Skip to content

chore(deps): bump the production group with 6 updates - #1357

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-ef1e8a4761
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-ef1e8a4761

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the production group with 6 updates:

Package From To
@css-inline/css-inline 0.23.1 0.23.2
tslib 2.8.1 2.9.1
@nestjs/common 12.2.0 12.3.2
@nestjs/core 12.2.0 12.3.2
nodemailer 10.2.1 10.3.1
@nestjs/platform-express 12.2.0 12.3.2

Updates @css-inline/css-inline from 0.23.1 to 0.23.2

Release notes

Sourced from @​css-inline/css-inline's releases.

[JavaScript] Release 0.23.2

Performance

  • Find top-level commas in selector lists with a fast scan for the common case.
  • Look up elements by a hash of their ID, class, or tag name instead of interning it.
  • Avoid a reallocation and two attribute copies per element while building the document tree.
  • Return the output buffer from inline and inline_fragment without copying it.
  • Build the remaining <style> content for remove_inlined_selectors without intermediate copies.
  • Skip selectors with pseudo-classes that never match during inlining, such as :hover, before matching them.
  • Skip a redundant UTF-8 validation pass over the input HTML.
  • Use an index of attribute names for attribute selectors instead of checking every element.
  • Check only the root element for selectors ending in :root.
  • Skip selectors whose classes, IDs, or tags are missing from the document anywhere in the selector, not only in its leftmost part.
  • Check all classes and IDs of a selector against the document before compiling it, not after.
  • Escape text by scanning bytes instead of decoding characters.
  • Skip candidates of selectors like .a .b or #x > p when no ancestor has the required names, on documents of 1 KB or more.

Fixed

  • !important not recognised when written in uppercase or with whitespace or comments after !.
  • Only the last element with a duplicated id being styled in documents of 1 KB or more.
  • Uppercase or mixed-case type selectors (e.g. H1) not matching HTML elements in documents of 1 KB or more.
  • Class selectors with non-breaking spaces or other non-CSS whitespace in class not matching in documents of 1 KB or more.
  • Selector lists being split on commas inside :not(), attribute values, or strings, so a part of a selector could match on its own.
  • Attributes from repeated <html> or <body> tags being dropped, and existing ones duplicated.
  • Selectors starting with a class, ID, or tag that contains escapes or non-ASCII characters not matching in documents of 1 KB or more.
  • At-rules written twice when keep_at_rules is combined with remove_inlined_selectors or keep_style_tags.
  • Attribute selectors on class ([class], [class*=...], etc.) never matching.
Changelog

Sourced from @​css-inline/css-inline's changelog.

Changelog

[Unreleased]

Commits

Updates tslib from 2.8.1 to 2.9.1

Release notes

Sourced from tslib's releases.

tslib 2.9.1

What's Changed

Full Changelog: microsoft/tslib@v2.8.1...v2.9.1

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for tslib since your current version.


Updates @nestjs/common from 12.2.0 to 12.3.2

Release notes

Sourced from @​nestjs/common's releases.

v12.3.0 (2026-10-27)

Features

Bug fixes

... (truncated)

Commits
  • a415cff chore(release): publish v12.3.2 release
  • 9576609 chore(release): publish v12.3.1 release
  • 3acb8e5 chore(release): publish v12.3.0 release
  • f991703 fix(common): report the detected file type in file type errors (#18289)
  • 6aafca1 fix(ws,microservices): load packages where bundlers can see them (#18285)
  • ff84deb fix(common): keep one route param per argument in an overriding method (#18272)
  • 2811325 fix(deps): update dependency file-type to v22.2.0 (#18257)
  • 9a95605 fix(common): avoid throwing for arrow prototype constructors (#18246)
  • 6c6ba7c fix(common): abort the response when a streamable file fails midway (#18220)
  • See full diff in compare view

Updates @nestjs/core from 12.2.0 to 12.3.2

Release notes

Sourced from @​nestjs/core's releases.

v12.3.0 (2026-10-27)

Features

Bug fixes

... (truncated)

Commits
  • a415cff chore(release): publish v12.3.2 release
  • 9576609 chore(release): publish v12.3.1 release
  • 3acb8e5 chore(release): publish v12.3.0 release
  • 10adb73 fix(core): check the sse pending data limit after each write
  • f640806 fix(core): run middleware once for routes that differ only in version (#18276)
  • 3e2309e fix(core): tolerate sse request sockets without tuning methods (#18262)
  • 0fb57c8 fix(core,express,fastify,ws,socket.io): load adapters with an older core (#18...
  • 135f999 fix(core): read the url protocol from the server (#18252)
  • 79b57f9 fix(core): name the array and index of undefined module entries (#18254)
  • e065e23 fix(core): discover classes by each of their discovery decorators (#18235)
  • Additional commits viewable in compare view

Updates nodemailer from 10.2.1 to 10.3.1

Release notes

Sourced from nodemailer's releases.

v10.3.1

10.3.1 (2026-10-29)

Bug Fixes

  • apply the otp option in MailComposer too (1d4087f)

v10.3.0

10.3.0 (2026-10-29)

Summary

This release adds support for the OTP-Token header from the IETF draft draft-goto-otp-token, which lets mail clients and browsers offer a one-time passcode for autofill on the site it belongs to. It also fixes how a Content-ID header is encoded.

Who should upgrade

  • Anyone sending one-time passcodes by email who wants them to be machine-readable.
  • Anyone already setting an OTP-Token header through headers: before this release it went out MIME encoded and could not be parsed.
  • Anyone embedding images with a cid that holds a non-ASCII character or a quote.

Highlights

  • New otp message option: otp: { code: '123456', origin: 'https://example.com' } adds OTP-Token: "123456"; origin="https://example.com". The origin is reduced to its canonical form, only https (or http on a loopback host) is accepted, and invalid values fail the send with the new EOTP error code. See Message configuration.
  • A custom OTP-Token header is no longer MIME word encoded. Line breaks and control characters are still removed.
  • OTP-Token is included in the DKIM signature by default.
  • A Content-ID header, from an attachment cid or set through headers, is now encoded as a message id rather than as text, so a cid with a non-ASCII character or a quote keeps matching the cid: URL in the HTML.
  • Groundmail added to the well-known services.

Features

  • add the otp option for the OTP-Token header (7789e15)

Bug Fixes

  • encode a Content-ID header as a message id (#1904) (47f2b25)
Changelog

Sourced from nodemailer's changelog.

10.3.1 (2026-10-29)

Bug Fixes

  • apply the otp option in MailComposer too (1d4087f)

10.3.0 (2026-10-29)

Features

  • add the otp option for the OTP-Token header (7789e15)

Bug Fixes

  • encode a Content-ID header as a message id (#1904) (47f2b25)
Commits
  • 26555d0 Merge pull request #1906 from nodemailer/release-please--branches--master--co...
  • 3e5bb55 chore(master): release 10.3.1
  • 1d4087f fix: apply the otp option in MailComposer too
  • 488ce9c chore(deps): update development dependencies
  • 41eda65 chore(deps): update development dependencies
  • 5de343d chore(master): release 10.3.0 (#1905)
  • 7789e15 feat: add the otp option for the OTP-Token header
  • 47f2b25 fix: encode a Content-ID header as a message id (#1904)
  • a6e7a70 chore(services): add Groundmail (#1903)
  • a0cea19 chore(deps): update development dependencies [skip ci]
  • Additional commits viewable in compare view

Updates @nestjs/platform-express from 12.2.0 to 12.3.2

Release notes

Sourced from @​nestjs/platform-express's releases.

v12.3.0 (2026-10-27)

Features

Bug fixes

... (truncated)

Commits
  • a415cff chore(release): publish v12.3.2 release
  • 9576609 chore(release): publish v12.3.1 release
  • 3acb8e5 chore(release): publish v12.3.0 release
  • 0eef541 fix(deps): update dependency multer to v2.5.0 [security] (#18268)
  • 0c9db73 fix(express): map unsupported multipart content types to 415 (#18264)
  • 0fb57c8 fix(core,express,fastify,ws,socket.io): load adapters with an older core (#18...
  • cb4d9ff fix(express): end a head response for an empty streamable file (#18234)
  • a4d86df fix(express): leave 5xx http-errors errors unmapped so they are logged (#18232)
  • 769e89e fix(express): apply middleware to controller root routes in strict mode
  • 7ea8765 fix(express): map http-errors errors to http exceptions (#18214)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@css-inline/css-inline](https://github.com/Stranger6667/css-inline) | `0.23.1` | `0.23.2` |
| [tslib](https://github.com/Microsoft/tslib) | `2.8.1` | `2.9.1` |
| [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `12.2.0` | `12.3.2` |
| [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `12.2.0` | `12.3.2` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `10.2.1` | `10.3.1` |
| [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express) | `12.2.0` | `12.3.2` |


Updates `@css-inline/css-inline` from 0.23.1 to 0.23.2
- [Release notes](https://github.com/Stranger6667/css-inline/releases)
- [Changelog](https://github.com/Stranger6667/css-inline/blob/master/CHANGELOG.md)
- [Commits](Stranger6667/css-inline@c-v0.23.1...javascript-v0.23.2)

Updates `tslib` from 2.8.1 to 2.9.1
- [Release notes](https://github.com/Microsoft/tslib/releases)
- [Commits](microsoft/tslib@v2.8.1...v2.9.1)

Updates `@nestjs/common` from 12.2.0 to 12.3.2
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.3.2/packages/common)

Updates `@nestjs/core` from 12.2.0 to 12.3.2
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.3.2/packages/core)

Updates `nodemailer` from 10.2.1 to 10.3.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.2.1...v10.3.1)

Updates `@nestjs/platform-express` from 12.2.0 to 12.3.2
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.3.2/packages/platform-express)

---
updated-dependencies:
- dependency-name: "@css-inline/css-inline"
  dependency-version: 0.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: tslib
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@nestjs/common"
  dependency-version: 12.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@nestjs/core"
  dependency-version: 12.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: nodemailer
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@nestjs/platform-express"
  dependency-version: 12.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 10, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-ef1e8a4761 branch November 10, 2026 11:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants