1

Patch Changes

  • 5cfb2a4: Added new run, runOutput, and runCheck utilities to help run child processes in a safe and portable way.

0.1.16-next.0

Patch Changes

  • c8c2329: Add proxy configuration from env-vars to create-app tasks
Commits

Updates @backstage/integration from 1.18.1 to 1.20.1

Changelog

Sourced from @​backstage/integration's changelog.

@​backstage/integration

2.0.0

Major Changes

  • 527cf88: BREAKING Removed deprecated Azure DevOps, Bitbucket, Gerrit and GitHub code:

    • For Azure DevOps, the long deprecated token string and credential object have been removed from the config.d.ts. Use the credentials array object instead.
    • For Bitbucket, the long deprecated bitbucket object has been removed from the config.d.ts. Use the bitbucketCloud or bitbucketServer objects instead.
    • For Gerrit, the parseGerritGitilesUrl function has been removed, use parseGitilesUrlRef instead. The buildGerritGitilesArchiveUrl function has also been removed, use buildGerritGitilesArchiveUrlFromLocation instead.
    • For GitHub, the getGitHubRequestOptions function has been removed.

Minor Changes

  • d933f62: Add configurable throttling and retry mechanism for GitLab integration.

Patch Changes

  • 1513a0b: Fixed a security vulnerability where path traversal sequences in SCM URLs could be used to access unintended API endpoints using server-side integration credentials.
  • 993a598: Fixed Azure integration config schema visibility annotations to use per-field @visibility secret instead of @deepVisibility secret on parent objects, so that non-secret fields like clientId, tenantId, organizations, and managedIdentityClientId are no longer incorrectly marked as secret.

2.0.0-next.2

Patch Changes

  • 1513a0b: Fixed a security vulnerability where path traversal sequences in SCM URLs could be used to access unintended API endpoints using server-side integration credentials.

2.0.0-next.1

Major Changes

  • 527cf88: BREAKING Removed deprecated Azure DevOps, Bitbucket, Gerrit and GitHub code:

    • For Azure DevOps, the long deprecated token string and credential object have been removed from the config.d.ts. Use the credentials array object instead.
    • For Bitbucket, the long deprecated bitbucket object has been removed from the config.d.ts. Use the bitbucketCloud or bitbucketServer objects instead.
    • For Gerrit, the parseGerritGitilesUrl function has been removed, use parseGitilesUrlRef instead. The buildGerritGitilesArchiveUrl function has also been removed, use buildGerritGitilesArchiveUrlFromLocation instead.
    • For GitHub, the getGitHubRequestOptions function has been removed.

Patch Changes

  • 993a598: Fixed Azure integration config schema visibility annotations to use per-field @visibility secret instead of @deepVisibility secret on parent objects, so that non-secret fields like clientId, tenantId, organizations, and managedIdentityClientId are no longer incorrectly marked as secret.
  • Updated dependencies
    • @​backstage/config@​1.3.6
    • @​backstage/errors@​1.2.7

1.21.0-next.0

Minor Changes

... (truncated)

Commits
  • c8a8aac Version Packages
  • 4aa43f6 chore(deps): update dependency cross-fetch to v4
  • f577e11 Version Packages (next)
  • 11153a0 Merge remote-tracking branch 'upstream/master' into entra-rename
  • ad7d38c fix tests
  • 243c655 Updated Azure Active Directory to Entra ID
  • 8cdb8c2 Version Packages
  • e43d3eb Version Packages (next)
  • 0b55f77 Removed some unused dependencies
  • bea3617 Version Packages (next)
  • Additional commits viewable in compare view

Updates @backstage/plugin-techdocs-node from 1.13.8 to 1.14.4

Changelog

Sourced from @​backstage/plugin-techdocs-node's changelog.

1.14.4

Patch Changes

  • cb7c6b1: Added techdocs.generator.mkdocs.dangerouslyAllowAdditionalKeys configuration option to explicitly bypass MkDocs configuration key restrictions. This enables support for additional MkDocs configuration keys beyond the default safe allow list, such as the hooks key which some MkDocs plugins require.
  • e96f6d9: Removed INHERIT from the ALLOWED_MKDOCS_KEYS set to address a security concern with MkDocs configuration inheritance.
  • Updated dependencies
    • @​backstage/backend-plugin-api@​1.8.0
    • @​backstage/integration@​2.0.0
    • @​backstage/catalog-model@​1.7.7

1.14.4-next.2

Patch Changes

  • e96f6d9: Removed INHERIT from the ALLOWED_MKDOCS_KEYS set to address a security concern with MkDocs configuration inheritance.
  • Updated dependencies
    • @​backstage/backend-plugin-api@​1.8.0-next.1
    • @​backstage/integration@​2.0.0-next.2

1.14.3-next.1

Patch Changes

  • cb7c6b1: Added techdocs.generator.mkdocs.dangerouslyAllowAdditionalKeys configuration option to explicitly bypass MkDocs configuration key restrictions. This enables support for additional MkDocs configuration keys beyond the default safe allow list, such as the hooks key which some MkDocs plugins require.
  • Updated dependencies
    • @​backstage/integration@​2.0.0-next.1
    • @​backstage/backend-plugin-api@​1.7.1-next.0
    • @​backstage/catalog-model@​1.7.6
    • @​backstage/config@​1.3.6
    • @​backstage/errors@​1.2.7
    • @​backstage/integration-aws-node@​0.1.20
    • @​backstage/plugin-search-common@​1.2.22
    • @​backstage/plugin-techdocs-common@​0.1.1

1.14.3-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/integration@​1.21.0-next.0
    • @​backstage/backend-plugin-api@​1.7.1-next.0
    • @​backstage/catalog-model@​1.7.6
    • @​backstage/config@​1.3.6
    • @​backstage/errors@​1.2.7
    • @​backstage/integration-aws-node@​0.1.20
    • @​backstage/plugin-search-common@​1.2.22
    • @​backstage/plugin-techdocs-common@​0.1.1

1.14.2

... (truncated)

Commits

Updates @smithy/config-resolver from 4.1.4 to 4.4.13

Release notes

Sourced from @​smithy/config-resolver's releases.

@​smithy/config-resolver@​4.4.13

Patch Changes

  • b1f0dba: fix(middleware-endpoint): update type of useDualStackEndpoint/useFipsEndpoint input config fix(config-resolver): add alternate values for NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS and NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS

@​smithy/config-resolver@​4.4.12

Patch Changes

  • 4b5602d: fix: update default value to undefined for dualstack/fips config
Changelog

Sourced from @​smithy/config-resolver's changelog.

4.4.13

Patch Changes

  • b1f0dba: fix(middleware-endpoint): update type of useDualStackEndpoint/useFipsEndpoint input config fix(config-resolver): add alternate values for NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS and NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS

4.4.12

Patch Changes

  • 4b5602d: fix: update default value to undefined for dualstack/fips config

4.4.11

Patch Changes

  • Updated dependencies [5340b11]
    • @​smithy/types@​4.13.1
    • @​smithy/node-config-provider@​4.3.12
    • @​smithy/util-endpoints@​3.3.3
    • @​smithy/util-middleware@​4.2.12

4.4.10

Patch Changes

  • a4d95e6: Set downlevel types to be used in typescript@'<4.5'
  • Updated dependencies [a4d95e6]
    • @​smithy/node-config-provider@​4.3.11
    • @​smithy/util-config-provider@​4.2.2
    • @​smithy/util-middleware@​4.2.11
    • @​smithy/util-endpoints@​3.3.2

4.4.9

Patch Changes

  • Updated dependencies [d0954cc]
    • @​smithy/types@​4.13.0
    • @​smithy/node-config-provider@​4.3.10
    • @​smithy/util-endpoints@​3.3.1
    • @​smithy/util-middleware@​4.2.10

4.4.8

Patch Changes

  • Updated dependencies [2bf677c]
    • @​smithy/util-endpoints@​3.3.0

... (truncated)

Commits
  • 9328be2 Version NPM packages
  • b1f0dba fix(config-resolver): add new config selectors (#1927)
  • e3a0f6f Version NPM packages
  • 4b5602d fix(config-resolver): update default value to undefined for dualstack/FIPS co...
  • 0bdca15 Version NPM packages
  • 5eab7ea Version NPM packages
  • a4d95e6 fix: set downlevel types to be used in typescript@'<4.5' (#1906)
  • 2acebec Version NPM packages
  • 06793cc Version NPM packages
  • 1f51a0c Version NPM packages
  • Additional commits viewable in compare view

Updates @xmldom/xmldom from 0.8.10 to 0.8.12

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.12

Commits

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

xmldom/xmldom#357

0.8.11

0.8.11

Fixed

Thank you, @​shunkica, for your contributions

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.12

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

0.8.11

Fixed

Thank you, @​shunkica, for your contributions

0.9.8

Fixed

Chore

Thank you, @​kboshold, @​Ponynjaa, for your contributions.

0.9.7

Added

Fixed

... (truncated)

Commits
  • 189cb78 0.8.12
  • ed08df7 fix: XML injection via unsafe CDATA serialization (GHSA-wh4c-j3r5-mjhp) (#968)
  • a5b929b chore: clean up generated test artefacts before running ci-local
  • 4e37a20 ci: run format:check in lint job
  • ac0ac77 chore: ignore generated files when checking formatting
  • 968c893 chore: add local CI script and format:check script
  • ac40424 fix: preserve trailing whitespace in ProcessingInstruction data (#962)
  • cece752 chore: add .nvmrc pointing to node version 18
  • cbf44d9 docs: improve links to changes in most recent release
  • c0f1401 0.8.11
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.


Updates axios from 1.10.0 to 1.14.0

Release notes

Sourced from axios's releases.

v1.14.0

This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.

⚠️ Important Changes

  • Breaking Changes: None identified in this release.
  • Action Required: If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably proxy-from-env v2 alignment and main entry compatibility fix).

🚀 New Features

  • Runtime Features: No new end-user features were introduced in this release.
  • Test Coverage Expansion: Added broader smoke/module test coverage for CJS and ESM package usage. (#7510)

🐛 Bug Fixes

  • Headers: Trim trailing CRLF in normalised header values. (#7456)
  • HTTP/2: Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (#7457)
  • Fetch Adapter: Cancel ReadableStream created during request-stream capability probing to prevent async resource leaks. (#7515)
  • Proxy Handling: Fixed env proxy behavior with proxy-from-env v2 usage. (#7499)
  • CommonJS Compatibility: Fixed package main entry regression affecting CJS consumers. (#7532)

🔧 Maintenance & Chores

  • Security/Dependencies: Updated formidable and refreshed package set to newer versions. (#7533, #10556)
  • Tooling: Continued migration to Vitest and modernised CI/test harnesses. (#7484, #7489, #7498)
  • Build/Lint Stack: Rollup, ESLint, TypeScript, and related dev-dependency updates. (#7508, #7509, #7522)
  • Documentation: Clarified JSON parsing and adapter-related docs/comments. (#7398, #7460, #7478)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

Full Changelog: v1.13.6...v1.14.0

v1.13.6

This release focuses on platform compatibility, error handling improvements, and code quality maintenance.

⚠️ Important Changes

  • Breaking Changes: None identified in this release.
  • Action Required: Users targeting React Native should verify their integration, particularly if relying on specific Blob or FormData behaviours, as improvements have been made to support these objects.

🚀 New Features

  • React Native Blob Support: Axios now includes support for React Native Blob objects. Thanks to @​moh3n9595 for the initial implementation. (#5764)
  • Code Quality: Implemented prettier across the codebase and resolved associated formatting issues. (#7385)

🐛 Bug Fixes

  • Environment Compatibility:
    • Fixed module exports for React Native and Browserify environments. (#7386)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

  • http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
  • interceptor: handle the error in the same interceptor (#6269) (5945e40)
  • main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
  • package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
  • silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
  • turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
  • types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
  • types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
  • unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

Reverts

  • Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
  • deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates basic-ftp from 5.0.5 to 5.2.0

Release notes

Sourced from basic-ftp's releases.

5.2.0

  • Changed: Skip files with invalid name in downloadToDir.

5.1.0

  • Added: Add the option to prevent the use of separate transfer host IPs when using PASV. (

@dependabot
chore(deps): Bump the npm_and_yarn group across 2 directories with 25…
be7f8b8 
… updates

Bumps the npm_and_yarn group with 24 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `6.30.1` | `6.30.2` |
| [@backstage/backend-defaults](https://github.com/backstage/backstage/tree/HEAD/packages/backend-defaults) | `0.13.0` | `0.16.0` |
| [@backstage/plugin-auth-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/auth-backend) | `0.25.5` | `0.27.1` |
| [@backstage/plugin-scaffolder-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/scaffolder-backend) | `3.0.0` | `3.1.5` |
| [@backstage/cli-common](https://github.com/backstage/backstage/tree/HEAD/packages/cli-common) | `0.1.15` | `0.1.18` |
| [@backstage/integration](https://github.com/backstage/backstage/tree/HEAD/packages/integration) | `1.18.1` | `1.20.1` |
| [@backstage/plugin-techdocs-node](https://github.com/backstage/backstage/tree/HEAD/plugins/techdocs-node) | `1.13.8` | `1.14.4` |
| [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver) | `4.1.4` | `4.4.13` |
| [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.8.10` | `0.8.12` |
| [axios](https://github.com/axios/axios) | `1.10.0` | `1.14.0` |
| [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.0.5` | `5.2.0` |
| [diff](https://github.com/kpdecker/jsdiff) | `4.0.2` | `4.0.4` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `4.5.3` | `4.5.5` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` |
| [immutable](https://github.com/immutable-js/immutable-js) | `3.8.2` | `3.8.3` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` |
| [jsonpath](https://github.com/dchester/jsonpath) | `1.1.1` | `1.3.0` |
| [jws](https://github.com/brianloveswords/node-jws) | `3.2.2` | `3.2.3` |
| [multer](https://github.com/expressjs/multer) | `2.0.2` | `2.1.1` |
| [node-forge](https://github.com/digitalbazaar/forge) | `1.3.1` | `1.4.0` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [rollup](https://github.com/rollup/rollup) | `4.45.1` | `4.60.1` |
| [svgo](https://github.com/svg/svgo) | `2.8.0` | `2.8.2` |
| [yauzl](https://github.com/thejoshwolfe/yauzl) | `3.2.0` | `3.3.0` |

Bumps the npm_and_yarn group with 2 updates in the /packages/backend directory: [@backstage/backend-defaults](https://github.com/backstage/backstage/tree/HEAD/packages/backend-defaults) and [@backstage/plugin-auth-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/auth-backend).


Updates `react-router` from 6.30.1 to 6.30.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@6.30.2/packages/react-router)

Updates `@backstage/backend-defaults` from 0.13.0 to 0.16.0
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/backend-defaults/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/v0.16.0/packages/backend-defaults)

Updates `@backstage/plugin-auth-backend` from 0.25.5 to 0.27.1
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/plugins/auth-backend/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/auth-backend)

Updates `@backstage/plugin-scaffolder-backend` from 3.0.0 to 3.1.5
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/plugins/scaffolder-backend/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/scaffolder-backend)

Updates `@backstage/cli-common` from 0.1.15 to 0.1.18
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/cli-common/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/cli-common)

Updates `@backstage/integration` from 1.18.1 to 1.20.1
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/integration/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/v1.20.1/packages/integration)

Updates `@backstage/plugin-techdocs-node` from 1.13.8 to 1.14.4
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/plugins/techdocs-node/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/techdocs-node)

Updates `@smithy/config-resolver` from 4.1.4 to 4.4.13
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/config-resolver/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@4.4.13/packages/config-resolver)

Updates `@xmldom/xmldom` from 0.8.10 to 0.8.12
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.8.10...0.8.12)

Updates `axios` from 1.10.0 to 1.14.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.10.0...v1.14.0)

Updates `basic-ftp` from 5.0.5 to 5.2.0
- [Release notes](https://github.com/patrickjuchli/basic-ftp/releases)
- [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md)
- [Commits](patrickjuchli/basic-ftp@v5.0.5...v5.2.0)

Updates `diff` from 4.0.2 to 4.0.4
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v4.0.2...v4.0.4)

Updates `fast-xml-parser` from 4.5.3 to 4.5.5
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.5.3...v4.5.5)

Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

Updates `immutable` from 3.8.2 to 3.8.3
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v3.8.2...v3.8.3)

Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)

Updates `jsonpath` from 1.1.1 to 1.3.0
- [Commits](https://github.com/dchester/jsonpath/commits)

Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)

Updates `multer` from 2.0.2 to 2.1.1
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.0.2...v2.1.1)

Updates `node-forge` from 1.3.1 to 1.4.0
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.3.1...v1.4.0)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `rollup` from 4.45.1 to 4.60.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.45.1...v4.60.1)

Updates `svgo` from 2.8.0 to 2.8.2
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v2.8.0...v2.8.2)

Updates `underscore` from 1.12.1 to 1.13.6
- [Commits](jashkenas/underscore@1.12.1...1.13.6)

Updates `yauzl` from 3.2.0 to 3.3.0
- [Commits](thejoshwolfe/yauzl@3.2.0...3.3.0)

Updates `@backstage/backend-defaults` from 0.13.2 to 0.16.0
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/backend-defaults/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/v0.16.0/packages/backend-defaults)

Updates `@backstage/plugin-auth-backend` from 0.25.7 to 0.27.3
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/plugins/auth-backend/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/auth-backend)

---
updated-dependencies:
- dependency-name: react-router
  dependency-version: 6.30.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/backend-defaults"
  dependency-version: 0.16.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/plugin-auth-backend"
  dependency-version: 0.27.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/plugin-scaffolder-backend"
  dependency-version: 3.1.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/cli-common"
  dependency-version: 0.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/integration"
  dependency-version: 1.20.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/plugin-techdocs-node"
  dependency-version: 1.14.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@smithy/config-resolver"
  dependency-version: 4.4.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.14.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: basic-ftp
  dependency-version: 5.2.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 4.5.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 3.8.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jsonpath
  dependency-version: 1.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jws
  dependency-version: 3.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: multer
  dependency-version: 2.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-forge
  dependency-version: 1.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.60.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 2.8.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: underscore
  dependency-version: 1.13.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yauzl
  dependency-version: 3.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/backend-defaults"
  dependency-version: 0.16.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/plugin-auth-backend"
  dependency-version: 0.27.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 1, 2026
@dependabot dependabot bot mentioned this pull request Apr 1, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants